Thireus' Bl0g

The famous Linux-based penetration testing arsenal can run in VirtualBox. In the meanwhile, some tricks are needed to have the latest version fully functional with VirtualBox.

For the ST’HACK Ethical Hacking Contest tonight in Bordeaux (France), everything must be ready for the battle. MacBooks are armed, scripts are ready to be launched and beers are waiting in the fridge. During the preparation, BackTrack 5 R2 was installed on every teammate computers.

VirtualBox is of course the most suitable virtualization solution to run BackTrack. Unfortunately, with this latest version of BackTrack, the VirtualBox Guest Additions cannot be installed on a fresh new install. Fortunately after some modifications, everything can be fixed to compile these additions for the 3.2.6 Linux Kernel of BackTrack 5 R2.

Edit: VirtualBox Guest Additions solution updated with new fixes.

Download and Install

• BackTrack: http://www.backtrack-linux.org/downloads/
• VirtualBox + Oracle VM Extension Pack: https://www.virtualbox.org/wiki/Downloads

If you want support for USB 2.0 devices you must download and install Oracle VM Extension Pack for VirtualBox!

I will not describe the steps to install BackTrack on VirtualBox. A lot of tutorials can be found on the Internet to upgrade to BackTrack 5 R2 or to make a fresh install. But here are some screenshots about the VirtualBox configuration for my MacBook Air i7 1.8Ghz.

Issue #1 (solved): USB device descriptor error

usb 1-1: Device descriptor read/8, error -110
usb 1-1: Device descriptor read/64, error -110

Solution

Number of Processor for the Guest OS must be set to 1 or eventually 2…
For example, my MacBook Air has a Core i7 inside, multithreading displays 4 virtual cores. So I have to set a maximum of 2 cores to BackTrack VM Guest to fix this issue. (Even if the recommended number of cores VirtualBox displays is 4).

Issue #2 (solved): VirtualBox Guest Additions

After a fresh new install of BackTrack 5 R2, you should have no issues installing VirtualBox Guest Additions… So, before applying these patches, make sure the installation of VirtualBox Guest Additions fails.

After upgraded from an old version of BackTrack to BackTrack 5 R2, you can face issues installing VirtualBox Guest Additions. These two kinds of errors can occur and lead to a vboxguest kernel extension impossible to load.

The headers for the current running kernel were not found. If the following
module compilation fails then this could be the reason.

and

Building the main Guest Additions module ...fail!
(Look at /var/log/vboxadd-install.log to find out what went wrong)

Both issues result to:

Starting the VirtualBox Guest Additions ...fail!
(modprobe vboxguest failed)

Solution

apt-get install linux-headers-$(uname -r) linux-headers xserver-xorg xserver-xorg-core file-roller # file-roller not needed
cd /usr/src/
tar jxf /usr/src/linux-source-3.2.6.tar.bz2
rm /usr/src/linux
ln -s /usr/src/linux-source-3.2.6 /usr/src/linux
rm /usr/src/linux-headers-3.2.6/include/asm
ln -s /usr/src/linux-source-3.2.6/arch/x86/include/asm /usr/src/linux-headers-3.2.6/include/asm
ln -s /usr/src/linux-headers-3.2.6 /lib/modules/3.2.6/build
ln -s /usr/src/linux-source-3.2.6/arch/x86/Makefile_32.cpu /usr/src/linux-headers-3.2.6/arch/x86/Makefile_32.cpu # Solution required for BackTrack x86 version by SphaZ

Please make sure you have linux-source-3.2.6.tar.bz2 into your /usr/src/ directory… Just in case you need it:

linux-source-3.2.6.tar.bz2
linux-source-3.2.6.tar.bz2

BackTrack 5 R2 linux-source-3.2.6.tar.bz2

Platforms:	Linux
Date:	March 27, 2012

79.9 MB
967 Downloads
Details...

Ready to install VBOXADDITIONS

Verifying archive integrity... All good.
Uncompressing VirtualBox 4.1.10 Guest Additions for Linux..........
VirtualBox Guest Additions installer
Removing installed version 4.1.10 of VirtualBox Guest Additions...
tar: Record size = 8 blocks
Removing existing VirtualBox DKMS kernel modules ...done.
Removing existing VirtualBox non-DKMS kernel modules ...done.
Building the VirtualBox Guest Additions kernel modules
Building the main Guest Additions module ...done.
Building the shared folder support module ...done.
Building the OpenGL support module ...done.
Doing non-kernel setup of the Guest Additions ...done.
You should restart your guest to make sure the new modules are actually used
Installing the Window System drivers
Installing X.Org Server 1.7 modules ...done.
Setting up the Window System to use the Guest Additions ...done.
You may need to restart the hal service and the Window System (or just restart
the guest system) to enable the Guest Additions.
Installing graphics libraries and desktop services components ...done.
Press Return to close this window...

