The folks that run the website RTL-SDR have a comprehensive list of all the software defined radio (SDR) software, both commercial and free. That list can be found here:
I’ve decided to centralize the default password lists for multiple vendors. I’m making this a sticky post and will update this list when as I find these types of sites:
* http://bit.ly/2S6SToW – NETGEAR Default Password List
* http://bit.ly/2S37j9u – Linksys Default Password List
* http://bit.ly/2S3gPJV – D-Link Default Password List
* http://bit.ly/2S8KWzJ – Cisco Default Password List
* http://bit.ly/2S37FwQ – Default Router Usernames and Passwords (multiple vendors)
* http://bit.ly/2HrgT3O – Telnet, MySQL and other Linux and Windows service passwords courtesy of n0tazombie.
I have identified the following CTF labs which are 24/7 and most if not all are free:
- 24/7 CTF: https://247ctf.com/ (Added 11/7/2019)
- Immersive Labs: https://immersivelabs.online
- pwnable.xyz (good for people new to CTF): https://pwnable.xyz/
- 365 CSAW: https://365.csaw.io
- CTF101: https://ctf101.org/
- Shellter Hacking Express: https://shellterlabs.com/en/contests/
- Backdoor: https://backdoor.sdslabs.co/
- ShellWePlayAGame?: https://shellweplayagame.org/
- RootMe: https://www.root-me.org/?lang=en
- OverTheWire: https://overthewire.org/wargames/
- Virginia Cyber Range: https://portal.virginiacyberrange.net/
- Hack The Box: https://www.hackthebox.eu/
- FuzzyLand: https://fuzzy.land/
- Hacking Lab: https://www.hacking-lab.com/index.html
To everyone that made me aware of these thank you!
The folks over at Google have recently open sourced a modular security scanning framework called Tsunami. Right now it uses nmap and ncrack as it’s core underlying tools, but they built it in a modular fashion that makes integrating other tools easier and they also are focused on having no false positives which tends to be the Achilles’ heel of most vulnerability scanners.
SIGRed (CVE-2020-1350) was recently discovered by Checkpoint Security and is a vulnerability in Windows Domain Server (DNS) which will allow for anonymous remote code execution (RCE) by sending a malformed DNS response and will allow an attacker to run as SYSTEM. This has been in the Windows DNS Server since Windows Server 2003 and affects even Windows Server 2019 and could easily be turned into a self replicating worm. This has a CVSS score of 10.0 on a 10 point scale, which is the highest rating on the scale. A patch is now available from Microsoft.
While taking a look at the SMBGhost vulnerability, security researchers at ZecOps discovered another seperarate bug in the SMB compression subsystem that they are calling “SMBleed” (CVE-2020-1206). Microsoft has issued patches for both SMBGhost and SMBleed in June’s PatchTuesday.
I just read and article where a security research was able to take the SMBGhost (CVE-2020-0796) exploit, which was previously just a local privilege escalation, and make it remote and has the potential to be turned into a worm. SMBGhost is a vulnerability in the SMB3 compression feature. Microsoft has yet to release a patch.
- Arstechnica Article: https://bit.ly/2YppYBs
I posted about a back in February about a new Android bug in the Bluetooth stack (CVE-2020-0022). This is a nasty bug that affects Android 8-10 devices and requires no user interaction the attack just needs to be in proximity to any Android device that has Bluetooth enabled. In Android 8 and 9 it’ll gain remote code execution and in Android 10 it’ll just crash the Bluetooth stack. BlueFrag is the name of the exploit that takes advantage of this vulnerability.
- Article: https://bit.ly/2LoMmoe
I just read on the official DEF CON Twitter account that Dark Tangent has decided to cancel DEF CON 28 due to the COVID-19 pandemic. The good news is he said it was the “in-person” conference held in Las Vegas, so there is still hope that they will have a virtual version of it just like Way West Wild Hackin’ Fest did in March for their in-person conference for the same reason.
- DEF CON Twitter Post: https://bit.ly/2WHXSR3
ProxyJump makes SSH’ing from a bastion to hosts behind it very convenient and it is built into SSH since v7.3. It makes use of the ProxyCommand underneath the hood that will dispatch commands to another SSH connection and display the output and has been in SSH for a “long time” according to the article.
- Article: https://red.ht/2YM5CnJ
I guess one of the benefits of being on lockdown is that security engineers have a lot of free time on their hands to create new Linux distributions and in this case there are two new Linux distros that have been developed focusing on software defined radios.
- DragonOS – DragonOS LTS an out-of-the-box Lubuntu 18.04 based x86_64 operating system for anyone interested in software defined radios. All source installed software is located in the /usr/src directory while the remaining software was installed by package managers. This is a brief summary of the software included, while not complete, it covers the bigger named packages and some of the drivers installed for the various supported SDRs such as the HackRF One, RTL-SDR, and LimeSDR. This distro includes the following SDR related tools: Universal Radio Hacker, GNU Radio, Aircrack-ng, GQRX, Kalibrate-hackrf, wireshare, gr-gsm, rtl-sdr, HackRF, IMSI-catcher, Zenmap, inspectrum, qspectrumanalyzer, LTE-Cell-Scanner, CubicSDR, Limesuite, ShinySDR, SDRAngel, SDRTrunk, Kismet, BladeRF
- Gorizont-rtlsdr – This distribution contains only RTL2832U chipset family rtl_sdr drivers and modules, and concentrates on providing terrestial HF/VHF/UHF signal processing and portable DAB+ reception with the cheapest and most available equipment. No other devices are supported. This distribution is intended for experimentation and legal listening purposes only. NOTE: No TETRA or similar trunked system decoders are included in this distribution for legal reasons.
I just found out from chutzp4 our own 5n1p3r came in first place this week in GRIMMCon’s COBOL CTF. Everyone join me in congratulating him on his achievement!