Image/Apple

Image/Apple

If you’re geeky enough to be reading this blog, then chances are you’ve likely got more than one computer on your home network. Every geek worth his or her salt knows how to set up a Windows machine for remote desktop connections outside of the house, but not every geek may know how to set it up to work with multiple computers on the same home network, sharing the same IP address. Today, we’ll share with you the secret to get it to work with all your Windows computers and how to access them.

To get your first remote desktop PC setup, you had to enable it on your computer through the advanced settings. Right click on My Computer and select Properties to bring up the System Properties (or use the Windows-break shortcut).

Click on the Remote tab and make sure “Allow users to connect remotely to this computer” checkbox is checked under the “Remote Desktop” pane.

Click OK. On your router, you had to also open up port forwarding on port 3389 to your computer, the default port that Windows remote desktop connection uses. Doing this requires a few steps. The first is to get your computer’s internal IP address, the one that your router uses, open up a command prompt by clicking Run –> Start and typing “cmd”. Then type “ipconfig” in the console and get your IP address.

With that, you need to get to your router setup and do something similar below, except the port is 3389, not 41952 as indicated. Your private IP is the IP you got from ipconfig, and the private port is the port on your PC that you want to forward the remote desktop connection to. The public port is the external port on your router that accepts the incoming connection. To make things simple, just keep these the same.

So… You did all this before, right????

To set up a second computer for remote desktop using the same IP address, simply enable remote desktop connections as indicated in the first step. But after doing so you need to change the default port so that it does not interfere with your existing port usage. Since 3389 is already taken, we’ll use 3390. To change the default port, open up the Windows registry editor by clicking Start –> Run and typing “regedit”.

Navigate to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp\PortNumber

Double click the PortNumber key, select the “Decimal” radio button so the number is readable, and change the value data to 3390. Then click OK and close the registry editor.

Again, get the IP address for the second machine, remember it, then add a port forward in your router settings, this time using 3390 as the port number. Remember that this will get forwarded to the internal IP of your second machine, not the first one. Repeat this process for any remaining computers and simply use a new port number for each one so there are no overlaps.

To connect to your computer from any other Windows machine in the world with remote desktop, you need to know the external IP that your IP provider assigns you. In the remote desktop connection settings, let’s assume your IP is 10.11.12.13 and you wish to connect to a computer you’ve set up to listen on port 3390. Start Remote Desktop Connection by clicking Start –> Accessories –> Remote Desktop Connection. In the dialog, fill in the computer in the format <IP address>:<port> so in this case it would be 10.11.12.13:3390.

Congratulations, you have now set up multiple remote desktop connections using the same IP address on your home network and are now among elite nerds. Now go eat some cheese.

The Touchpad Pro app for the iPhone developed by Jahanzeb Sherwani will turn your iPhone into a wireless, remote trackpad, which gives you direct access to your computer as if you were using a mouse or touch device for input. The latest native iPhone application Touchpad Pro app is based entirely on VNsea.

You can do just about anything on your iPhone as a wireless touchpad as you could with the touchpad on your computer. You can move the mouse around, click, double-click, and even drag (double click but keep it pressed and then move around). Vertical scrolling is even possible, by click-and-dragging on the right edge of the iPhone screen. You can thus use it to control videos, show pictures, or advance slides in a presentation.

To install the native iPhone Application you will need to jailbreak your iPhone or iPod Touch. Here are instructions on how to to install Touchpad app:

1. First you need to jailbreak your iPhone to allow third-party applications to be installed.
2. Add the repository required to install Touchpad to your Installer.
   • Click on the Installer Icon.
   • Skip to step 3 to see if you already have Touchpad Pro in your sources. Otherwise follow these steps and click on the “Sources” icon at the bottom.
   • Click “Edit”.
   • Click “Add”.
   • Enter: “http://cnp.qlnk.net/”.
   • Click “OK”.
3. Install Touchpad Pro from the Utilities category.
4. Install VNC on the machine you want to control and get your PC’s IP address from the taskbar icon when you finish.
   • 
5. Launch Touchpad Pro
6. On the VNC servers page click the “+” icon
• 
7. Then follow these instructions:
   • 
8. The session name (e.g. mediapc) will now be added to the list of VNC servers. Tap it to connect.

