The Trusted Insider @secureagc - Tumblr Blog

Restore macOS Battery Life Indicator with 1 String

As inaccurate as it may be the menubar battery indicator is still useful when you start taxing the system and need to have an idea of how fast the battery is draining. While macOS 10.12.2 may have removed the indicator from the UI, a quick fix can bring it back! Here is a quick breakdown;

Use a version of macOS prior to 10.12.1 and copy it’s “Battery.menu” file from it’s system to the current box running 10.12.2;

/System/Library/CoreServices/Menu Extras/Battery.menu

If you don’t have an older system and don’t want to go through the hassle of finding the “Battery.menu” file on the internet you can use the following command to pull it down from my private Dropbox share;

wget https://www.dropbox.com/s/tr70dkpl6k6l1i3/macos-10.12.1-batterymenu.zip?dl=0

For the more security conscious folks the MD5 is as follows;

c9824d4e1e79f2d2b0f68bc220325377

Stringing three commands together we get;

wget https://www.dropbox.com/s/tr70dkpl6k6l1i3/macos-10.12.1-batterymenu.zip?dl=0 && sudo tar -xvf macos-10.12.1-batterymenu.zip\?dl\=0 && sudo rsync -av ./Battery.menu /System/Library/CoreServices/Menu\ Extras/

Nothing crazy, just #wget, #tar, and #rsync!

#macos #battery #time #apple #easy

Customized Google Video Conferencing (GVC) URI’s

There are countless ways to hold a video conference these days, FaceTime, Skype, Google Hangouts, etc but after having used Hangouts every day for roughly a month it’s hard to break the habit when scheduling meetings.

If you’re a Google Apps customer your whenever you schedule a meeting or create a custom Hangout, links will follow the following URI structure;

“https://hangouts.google.com/hangouts/_/[example.com]/[hangout name]”

Customizing the name of the Hangout is easy, just enter a unique string of characters ‘custom-hangout-name’ without spaces and that’s it! For non-Google Apps customers Hangout names will be generated as a string of 28 alpha numeric characters which cannot be customized;

“https://plus.google.com/hangouts/_/b6me2u5zwrgztobjobqmtge23qe”

While the Google Apps URI is incredibly customizable it is not fast or simple to type out. URL shortening services can be used to address this deficiency but unless time has spent to create one people will still be sent hyperlinks. What is the fastest and most simple way to solve this issue? We can leverage Apache to rewrite some URI’s or just use some Javascript;

.htaccess - hangouts.example.com

RewriteEngine on RewriteBase / RewriteCond %{HTTP_HOST} ^[sub domain].[example.com]$ [NC] RewriteRule ^(.*)$ https://hangouts.google.com/hangouts/_/[example.com]/[hangout name]?hl=en&authuser=1 [R=301,NC,L,QSA]

javascript - example.com/hangouts

<html> <script> window.location = "https://hangouts.google.com/hangouts/_/[example.com]/[hangout name]?hl=en&authuser=1"; </script> </html>

Now it is incredibly easy to verbally communicate where everyone needs to navigate to for an quick and impromptu meeting. It is worth mentioning that individuals who wish to join the meeting need to authenticate to Google and request access to the Hangout - preventing people from randomly joining!

#gvc #hangouts #google #video conference #asap #meetings #scheduling

Proxy'n Chrome + OSX

Over all of these years one of the most irritating issues with Chrome has always been the inability to easily define proxy settings independent of the underlying operating system. It is surprising the number of individuals who do not dig deeper and assume that the functionality is not available. The following syntax will spawn a new instance of Chrome if one is not running;

open -a "Google Chrome" --args --proxy-server="socks5://127.0.0.1:8081"

It is pretty difficult to find someone who isn't in love with SSH and Chrome these days but this should help win a few more over. The next six commands walk through the entire process easily to establish a standard SSH SOCKS proxy in OSX;

curl ipv4.icanhazip.com ssh -D 127.0.0.1:8081 [email protected] killall "Google Chrome" open -a "Google Chrome" --args --proxy-server="socks5://127.0.0.1:8081" chrome://net-internals/#proxy curl ipv4.icanhazip.com

The net-internals URI will help verify that the settings have taken affect. If the following text pops up, something went wrong.

