KVM, virsh and virtual machine manager r0ck!

Just bought a sweet little 2x4 xeon server with vtx and 16GB of ECC RAM from ebay. First off you get what you pay for. It took me 5 hours of messing around to realize the bios switch setting for vtx was backwards. E.g. ON==OFF. Uggh The box in question is made by Rackable Systems and its got an Intel® Server Board S5000PSL. Its really a great machine but the bios is a little like...messed up. Anyway....if you are patient it all works great. My next task was to install Ubuntu and get some virtualization software up. I first started with my own copy of vmware 8, but turns out vmware8 workstation isn't supported well with ubuntu 14. So then I tried VirtualBox..which worked great. What I really wanted though was to run a couple of vms headless and after doing some research decided that KVM with the virsh tools was really the way to go for a quick win. I had a pre-built vmware image of free-pbx which I had used a couple years ago to run a VOIP phone system in the house. I decided that would be the first image I got running.

 1. Convert the image to a qemu compatible one qemu-img convert -p "CentOS 64-bit.vmdk" pbx.qcow2

2. Move the image to /var/lib/libvirt/images 

3. Install an entry for the new machine using the disk image you made sudo virt-install --import -n fee-pbx1 -r 2048 --disk path=/var/lib/libvirt/images/pbx.qcow2,bus=virtio --network network=default,model=virtio --graphics vnc,listen=0.0.0.0 --noautoconsole -v

 4. Make sure it autostarts when the host reboots virsh -c qemu:///system autostart fee-pbx1

After this I found a cool tool called Virtual Machine Manager which lets you ssh into the host machine and manager all your runnning images. This is on par with Vmware ESXi but it's free and really easy to install. You should ideally install virt-manager on your regular development workstation and remote into the vm host. I run centos on my dev box and virt-manager can be installed with yum.  Screenshots attached to highlight how sweet these tools are for a light user who wants persistent vms.

Undocumented NtQuerySystemInformation Structures (Updated for Windows 8)

Regarding this guys disclosure about more undocumented NtQuerySystemInformation options.


http://www.exploit-monday.com/2013/06/undocumented-ntquerysysteminformation.html


....Isn't it about time Microsoft realized that the emperor wears no clothes?  I mean seriously.....high school students are reversing win8 now.....there is nothing that is undocumented any-more.

FFS....give it up....document everything on MSDN and move on guys.   You waste everyone's time  and make stupid AV companies Rich.  Let worry about embedded systems and all the chinese crap that never gets updated or is back-doored with vulns (uhhhhhh  Huawei anyone....)

IronKey data loss

Key Points
======
1. Never use an IronKey again
2. Wonder why IronKey uses FAT32 as a 'safe' partition type...with the expense, why not include a small capacitive charge to safely protect data on a proprietary, fault tolerant file system...?????
3. Once your data gets corrupted, use dd_rescue and photorec.  I love these tools, they saved me tons of time and $$.

Steps to recover data:
1. mount the partition in linux with the ironkey app
2. don't examine the files!!!!!
3. use dd rescue immediately and save the usb partition to an image file
4. change the image file to read-only
5. use photo-rec to carve out the files you want (un-select all file types, then select only the ones you are interested in)

Steve Jobs

I remember riding my bike over to my friends house to write BASIC programs on their Apple II computers and play "Wizardry". It was absolutely amazing to me and began my passion for computers and electronics. It was a sad day with the loss of an American treasure in Steve Jobs.

There are a couple of quotes that come to mind when one thinks about Steve Jobs and Apple

"The average man is a conformist, accepting miseries and disasters with the stoicism of a cow standing in the rain."

"The mind has exactly the same power as the hands; not merely to grasp the world, but to change it."

Jobs was definitely not a conformist and got run out of Apple because of it 1985, but he kept going....coming up with new ideas and innovations with both his hands and his mind. His inventions were a lesson in physical elegance and technical soundness. Extremely useful yet beautiful. Apple eventually bought one of the most innovative companies of it's time; Next who's founder was Jobs.

"...Although Apple was interested in investing in Jobs' startup, they were outraged, and actually sued Jobs later in 1985 when they learnt about the five Apple employees joining him. Apple dropped the suit early next year after some mutual agreements. The startup was NeXT Computer, Inc. "

He loved his passions and stayed with them until the very end. We should all take stock in the life of Steve Jobs and what many positive changes he has effected globally.