(sources: iphonehacks and touchpadpro)

Recently I bought a new Linksys WRT150N wireless router because I was fed up with my current one and because I had heard the famed DD-WRT firmware could be installed on it, effectively turning a cheap router into an expensive one. My old SMC router would drop connections about once a month and it really lacked the customizability that I required for my networking needs. For example, do you know how much of a pain it is to forward port ranges one port at a time with a 10 port limit? I also was not able to assign static IPs to my computers within the subnet (though to give my even older router credit, I could do this before).

I’ve documented the steps so you can follow along too should you decide one day that your standard router firmware just isn’t doing enough for you. Though these steps are for the Linksys WRT150N and WRT160N routers, they are pretty much applicable to any router (that can support DD-WRT that is).

1. Find out if your router can support DD-WRT firmware or before you purchase a new router, check this list beforehand. It also helps to do a bit of research by reading user comments. I first found out the WRT150N could support DD-WRT by reading user comments on amazon and then later confirmed on newegg and confirmed the same for the WRT160N.
2. To figure out which firmware version to download, you’ll need to know the chipset maker. For the WRT150N, it has a Broadcom chip so download the binary from the Broadcom folder. To find out which chipset your router has, figure it out from the supported devices list and use that to figure out whichi DD-WRT firmware to download. As of the time of this writing, I used the stable version of v24 firmware but this may change in the future. Always stick with the stable version, however.
3. Since the WRT150N router is v1.1, it has a gimped flash memory size so you actually need to install the “mini generic” version first to remove this limitation, then the “std generic” (again this information was revealed by reading through user reviews on the product). Make sure you download those two binaries and save them somewhere on your computer. You will use them in the next steps.
4. Connect the router directly to your computer and connect the power supply. Use any port but the blue Internet one. Do you see the picture above of that sticker taped over the ethernet ports on my router? Tear it off and laugh maniacally because you will not be following the instructions. Got a manual with a CD that you need to insert before you do anything? Toss it in the trash. These instructions are the only manual you’ll need.
5. Access the router setup page by opening a browser and visiting http://192.168.1.1/. The default login and password for my new router was admin/admin. If that doesn’t work try logging in as admin without a password.
6. Browse to the firmware upgrade page below
   • 
7. Click browse to load the mini generic .bin to replace the stock firmware. Once the upgrade completes you will get a continue button. Wait 5 minutes before clicking continue. Why? I have no idea, it was revealed during my research which may have been old information. But I waited to be on the safe side and besides the Laker game was on.
8. After the update successfully finishes, visit http://192.168.1.1/ again. Now that you have DD-WRT firmware installed, you need to login with default credentials as root/admin.
9. Browse to the firmware upgrade page below
   • 
10. Click browse to load the std generic .bin you downloaded earlier and reinstall the firmware. This will allow you to get over the 3MB flash memory limit and get a real tool on that router.

A notable tweak with DD-WRT is the Tx Power which allows you to amplify the antenna strength for a better connection throughout your house. Make sure you change your password as now you and everyone else who’s read this post now knows that root/admin can get into the router setup screen. Also check out an earlier post on a wireless speedup hack.


Images/Code Retard

First, download from Network Stumbler’s website.

Then install it and find out which channels other wireless networks in your neighborhood are on.
Then select a channel that is not near anyone else’s channels. This little tip I got when I used to work as an IT manager which helped when our company network was in the same wireless channel as 20 other companies.

Of course, this might not help your wireless network if you don’t have that much interference in the first place but it does help since 99% of all wireless networks default to Channel 6. Useful tip to remember hope it helps some of you out.