Use DIRECT connections. Source: SYSTEM

#osx #chrome #socks proxy #ssh #informational

Everyone takes notes for referencing; this not just within the security community right? 'RTFM: Red Team Field Manual' was published earlier this year which included syntax for referencing during engagements. While I am sure almost all of us have something akin to this, these folks went one step further and published their collective notes which quickly exploded within the community.

Now if we go back in time a few years to 2011, I had posted a quick note on Evernote, maintaining syntax and config files with shared notebooks. Maintaining a word document or a flat file wasn't ideal for me, so I thought I'd share how I curated my notes [nothing too special or revolutionary].

Since then, my notebook has gotten a bit larger and more useful, not to mention there appears to be a massive demand for this type of material. Even at DEF CON 22, during my talk, the slide that got the most attention was the one listing a bunch of tools.

Having a list and access to all the tools in the world [BackTrack/Kali] won't make a lick of difference if you don't know how to when to use them. While most of us aren't security researchers or currently have the ability to make a big splash within the community, we can give back in some small way, these notes will prioritize and expand on the tools that we all are using to make our lives easier.

#rtfm #redteam #referencing #tools #backtrack #evernote #efficient #sharingiscaring

Perhaps the deprecation of Adobe Creative Suite 6 earlier this year [June 1st 2014] is a good thing. Wonder if Creative Cloud has the same requirement..

#adobe #java #huh #creative suite

The Apple App Store & Evernote

Have you been wondering why Spotlight isn't pulling up your notes that you've been storing within Evernote? It's not an operating system issue, throw the 10.9 & 10.10 troubleshooting out the window right now.

There is a slight versioning discrepancy, between the current version [5.7.0 - October 2014] which is available straight from the Evernote site and the version available within the App Store [5.5.1 - April 2014].

Evernote introduced Spotlight integration with release 5.6.0 on September 22nd 2014 and it seem as though the App Store version has remained at the 5.5 release.

Quick & simple fix;

- Completely remove the Evernote installed through the App store via Terminal or through a third party application 'Trash Me' or 'AppDelete'

mdfind -name "evernote" | xargs rm -rfv

- Download and install new version

- Force Spotlight reindex

mdimport -r /Applications/Evernote.app/Contents/Library/Spotlight/EvernoteSpotlightImporter.mdimporter

#evernote #spotlight #osx #versioning #appstore #terminal

The Java Saga

Did you just recently upgrade to OSX 10.10? Were you for some ungodly reason running Java? If so, unless you moved your JDK & JRE directories, they're all gone! No big deal! Who wanted Java anyway right? Well if you're running applications such as BurpSuite natively within OSX, you're going to need an older version of Java for all of the features to function.

Addressing this issue is rather simple, download the versions you need and manipulate your bash profile through a variable which is then placed in your path and switch versions through commenting of that initial path variable.

#export JAVA_HOME=(/System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/)

#export JAVA_HOME=(/System/Library/Java/JavaVirtualMachines/jdk1.7.0_67.jdk/Contents/Home/)

export JAVA_HOME=(/System/Library/Java/JavaVirtualMachines/jdk1.8.0_20.jdk/Contents/Home/)

export PATH="/usr/local/bin:/usr/local/sbin:/opt/msf:/usr/local/heroku/bin:$JAVA_HOME/bin:$PATH"

Simple huh? No mucking around with symlinks or the miserable Java manager UI. Uncomment the version you want and boom, done.

For all the new folks, we'll go over the steps on how we exactly got to this point along with some history.

With a clean upgrade/install the process is insanely simple. Download the required JDK DMG(s) that you want.

- Oracle Download Page - Legacy Apple Java Download

Note, Apple maintained its own installation of Java prior to 1.7 and no longer supports Java whatsoever. If your application requires a legacy version and you're running OSX, there aren't that many other options.

Prior to moving on, it's important to understand the difference between JRE & JDK packages. JRE is merely a Java VM which runs Java applications whereas the JDK includes development resources as well as the JRE itself.

Oracle currently installs the JRE package in the following directory

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java

Since we want to run Java 1.6, 1.7, and 1.8, let's assume that we've already downloaded them and executed the necessary packages to install them.

We're going to find the older Java 1.6 installation within this directory.

/System/Library/Java/JavaVirtualMachines/

Navigating to the following directory should show you the 1.7 and 1.8 installations.

/Library/Java/JavaVirtualMachines/

In the initial example above you'll notice that all of the JDK's were in the same directory. That's simply because I just moved them post installation to reduce a bit of complexity.

