O, Death

“You want a physicist to speak at your funeral. You want the physicist to talk to your grieving family about the conservation of energy, so they will understand that your energy has not died. You want the physicist to remind your sobbing mother about the first law of thermodynamics; that no energy gets created in the universe, and none is destroyed. You want your mother to know that all your energy, every vibration, every Btu of heat, every wave of every particle that was her beloved child remains with her in this world. You want the physicist to tell your weeping father that amid energies of the cosmos, you gave as good as you got.

And at one point you’d hope that the physicist would step down from the pulpit and walk to your brokenhearted spouse there in the pew and tell him that all the photons that ever bounced off your face, all the particles whose paths were interrupted by your smile, by the touch of your hair, hundreds of trillions of particles, have raced off like children, their ways forever changed by you. And as your widow rocks in the arms of a loving family, may the physicist let her know that all the photons that bounced from you were gathered in the particle detectors that are her eyes, that those photons created within her constellations of electromagnetically charged neurons whose energy will go on forever.

And the physicist will remind the congregation of how much of all our energy is given off as heat. There may be a few fanning themselves with their programs as he says it. And he will tell them that the warmth that flowed through you in life is still here, still part of all that we are, even as we who mourn continue the heat of our own lives.

And you’ll want the physicist to explain to those who loved you that they need not have faith; indeed, they should not have faith. Let them know that they can measure, that scientists have measured precisely the conservation of energy and found it accurate, verifiable and consistent across space and time. You can hope your family will examine the evidence and satisfy themselves that the science is sound and that they’ll be comforted to know your energy’s still around. According to the law of the conservation of energy, not a bit of you is gone; you’re just less orderly. Amen.”

-Aaron Freeman.

The NSA Hacks System Administrators

This article reveals that the people holding the keys are often the juiciest targets, regardless of their innocence, as they are a means to and end. However, perhaps the most interesting part of the article, Inside the NSA’s Secret Efforts to Hunt and Hack System Administrators, is this:

Once the agency believes it has identified a sys admin’s personal accounts, according to the posts, it can target them with its so-called QUANTUM hacking techniques. The Snowden files reveal that the QUANTUM methods have been used to secretly inject surveillance malware into a Facebook page by sending malicious NSA data packets that appear to originate from a genuine Facebook server. This method tricks a target’s computer into accepting the malicious packets, allowing the NSA to infect the targeted computer with a malware “implant” and gain unfettered access to the data stored on its hard drive.

Looks like I chose a good week to cancel my Facebook account 😉

Cracking Password-Protected MS Office Files

Disclaimer: Don’t do this unless it’s for legitimate reasons, such as the one outlined below.

At work, I recently came across the need to crack a handful of MS Office files that someone had password protected. Of course, that person was no longer around, so the person who took over needed to figure out how to access these documents, and they asked the Security team for help.

My first instinct turned out to be the correct one: use John the Ripper on Kali 2.

The main issue I faced was extracting the password hash from the Office docs in question so that John The Ripper could have something to run against. Turns out there is a handy python script you can use that does exactly this: office2john.py (https://github.com/kholia/RC4-40-brute-office)

Instructions

Download office2john.py, then make it executable.

# chmod a+x offce2john.py

Now you can use this tool to extract the hash from the Office document, and save it to a text file:
# ./office2john.py secret-company-secrets.docx > hash.txt

Now check out the contents of the hash file if you want:
# cat hash.txt

All you need at this point is a good password list to run through John the Ripper, and a few options to run it with. The sqlmap.txt file that comes with Kali2 is a good candidate:
/usr/share/wordlists/sqlmap.txt

Here’s the full command:
# john --session=docx --rules --wordlist=/usr/share/wordlists/sqlmap.txt hash.txt

Options:
–session=docx – This is the name of this session. Could be anything, really.
–rules – Enables word mangling on the defined wordlist
–wordlist – Path to the word list you are running this against

Now, sit back and wait for John to do its thing.

PDFs

Just use pdfcrack in Kali.