WPA is an encryption algorithm that takes care of a lot of the vunerablities inherent in WEP. WEP is, by design, flawed. No matter how good or crappy, long or short, your WEP key is, it can be cracked. WPA is different. A WPA key can be made good enough to make cracking it unfeasible. WPA is also a little more cracker friendly. By capturing the right type of packets, you can do your cracking offline. This means you only have to be near the AP for a matter of seconds to get what you need. Advantages and disadvantages.

WPA Flavours

WPA basically comes in two flavours RADIUS or PSK. PSK is crackable, RADIUS is not so much.

PSK uses a user defined password to initialize the TKIP, temporal key integrity protocol. There is a password and the user is involved, for the most part that means it is flawed. The TKIP is not really crackable as it is a per-packet key but upon the initialization of the TKIP, like during an authentication, we get the password (well the PMK anyways). A robust dictionary attack will take care of a lot of consumer passwords.

Radius involves physical transferring of the key and encrypted channels blah blah blah, look it up to learn more about it but 90% of commerical APs do not support it, it is more of an enterprise solution then a consumer one.

The Handshake

The WPA handshake was designed to occur over insecure channels and in plaintext so the password is not actually sent across. There are some fancy dancy algorithms in the background that turn it into a primary master key, PMK, and the like but none of that really matters cause the PMK is enough to connect to the network.

The only step we need to do is capture a full authenication handshake from a real client and the AP. This can prove tricky without some packet injection, but if you are lucky to capture a full handshake, then you can leave and do the rest of the cracking at home.

We can force an authenication handshake by launching a Deauthentication Attack, but only if there is a real client already connected (you can tell in airodump). If there are no connected clients, you’re outta luck.

Like for WEP, we want to know the channel the WPA is sitting on, but the airodump command is slightly different. We don’t want just IVs so we don’t specify an IV flag. This will produce “lucid.cap” instead of “lucid.ivs”. Assume WPA is on channel 6 and wireless interface is ath0.

./airodump ath0 lucid 6

Dictionary Brute Force

The most important part of brute forcing a WPA password is a good dictionary. Check out http://www.openwall.com/wordlists/ for a ‘really’ good one. It costs money, but it’s the biggest and best I’ve ever seen (40 Million words, no duplicates, one .txt file). There is also a free reduced version from the same site but i’m sure resourceful people can figure out where to get a good dictionary from.

When you have a good dictionary the crack is a simple brute force attack:

./aircrack -a 2 -b 00:23:1F:55:04:BC -w /path/to/wordlist


Either you’ll get it or you won’t… depends on the strength of the password and if a dictionary attack can crack it.

A little theory first. WEP is a really crappy and old encryption techinque to secure a wireless connection. A 3-byte vector, called an Initalization Vector or IV, is prepended onto packets and its based on a pre-shared key that all the authenticated clients know… think of it as the network key you need to authenticate.

Well if its on (almost) every packet generated by the client or AP, then if we collect enough of them, like a few hundred thousand, we should be able to dramatically reduce the keyspace to check and brute force becomes a realistic proposition.

A couple of things will cause us some problems.

* If the key is not static, then you’ll mix up all your IVs and it’ll take forever to decrypt the key.
* Theres no traffic, therefore no packets – we can fix this.
* MAC Address Filtering – we can fix this too.

Setting up your tools

We’re gonna need 3 or 4 shells open, we have 5 tools:

* airodump – Grabbing IVs
* aircrack – Cracking the IVs
* airdecap – Decoding captured packets
* airreplay – (My Favourite) Packet injector to attack APs.
* kismet – Network Sniffer, can grab IVs as well.

For a standard WEP hack we’ll usally only need airodump, aircrack, and kismet (server and client). If we run into some problems we might have to use airreplay to fiddle about.

I’ll leave you to config all these tools up, for the most part they should just be defaults with the exception of kismet.