Otherwise we're going to define a variable and export it all within our bash profile, let's call this 'JAVA_HOME', which will point to the specific Java version we want.

export JAVA_HOME=(/System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/)

We can create multiple variables with different paths and simply comment out the ones we don't want. Now we'll just throw that variable into our path and bam, Java.

$JAVA_HOME/bin:

This isn't new information by any means, I spent a considerable amount of time attempting to move or reconfigure the Java 1.6 directory structure over to the /Library/Java/JavaVirtualMachines directory and decided to simply leverage the common approach to the situation only after a few hours.

With the 1.6 installation of Apple's Java '/usr/libexec/java_home' symlink points to '/System/Library/Frameworks/JavaVM.framework/Versions/Current/Commands/java_home'. Why do I bring this up? There is a difference between framework and virtual machine directories that Apple had created, the frameworks folder has symlinks from previous Java versions everywhere.

To modify or make changes here breaks a number of things. If you need Java 1.6 simply install the Apple package and leave it alone. At the time Java was built into the operating system as an OSX framework for developers to play with. The intricate linking was designed to accommodate design decisions from previous versions and was not meant to be used directly.

- Legacy Apple Java Development Page

While anyone could sit down and read why Apple deployed Java the way they did or the directory structure, I thought I'd save a few people a bit of frustration.

Also if you're intentionally running Java, even worse, legacy versions of Java, please do your due diligence in locking down your system as it will not only protect your box but also the environments that you connect to and individuals you communicate with.

#java #apple #burpsuite #osx #bash profile #yosemite

Ambiguity is insecurity

via twitter @sergeybratus

#security #insecurity #obscurity

Metasploit Prompt Customization

During assessments when I find a foothold, I just jump straight in and often times forget to note the exact time to the minute of when I was initiating certain attacks and not always do I have MSF spooling enabled. Where does that leave us? How can we be proactive about a forgetful mind? We can customize our msf prompt to show the timestamp in a non-intrusive manner! Through the modification of the .msf4/config file we can configure our prompt to show the exact format we'd like to see!

[framework/core]

setg PROMPT %clr%T%clr %undmsf%und

setg PromptTimeFormat=%m-%-d-%y %H:%M:%S %p

Which will format the prompt as Month-Day-Year Hour:Minute:Second AM/PM. How easy was that? Save the configuration file and boot msfconsole up!

Resource - Mubix's Blog MSFConsole Prompt Fiddling

#metasploit #prompt #command line #time #formatting #msf

OpenBSD MOTD System Information Suppression

Each and every time you login, you get that pesky MOTD that goes ahead and spits out the operating system, kernel, and other unnecessary version information! Not to mention if you want to have any sort of a custom daily message, you have to leave the first line blank. While deleting a few lines in the '/etc/rc' is an old trick when it comes to OpenBSD, it will suppress that pesky system information!

# patch /etc/motd if [ ! -f /etc/motd ]; then install -c -o root -g wheel -m 664 /dev/null /etc/motd fi

if T=`mktemp /tmp/_motd.XXXXXXXXXX`; then sysctl -n kern.version | sed 1q > $T echo "" >> $T sed '1,/^$/d' < /etc/motd >> $T cmp -s $T /etc/motd || cp $T /etc/motd rm -f $T fi

After this modification, you don't have to worry about leaking that first line blank, just go ahead and use all of the '/etc/motd' file to your wildest wishes! It's the little tweaks in life that make it all better!

#OpenBSD #MOTD #annoying #kernel #informational

Quick & Easy "IRSSI-D"

Even with a UPS and a battery backup, systems tend do go down due to unforseen circumstances (tripping over a cable, rewiring the media center, cleaning, etc) and when they do come back online, it's always better when they pick up where they left off by restoring certain services. Below you'll find a sample '/etc/rc.local' file which looks pretty normal.

echo 'starting custom daemons: ' if [ -x /usr/local/bin/noip2 ]; then echo -n 'noip2 '; /usr/local/bin/noip2 fi echo -n ' irssid \n'; /usr/bin/su - pushpin -c "/usr/local/bin/screen -dmS IRC irssi"

The neat command that I've been using to start irssi within a named screen session on boot is the last bit of code there. Echo prints to standard out, 'irssid' and starts a new line shortly thereafter. After echo, the following command switches users to a specific user 'pushpin' so any consequent commands are issued as that user. Screen will now be run as pushpin and has been started with a few variables, 'd' being detach, 'm' disregards the $STY environment variable, and lastly 'S' labels the screen session. Within the screen session, 'irssi' initializes the irc client.