OpenRG Deobfuscate in C

http://www.zibri.org/ Did this in a java script. I ported it to C. Have fun deobfuscating during the holidays!

#include 
#include 

char szDeobfuscated[4096];
int key[] = {86, -12, -17, 80,   52, 169, 
-17, 107, 85,  75,   3,  60, 154,   1, 
120, 179,-3,  177,  61, 211, 155, 210,
 203, 159,  6, 209, 209, 101, -24, 189,  
45, 159, 177, -17, 141,216, -12, -4, 187, 
195, 184, 161, 11, 174, 61, 193, 46, 174,
 -29,84, 7, -15, 10, 90, 208, 138, 120,
 4, 6, 50, 134, 44, 172, -14};

void DeobfuscateString(char *enc) 
{
 int code = 0;
 int z = 0;
 int cDeobChar = 0;
 char tempnum[5]; //e.g. 0xAB
 int i = 0;
 char *tmpstr = szDeobfuscated;
 char a = 0;
 char b = 0; 
 int length = 0;
 
 if(NULL==enc)
  return;

 length = strlen(enc);

 if(length> sizeof(szDeobfuscated)-1)
  return;

    printf("Decoding %s of length %d\n", enc, length);


    for (i = 0; i < length; i++)
    {
        //check for ampersand '&'
        if (enc[i] != 38)
        {
            code = enc[i];
        }
        else
        {
            //if it's an ampersand
            i++; //skip over it
            //take the next two characters and make a hex value out of it e.g.
            //&ad would become 0xAD  
            memset(tempnum,0,5);
            a = enc[i++];
            b = enc[i++];
            sprintf_s(tempnum,5,"0x%c%c\0",a,b);
            sscanf_s(tempnum,"%x",&code);
   
        }

        cDeobChar = code - key[z];

        if (cDeobChar < 0)
        {
            cDeobChar = cDeobChar + 255;
        }

        *tmpstr++ = (char)cDeobChar;
        z++;
    }
    printf("\n\t%s\n",szDeobfuscated);
    return;
}

int main(void)
{
    memset(szDeobfuscated,0,4096);
    DeobfuscateString("&ad;Y&5b;&b3;&a3;&17;T&8b;&c4;&b9;#&96;&04;c&ea;&1d;$%&5d;&16;&08;B3&c0;");
    memset(szDeobfuscated,0,4096);
    DeobfuscateString("&97;50&91;u&ea;0∾&86;|4m&cb;2&a9;&e4;");
return 0;
}

vmware fusion and kernel debugging

Server (Vm Target to be kernel debugged)
========================================
serial0.present = "TRUE"
serial0.pipe.endPoint = "server"
serial0.fileType = "pipe"
serial0.yieldOnMsrRead = "TRUE"
serial0.startConnected = "TRUE"
serial0.fileName = "/tmp/kdpipe"


Client (Vm Where you run windbg)
=============================
serial0.present = "TRUE"
serial0.pipe.endPoint = "client"
serial0.fileType = "pipe"
serial0.yieldOnMsrRead = "TRUE"
serial0.startConnected = "TRUE"
serial0.fileName = "/tmp/kdpipe"


On the target to be debugged
=============================
bcdedit /copy {current} /d "Microsoft Windows Vista [debugger disabled]"
bcdedit /debug ON
bcdedit /set {current} debugtype SERIAL
bcdedit /set {current} debugport 1
bcdedit /set {current} baudrate 115200
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /v DEFAULT /t REG_DWORD /d 0xffffffff


_NT_SYMBOL_PATH=srv*c:\symbols*http://msdl.microsoft.com/download/symbols

awk

Why are people from China trying to login to my computer? I don't understand....

for i in `cat auth.log.1 | awk '{print $13}'|sort -n |uniq`; do whois $i |grep person; done
person: Chyi-Chuan Yang
person: Seednet Seednet
person: Haibo Ma
person: Ruixin Wang
person: Haibo Ma
person: Ruixin Wang
person: ChinaUnicom Hostmaster
person: Wei Wang