Finding the Network

First step is we need to find a netork to crack. Start up kismet and start sniffing for APs. Leave it on for a bit so that it can discover all the important information about the networks around. What we want from kismet is:

* Encryption type: Is it WEP 64-bit? 128-bit?
* What channel is it on? Can greatly speed up IV collection.
* AP’s IP Address
* BSSID
* ESSID

All this info isn’t required but the more you have, the more options you have later to crack and sniff. We can get a lot of this from airodump as well but I find the channel is important.

Capturing IVs

Alright, we know what we wanna crack, so lets start capturing packets. You can use kismet to capture files but I prefer airodump because it keeps a running count of all the IVs I’ve captured and I can crack and airodump will automatically update aircrack with new IVs as it finds them.

Note: kimset can interfere with airodump so make sure you close it down before starting airodump.

Airodump is pretty straight forward with its command line looking something like this:

./airodump

[channel] [IVs flag]

* interface is your wireless interface to use – required.
* output prefix is just the filname it’ll prepend, – required.
* channel is the specific channel we’ll scan, leave blank or use 0 to channel hop.
* IVs flag is either 0 or 1, depending on whether you want all packets logged, or just IVs.

My wireless card is ath0, output prefix i’ll use “lucid”, the channel we sniffed from kismet is 6, and IVs flag is 1 because we just want IVs. So we run:

./airodump ath0 lucid 6 1

Airodump will come up with a graph showing us all the APs and their relevant info, as well as client stations connected to any of the APs.


BSSID PWR Beacons # Data CH MB ENC ESSID

The second line shows us some info about the AP as well as the number of beacons and data packets we’ve collected from the AP. The two last lines show us two authenticated clients. Where they are connected to and the packets they are sending. We won’t use this client info in a straight theory hack but in practice we’ll need this info to actively attack the AP.

This step may take a long time or could be very short. It depends how busy the AP is and how many IVs we are collecting. What we are doing is populating a file “lucid.ivs” with all the IV important packet info. Next, we’ll feed this to aircrack. To move onto the next step, we’ll want at least 100,000 packets (under # Data in airodump) but probably more.

Using IVs to Decrypt the Key

Ok, pretend you have enough IVs now to attempt a crack. Goto a new terminal (without stopping airodump – remember it’ll autoupdate as new IVs are found) and we’ll start aircrack. It looks something like this:


./aircrack [options]


There are a lot of options so you can look them up yourself, i’ll be using common ones here that should get you a crack. Our input file is “lucid.ivs”, the options we will use are:

* -a 1 : forces a WEP attack mode (2 forces WPA)
* either -b for the bssid or -e for the essid : whichever is easier to type but I like using a BSSID because its more unique.
* -n 64 or -n 128 : WEP key length, omit if not known by now.

So our command will look like:


./aircrack -a 1 -b 00:23:1F:55:04:BC -n 128 lucid.ivs

and off it goes, resembling the picture from the top. Keep an eye on the Unique IV count as it should increase if airodump is still running. For all intents and purposes you are done. That’ll pop open most old wireless routers with some traffic on them.

Anticipated Problems

There are lots of problems that can come up that will make the above fail, or work very slowly.

* No traffic
o No traffic is being passed, therefore you can’t capture any IVs.
o What we need to do is inject some special packets to trick the AP into broadcasting.
o Covered below in WEP Attacks

* MAC Address filtering
o AP is only responding to connected clients. Probably because MAC address filtering is on.
o Using airodumps screen you can find the MAC address of authenticated users so just change your MAC to theirs and continue on.
o Using the -m option you can specify aircrack to filter packets by MAC Address, ex. -m 00:12:5B:4C:23:27

* Can’t Crack even with tons of IVs
o Some of the statistical attacks can create false positives and lead you in the wrong direction.
o Try using -k N (where N=1..17) or -y to vary your attack method.
o Increase the fudge factor. By default it is at 2, by specifying -f N (where N>=2) will increase your chances of a crack, but take much longer. I find that doubling the previous fudge factor is a nice progression if you are having trouble.

* Still Nothing
o Find the AP by following the signal strength and ask the admin what the WEP key is.

Hacking Wireless Computers – A funny movie is a click away