#irssi #boot #rc.local #screen #echo #irc #su

I Can Haz External IP Address via Command Line?

Want an extremely easy way to find your external IP address without opening up a browser? Do you have curl installed? If the answer to both of the previous questions is a resounding yes, then simply enter the following command into a Linux or Unix terminal prompt and you're good to go!

curl icanhazip.com

However, if you're on a Windows system and have access to PowerShell 3.0 or newer, you can use the following syntax.

Invoke-WebRequest icanhazip.com

While the curl syntax is easier to remember, they both produce the same result, an external IP address!

#command line #windows #linux #unix #curl #powershell #icanhazip #external ip address

I don't always execute malicious code, but when i do, I do it on your box.

via twitter - @hevnsnt

#security #meme #funny #joke #malware

Iron Key + Mountain Lion = Iron Mountain Lion Key?

While this is certainly not a new issue with IronKey, historically it has had a few difficulties with mounting and permissions within non-windows environments, I thought it might be beneficial to throw an article out there with some updated syntax for OSX. If you recently got your hands on one of the newer Iron Keys, you may have had some issues mounting your encrypted volumes within OSX 10.7 & 10.8, however do not fear, the command line hero is here!

I've simplified the entire process down to a single command.

echo -e "sudo chmod 644 /dev/rdisk2* \n/Volumes/IronKey/IronKey.app/Contents/MacOS/IronKey" > iron.sh && chmod 755 iron.sh

This command will create a bash script called iron.sh, change the permissions of the script so that it can execute, which then can be run to change the permissions on the partitions within the IronKey itself so that OSX can appropriately read the partitions to mount the device!

#IronKey #OSX #chmod #bash #echo #lazy #mount

Hide n' Seek with Amazon eBooks on OSX

Looking for those pesky Amazon eBooks you purchased? Do they keep moving that darned folder on ya? The following simple find command will simplify your life!

find . -name *.azw

This is assuming you're running OSX, have purchased an eBook from Amazon, and have the Kindle app installed and the book synced to that system.

#OSX #Amazon #eBooks #find #syntax

Disabling Apple Mail Attachment Preview

Are you bothered when OSX Mail decides to preview the email attachments you send off to your colleagues? The following command will disable the automatic preview of attachments in Apple's Mail application.

defaults write com.apple.mail DisableInlineAttachmentViewing -bool true

To re-enable the preview, merely change the boolean attribute to false as such '-bool false' simple as that!

#OSX #Mail #Apple #Email #Efficiency

Bash History Spring Cleaning

Let's start off this month by cleaning up our bash history, often we find that it is filled with duplicate commands and silly things that simply shouldn't be there.

cat -n .bash_history | sort -k 2 | uniq -f 1 | sort -n | cut -f 2- > temp && mv temp .bash_history

This command will read the '.bash_history' file and append numbers to each line, then sort will organize the data in the second column, uniq will remove any duplicate lines, sort will then again organize the data numerically, and lastly cut will only display the commands instead of the line numbers that we had inserted. We will then output to a temp file and then move that file over our bash history file. At this point, simply close the current terminal window and open up a new one! You'll notice that your history has been significantly cleaned up.

Hmmmm, that's not very efficient is it? Well let's slipstream this badboy. Since I'm using OSX 10.8, I've got two files I must deal with, a '.profile' instead of the usual '.bashrc' Generally, the first file is loaded upon login, while the second file is loaded upon the generation of an interactive shell. Since OSX is a little different, I've included the following information underneath my path in my '.profile'; for the sake of clarity I've commented what each line does. With this file configuration we'll have a clean bash history moving forward within OSX.

# append rather than overwrite the history file shopt -s histappend # maintain multi-line commands shopt -s cmdhist # save each command as it is executed PROMPT_COMMAND='history -a' # do not allow for duplicates and ignore white space export HISTCONTROL=ignoredups:erasedups:ignorespace # massive history size and file size export HISTSIZE=100000 export HISTFILESIZE=100000 # rvm scripts [[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"

We mustn't forget to execute 'source .~/profile' otherwise we must quit out of our terminal session and open up a new one.

#OSX #BASH #HISTORY #SPRINGCLEANING #export #sort #uniq

Trending Blogs

Recently Viewed Blogs

The Trusted Insider