Incoming search terms:

• backtrack virtualbox (102)
• Error! Bad return status for module build on kernel: 3 2 6 (i686) (88)
• /var/log/vboxadd-install log (59)
• backtrack 5 virtualbox (58)
• backtrack macbook air (58)
• backtrack 5 r2 virtualbox guest additions (48)
• error! bad return status for module build on kernel: 3 2 6 (x86_64) (43)
• backtrack virtualbox guest additions (37)
• backtrack 5 virtualbox guest additions (35)
• backtrack on macbook air (33)

JailBreaking is easy, but you can face many issues before and after the process. Let’s see how to fix some of them…

It was friday night , I was playing with my old iOS 5.0.1 JailBroken 3GS device, and did something nasty installing bad Cydia packages. My iPhone  never booted up again after this. It was totally down, frozen on the Apple boot logo. Backups were too old, this time I knew I had to make a fresh new install of my iDevice .

This article will not describe how to jailbreak your iPhone. iClarified has very nice and easy tutorials for beginners to JailBreak iDevices. This article can help you to fix the following issues:

• Restoration fails on iTunes before starting anything on your iDevice.
• Restoration hangs on iTunes at 99% of the restoration process.
• Activating iOS location service causes dropped signal and WiFi loss.
• No Push notifications.
• Downgrade BaseBand 06.15.00 to 05.13.04

So, let me present your here some big issues I faced during the iOS 5.0.1 JailBreak process using redsn0w on MacOS 10.7.2 for my iPhone 3GS (iPad baseband 06.15.00). Most of them are easy to solve, but good solutions are hard to find on the Internet. I found some using my own brain and others after seeking for a while on various JailBreak forums.

Issue #1 (Before JailBreak, solved): Restoration fails on iTunes before starting anything on your iDevice.

This issue is most of the cases related to your network configuration. Apple needs to check, before any restoration process, if the firmware (.ipsw) you uses is valid. If your FireWall blocks these requests, the restoration process cannot begin.

The easiest solution is thus to temporarily deactivate your FireWalls and rename your hosts file.

sudo mv /etc/hosts /etc/hosts.jailbreak.bak

After JailBreak, do not forget to reactivate your FireWalls and move back your hosts file.

sudo mv /etc/hosts.jailbreak.bak /etc/hosts

If  you do want to keep your FireWall and hosts file in place, just check that “gs.apple.com” is not blocked.

Issue #2 (Before JailBreak, solved): Restoration hangs on iTunes at 99% of the restoration process.

This is due to an USB communication issue. iTunes is waiting for your iDevice to be plugged on your Mac. But this never happens because your iDevice is already plugged in and waits for iTunes next instructions.

There are many solutions to fix it using softwares. The easiest and fastest I’ve found is to launch DiskAid. This software will catch your iDevice USB communication, and give it back to iTunes quickly. So iTunes will display a “Connection Failed” error but will retry and send final instructions on your iDevice.

Watch this video if you are unsure what to do:

You cannot simply unplug and plug again your iDevice. This will cause your iPhone to be stuck and you will need to restore it once again.

Issue #3 (After JailBreak, solved): Activating iOS location service causes dropped signal and WiFi loss.

This issue is due to a bad hacktivation. You will need to deactivate and re-activate your iDevice using SAM.

1. First turn off location service.
2. Use Cydia to install SAM even if you have activated with official SIM card. SAM is available on the Cydia repository http://repo.bingner.com.
3. De-activate your iDevice with SAM.
4. Re-run redsn0w with nothing checked (meaning uncheck Cydia installation checkbox). redsn0w will hacktivate and apply the fix during hacktivation.
5. Go back to SAM after your iDevice booted up. Press “Revert Lockdownd to Stock”.
6. Re-activate your iDevice with iTunes and official SIM or reactivate with SAM.
7. Turn on location service, and check if the issue is gone (i.e. use Map for 30 seconds with location activated).

Issue #4 (After JailBreak, solved): No Push notifications.

To fix push notifications, you have some packages on Cydia. This issue is also related to bad certificates received during the activation process.

If you want to know if Push is working, there is a simple free application on the App Store called iPusher.

You can either fix Push notifications using the right Cydia Packages (type “fix push” in Cydia). Or use SAM once more (better)

1. Use Cydia to install SAM even if you have activated with official SIM card. SAM is available on the Cydia repository http://repo.bingner.com.
2. Open SAM. Press “Revert Lockdownd to Stock”.
3. Press the “De-activate (clear Push)” button with SAM.
4. Re-activate your iDevice with iTunes and official SIM or reactivate with SAM.

Note:  There is a very great and illustrated tutorial to fix it using SAM on addictivetips.

You may also need to remove then reinstall all your applications which use Push notifications

Issue #5 (After JailBreak, solved): Twitter Notifications not working.

FaceBook notifications are working great after applying “Issue #4” fix. But Twitter is totally quite . I’m still investigating… but it is maybe due to the low activity of my Twitter account

Edit: Twitter Push notifications are working when someone mentions you in a tweet.

Issue #6 (iOS 5.0.1 only, solved): PAC proxy ignored by Safari.

Under iOS 5.0.1 only, Safari totally ignores locally stored .pac proxy configuration.

This is a new new restriction also available on Safari 5.1 under MacOS.

Two solutions:

• You either, run a local server on your iDevice so that you can access your proxy configuration via http://localhost:7276/myproxy.pac (127.0.0.1 will not work, prefer using localhost hostname). Configure your network to use this URL instead of the local file:///private/var/mobile/pacdir/myproxy.pac adress you used to have into the “Auto Configuration” field of your network proxy settings.
• Or you can host your file on an Internet server. If some people are in need, I can host .pac files. Just ask.

I don’t know yet which one is best. I think it is better to keep everything on the device.

#!/usr/bin/perl
# Time-stamp: "2005-08-19 01:17:45 ADT"
#
# desc{    pac http proxy server    }    sburke@cpan.org
#

use strict;
use IO::Socket qw(:DEFAULT :crlf);
use constant MY_PORT => 7276;
use constant DEBUG => 1;

my $pac_file_type = 'application/x-ns-proxy-autoconfig';
my $pac_file = "myproxy.pac";

my $no_bytes = (stat ($pac_file))[7];

print $pac_file;

{
    if(open(IN, "<$pac_file")) {
	local $/;
	$pac_file = join '',
	  "HTTP/1.1 200 OK", CRLF, "Content-Length: ", $no_bytes, CRLF,
	  "Content-Type: ", $pac_file_type, CRLF, CRLF,
	  <IN>;
	close(IN);
    }
}
#-----------------------------------------------------------------------------

my $quit = 0;
$SIG{'INT'} = sub {$quit = 1};

my $sock = IO::Socket::INET->new(
  Listen => 20,        LocalPort => shift(@ARGV)|| MY_PORT,
  Timeout => 60 * 60,  Reuse => 1,
) or die "Can't create listening socket: $!\n";

DEBUG and warn "Waiting for connections...\n";

my($session, $peer, $port);
while(!$quit) {
  next unless my $session = $sock->accept;
  if(DEBUG) {
    $peer = gethostbyaddr($session->peeraddr, AF_INET) || $session->peerhost;
    $port = $session->peerport;
    warn "Connection from [$peer\n,$port] at ", scalar(localtime), "\n";
  }

  #select($session);
  #++$|;
  #select(STDOUT);

  print $session $pac_file;
  close($session);
  DEBUG and print " (Closed)\n";
}

DEBUG and print STDERR "Byebye\n";
close($sock);
exit 0;

I keep you in touch on this thread How To Get Socks Proxy + SSH Tunneling To Work On A Jailbroken iPhone/iPod Touch/iPad. I’ll package everything and try to make things easier to use and configure.

Issue #7 (BB 06.15.00 only, solved): GPS Fix, Signal Issues Fix.

This solution is for iPhone 3 and 3GS users who upgraded their baseband to the iPad BaseBand 06.15.00 (in order to unlock their iPhone with ultrasn0w). Unfortunately, upgrading to the 06.15.00 breaks the iPhone’s GPS feature and is the source of many signal issues.

Fortunately MuscleNerd released a solution which is integrated in redsn0w now. iPhone users can now downgrade from 06.15 to 05.13.04. The 05.13.04 BaseBand version is unlockable with ultrasn0w .

https://twitter.com/MuscleNerd/status/214626056211140609

The full tutorial to downgrade from 06.15 is available on iClarified.

Final thoughts…

Thanks to anyone who worked hard on these fixes. A big thank to the Dev-Team for their tools and efforts on JailBreak.

My JailBroken and unlocked iPhone 3GS is now fully functional. I hope I helped some of you

Do not hesitate to post comments for any questions or suggestions.
Maybe you have a better way to fix an issue, or you can suggest me an unmentioned issue.

Incoming search terms:

• sparkleshare encfs (38)
• ipusher (32)
• ipusher cydia (18)
• ipusher repo (15)
• 06 15 00 gps fix (11)
• ipusher cydia source (8)
• ipusher app (5)
• diskaid connection failed (4)
• jailbreak ipsw host fail (3)
• ipusher white (3)