Where
A = minutes (0-59)
B = hours (0-23)
C = day (1-31)
D = month (1-12)
E = week day (0-6 where 0 is Sunday)

The following are examples for:
– Execute /bin/do_something.sh at 9:40 PM from monday to wednesday
– Execute the script every 15 minute and every day
– Execute the script every 21st and 44th minute on every hour and every day, but only in December

Other interesting options:
@reboot = Run once, at startup
@yearly = Run once a year. Like “0 0 1 1 *”
@annually (same as @yearly)
@monthly = Run once a month. Like “0 0 1 * *”
@weekly = Run once a week. Like “0 0 * * 0”
@daily = Run once a day. Like “0 0 * * *”
@midnight (same as @daily)
@hourly = Run once every hour. Like “0 * * * *”

This execute /bin/do_something.sh once, at startup:

How can you manipulate the output?

By default the output is sending to the user (root) mailbox, but it can be redirected.
This Add a row to the file do_something.log inserting output and errors:

Send a mail to me@mydomain.com:

Trash all output:

Some scenarios:
– Sniffing traffic
I setup a RAP and start wireshark, ettercap or another network sniffer. Every connections that pass through my PC are intercepted.
– Phishing
I setup a RAP and force it to use mine DNS Server. If someone will connects to me and start to surf I am able to redirect traffic using my DNS. In this case I can implement some kind of phishing.
– Company network back door
I setup, may be using a small RaspberryPi, an access point using the Company network as wired interface. This is an hot spot directly connectet to the Company LAN.
– Caffè-Latte attack
Locoking at the wireless packets you can see the client trying to connect to the previusly registred access point (eg. MY_NETWORK). I Can setup an access point using the same SID the client is searching for. When the client, that is serching for a known SSID, find my RAP named MY_NETKORK it immediatly try to connect. I can use this connection to sniff WPA handshakes or WEP packets and try to decode passwords.
– Extend my connection
I have a notebook connected to a LAN but no access point. I also have a smartphone and I want a wireless connection on-the-fly.

The basic configuration:
– eth0, the wired connection linked to the network
– a DHCP server working on the LAN where eth0 is connected
– wlan0, a wireless interface able to be setted up in monitor mode

I start the monitor mode on wlan0:

This will create the mon0 interface.
Now I setup an AP on mon0, named “MY_network”, channel 11 and WEP autentication. I can also set it as a free wifi without password (airbase-ng --help).

This will create the at0 interface.
Now the AP is started, in another terminal window I make a bridge named rougue-bridge and link at0 to eth0 using the bridge-utils. Note that in Kali Linux the bridge-utils have to be installed (apt-get install bridge-utils) in order to use brctl command.

I can release the IPs of eth0 and at0. This is because the two interfaces are now integrated in the virtual bridge and don’t need an IP anymore:

I need also the IP forwarding:

At the end I configure the test-bridge. Differently from eth0 and ap0 the bridge needs an IP of the LAN where eth0 is connected.

Note that these are temporary operations that will be discarded by rebooting the system.

Extra
Starting an AP to sniffing handshake.

-z sets WPA1 tags (2 = TKIP)
-W set WEP flag in beacons. The option -W 1 is recommended when using -z or -Z
-F where to store the cap file.

Here’s my old simple script to start a Rougue Access Point using Linux Bash. It may need some adjustment, but I think it will work.

On the local PC I start a logging process:

On the PC to test, maybe using a blind command:

Again on local PC I collect and normalize the log:

I based this Proof of Concept on the article “Blind Command Line Injection” from PenTest Magazine by Mr. Chris Duffy: thank you.

Configuration:
On the Kali distribution the ssh server is already installed so I have only to start it; I can do it using the menu Applications > Kali Linux > System Services > SSH > sshd start
After that I can immediatly connect from client using the user autentication

Ofcourse I want to secure the SSH server, so I stop the service and I will setup SSH to use an RSA authentication.
On server I create the keys using ssh-keygen command; this will create 2 keys:
– Public key, resident on the server, in my case it is called id_rsa.pub
– Privare key, used by the client, called id_rsa

As I said, the private key, has to be transferred on the client. I start a Netcat listener on machine called bt

On the server, the Kali machine, I connect to the listener and transfer the key

Note that NC file transfert is not a secure way to pass the key. That is why NC isn’t an encrypted channel. I use this method because I am in a lab/test environment.

On server I have to edit the file /etc/ssh/sshd_config to allow RSA authentication.

Is a good idea to remove user autentication too

I save the file and restart the service.
The last server operation is to add the id_rsa.pub key on the file indicated on sshd_config in the field AuthorizedKeysFile

Note that I have to add the key (>>) to the file, not to overwrite it (>), since I can have more than one publik key stored in the same file.

I move on the client and give the right permission to id_rsa (chmod 600 id_rsa). I am not used to store private keys on the default folder, but I prefer to store it in an encrypted folder and then to use the -i option of the ssh client.

Ok, let’s try the access using my new RSA key

Remember that is good:
– To store your private keys in a protected place
– To create keys with strong password
– To hardening sshd_config (eg. disable root access)
– To take a look at the auth file log (/var/log/auth.log)

An alternative, when the operating system is working, is to take the two twins files present in folder c:\windows\repair\ that the system create as a backup. This work up to Windows XP (think also Vista), but I can’t be able to find these files on Windows7. If you know something more, write me.

Once you have the files you use bkhive to extract the bootkey:

Then put together the bootkey and the SAM file:

And then try to crack the hash:

This is just an exemple of use of this tools. To crack hash you can algo use google that is always the bigest resource.

The target is a Linux system.
Using Pyton:
After you get a Netcat remote shell execute

This is non completly interactive, but is better than before.

Is Better to use socat that is a more complex variant of netcat.
Listener:

Client:

This is a full interactive remote shell

The target is a Windows system.
I suppose that in Microsoft environment you don’t have pyton or socat, although the two programs have Windows binary.
So the better way I found is to start a telnet server. Googling I found some stand alone programs like TelnetD. Note that isn’t a free software, but you can try it using the Trial Version.

Download and install vsftpd:

If you want to allow local users to log in and to allow ftp uploads you have to edit file /etc/vsftpd.conf uncommenting the following:

Also set this parameters:

To secure your server, disable anonymous access if not required:

If you wish you can also modify the banner present in vsftpd.conf, but this is usefull only to prevent simple banner grabbing. A specific tool such as NMAP will discover your server version anyway.

Now create the file /etc/vsftpd.chroot_list and add the local users you want allow to connect to FTP server.
Start service and test connections: