Hướng Dẫn Thực Hành BackTrack - Add New Disk to BackTrack: Lesson 1

{ Add New Disk, Create Partition Table and Filesystem }

---

Section 0. Background Information

• Adding a new disk to a Backtrack 5 VMware Instance
  • In this lab, you will learn how to do the following:
    • Add a new disk
    • Create a partition table for the new disk
    • Create an ext3 filesystem on the new disk
  • This new disk will be added for Forensic Labs.

Section 1. Configure BackTrack Network Adapter Virtual Machine Settings

1. Open Your VMware Player
   • Instructions:
     1. On Your Host Computer, Go To
     2. Start --> All Program --> VMWare --> VMWare Player
2. Edit BackTrack Virtual Machine Settings
   • Instructions:
     1. Highlight BackTrack5R1
     2. Click Edit virtual machine settings
   • 
3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Do NOT Click on the OK Button.
• 

Section 2. Add Hard Drive to BackTrack Virtual Machine

1. Add Device
   • Instructions:
     1. Click on the Add.. Button
   • 
2. Add Hard Disk
   • Instructions:
     1. Click on Hard Disk
     2. Click Next
   • 
3. Select a Disk
   • Instructions:
     1. Select "Create a new virtual disk"
     2. Click Next
   • 
4. Select Virtual disk type
   • Instructions:
     1. Select SCSI (Recommended)
   • 
5. Specify Disk Capacity
   • Instructions:
     1. Maximum disk size (GB): 15.0
     2. Select "Store virtual disk as a single file"
     3. Click Next
   • 
6. Name Disk File
   • Instructions:
     1. Take the default name
     2. Click Finish
   • 
7. View Results
   • Notes:
     • You should see two disk, the original disk and the New Hard Disk.
   • Instructions
     1. Click OK.
   • 

Section 3. Login to BackTrack

1. Start BackTrack VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select BackTrack5R1
     3. Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

Section 4. Create New Disk Partition Table

1. Open a console terminal
   • Instructions:
     1. Click on the console terminal
   • 
2. View Hard Disks
   • Instructions:
     1. fdisk -l
   • Notes:
     • You should see the following two disk names:
       1. /dev/sda: 21.5 GB
          • This is the original disk.
          • Notice there is a partition table
       2. /dev/sdb: 16.1 GB
          • This is the new disk.
          • It contains 1958 cylinders.
          • Notice that /dev/sdb does not have a valid partition table.
   • 
3. Partition the New Disk
   • Instructions:
     1. fdisk -c /dev/sdb
     2. Select m
   • 
4. Partition the New Disk
   • Instructions:
     1. n
        • Add New Disk
     2. p
        • Make Primary Partition
     3. 1
        • "1" is the partition number for disk /dev/sdb.
     4. 1
        • "1" is the first cylinder of the disk.
     5. 1958
        • "1958" is the last cylinder of the disk.
     6. p
        • Print the partition table.
     7. w
        • Write the table to disk and exit
   • 

Section 5. Create a new file system

1. Create a new filesystem
   • Instructions:
     1. mkfs.ext3 /dev/sdb1
        • Create an ext2/ext3/ext4 filesystem
   • 
2. Mount the new filesystem
   • Instructions:
     1. mkdir /FORENSICS
     2. mount /dev/sdb1 /FORENSICS
     3. df -h
   • 

Bài Tập : Steganography: Lesson 1 - Using Quick Stego to Embed Secret Messages Into Pictures

 { Using Quick Stego to Embed Secret Messages Into Pictures }

---

Section 0: Background Information

1. What is Steganography
   • Steganography is the science of writing hidden messages in such a way that no one apart from the sender and intended recipient even realizes there is a hidden message.
2. What is QuickStego
   • QuickStego lets you hide text in pictures so that only other users of QuickStego can retrieve and read the hidden secret messages. Once text is hidden in an image the saved picture is still a 'picture', it will load just like any other image and appear as it did before. The image can be saved, emailed, uploaded to the web (, the only difference will be that it contains hidden text.
3. Reference Link:
   • http://quickcrypto.com/free-steganography-software.html

Section 1: Power On PENTEST-WXP

1. Edit Virtual Machine Settings
   • Instructions:
     1. Click on PENTEST-WXP
        • PENTEST-WXP is a Windows XP SP3 Virtual Machine.
     2. Click on Edit virtual machine
   • 
2. Configure Network Adapter
   • Instructions:
     1. Select Network Adapter
     2. Click the radio button "Bridged: Connected directly to the physical network."
     3. Click the Okay button
   • 
3. Start PENTEST-WXP
   • Instructions:
     1. Click on PENTEST-WXP
     2. Click on Play virtual machine
   • 
4. Send Ctrl+Alt+Del
   • Instructions:
     1. Virtual Machine --> Send Ctrl+Alt+Del
   • 
5. Logging into PENTEST-WXP.
   • Instructions:
     1. Username: administrator
     2. Password: Provide the Password
   • 
6. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 
7. Obtain PENTEST-WXP's IP Address
   • Instructions:
     1. ipconfig
   • Note(FYI):
     • In my case, PENTEST-WXP's IP Address is 192.168.1.111.
     • Your IP Address will be different.
   • 

Section 2: Download Quick Stego

1. Start Firefox
   • Instructions:
     1. Start --> All Programs --> Mozilla Firefox --> Mozilla Firefox
   • 
    
2. Download Stego
   • Instructions:
     1. Place the following address in your Firefox browser.
        • http://quickcrypto.com/products/QS12Setup.zip
        • Click here if link is dead.
     2. Select the Save File radio button
     3. Click the OK button
   • 
3. Open Containing Folder
   • Instructions:
     1. Right Click on QS12Setup.zip
     2. Click on Open Containing Folder
   • 
4. Extract Stego
   • Instructions:
     1. Right Click on QS12Setup.zip
     2. Click on Extract All...
   • 
5. Start Extraction Wizard
   • Instructions:
     1. Click on the Next button
   • 
6. Select a Destination
   • Instructions:
     1. Click on the Next button
   • 
7. Extraction Complete
   • Instructions:
     1. Check "Show extracted files"
     2. Click on the Finish button
   • 

Section 3: Install Quick Stego

1. Start Installation
   • Instructions:
     1. Right Click on QS12Setup
     2. Click Open
   • 
2. Open Fire - Security Warning
   • Instructions:
     1. Click Run
   • 
3. Setup - Quick Stego
   • Instructions:
     1. Click Next
   • 
4. License Agreement
   • Instructions:
     1. Click the "I accept the agreement" radio button.
     2. Click the Next button
   • 
5. Select Destination Location
   • Instructions:
     1. Click the Next button
   • 
6. Select Additional Tasks
   • Instructions:
     1. Check Create a Desktop Icon
     2. Check a Quick Launch Icon
     3. Click the Next button
   • 
7. Ready to Install
   • Instructions:
     1. Click the Install Button
   • 
8. Completion
   • Instructions:
     1. Click the Finish Button
   • 

Section 4: Download Picture

1. Download Trojan Horse Picture
   • Instructions:
     1. Place the following address in your Firefox browser
        • http://goo.gl/erVt6X
     2. Right Click on the picture, Select Save Image As...
   • 
2. Save As bmp
   • Instructions:
     1. Name the file "horse.bmp"
        • Make sure you add the .bmp extension.
     2. Click the Save button.
   • 

Section 5: Run Quick Stego

1. Run Quick Stego
   • Instructions:
     1. Click on the Quick Stego Icon
   • 
2. Open Image
   • Instructions:
     1. Click on the Open Image button
   • 
3. Open Horse Image
   • Instructions:
     1. Navigate to the Downloads Directory
     2. Select the horse.bmp image
     3. Click the Open button
   • 
4. Hide Text
   • Instructions:
     1. Notice the message that say "This image does not secret text message"
     2. Add a message to the black rectangle
     3. Click the Hide Text button
   • 
5. Save Image
   • Instructions:
     1. Notice the message that say "The text message is now hidden in the image"
     2. Click the Save Image button
   • 
6. Save New Image
   • Instructions:
     1. File name: horse-secret.bmp
     2. Click the Save button
   • 

Section 6: Compared the images.

1. Open My Computer
   • Instructions:
     1. Start --> My Computer
   • 
2. Compare Images
   • Instructions:
     1. Navigate to the Download directory
     2. Notice that the byte size of horse-secret.bmp is much bigger than horse.bmp.
   • 

Section 7: Proof of Lab

1. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 
2. Proof of Lab
   • Proof of Lab Instructions
     1. cd "My Documents\Downloads"
     2. dir horse*
     3. date /t
     4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
     5. Press the <Ctrl> and <Alt> key at the same time.
     6. Press the <PrtScn> key.
     7. Paste into a word document
     8. Upload to website www.antoanthongtin.edu.vn
   •