Basic Usage of BackTrack

Logging in to BackTrack

Once the installation of BackTrack is done, the default username and password required to log in are root / toor.
NOTE: You will not be able to see the password as you type it.

Starting a GUI Environment

After you are logged in you can start the GUI Environment by issuing the startx command.

X wont start!

In rare occasions (such as after a VMware tools install, or when using unsupported Video cards), X will refuse to start. If that happens you have several options you can try in order to fix the issue:

• Reconfiguring the X server package, you can reset (and often fix) Xorg configurations with the following command:

   root@bt:~# dpkg-reconfigure xserver-xorg

• If you are using Backtrack 5 on x64 with KDE you should try the following:

   root@bt:~# rm /root/.kde/cache-*

NOTE: Sometimes you may need to also remove the cache folders in /var/tmp by issuing the following command:

   root@bt:~# rm -rf /var/tmp/kdecache-*

Getting Networking to work

If you haven’t noticed yet BackTrack does not boot with networking by default in order to increase its stealth.

Setting your IP manually

We will first set up the networking manually. In the following example we will assume the following addresses and their purpose:

   IP Address      -  192.168.1.112/24
   Default Gateway -  192.168.1.1
   DNS server      -  192.168.1.1

In order to set these up we will run the following commands:

root@bt:~# ifconfig eth0 192.168.1.112/24
root@bt:~# route add default gw 192.168.1.1
root@bt:~# echo nameserver 192.168.1.1 > /etc/resolv.conf

Getting a static IP to stick between reboots

These settings however will only last until you reboot, so if we want to save them between reboots we need to edit the /etc/network/interfaces file like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5). 

# The loopback network interface 
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.112
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

Edit the file as appropriate, then have the network come up automatically at boot time:

root@bt:~# update-rc.d networking defaults
root@bt:~# /etc/init.d/networking restart

Getting an IP from DHCP

In order to get an IP from a DHCP server we can issue the dhclient <interface> command as follows:

root@bt:~# dhclient eth0
Internet Systems Consortium DHCP Client V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/

Listening on LPF/eth0/00:0c:29:81:74:21
Sending on   LPF/eth0/00:0c:29:81:74:21
Sending on   Socket/fallback
DHCPREQUEST of 192.168.1.112 on eth0 to 255.255.255.255 port 67
DHCPACK of 192.168.1.112 from 192.168.1.1
bound to 192.168.1.112 -- renewal in 37595 seconds.
root@bt:~#

Using the script to start networking

There is a script to start networking in the /etc/init.d directory which attempts to start every interface listen in /etc/network/interfaces (you can remove the ones you don’t need). To start it issue the following command:

root@bt:~# /etc/init.d/networking start

WICD Network Manager

Another way to set up your networking is using the WICD Network Manager, you can find it in the menu:
Menu > Internet > Wicd Network Manager
NOTE: Notice that when starting WICD you will get an error:


In order to get rid of this error you have to reboot Backtrack, than BEFORE starting WICD open up a terminal and type in the following:

root@bt:~# dpkg-reconfigure wicd
root@bt:~# update-rc.d wicd defaults

Now after a reboot the error should not occur anymore.

Changing the root password

As you know Backtrack comes with a default username and password (root/toor) it is IMPORTANT that we change that root password especially when running services such as SSH. We can change the password by issuing the passwd command:
root@bt:~# passwdEnter new UNIX password: {enter your new password here } Retype new UNIX password: {enter your new password again} passwd: password updated successfully root@bt:~#

Starting services

BackTrack has various services such as Apache, SSH, MySQL, VNC, etc. They are all disabled by default. To start a service such as SSH, you can use the service init scripts. For example, to start the SSH service:

root@bt:~# sshd-generate  # Specific to the SSH service - needed to generate SSH keys
root@bt:~# /etc/init.d/ssh start
Starting OpenBSD Secure Shell server: sshd.
root@bt:~# /etc/init.d/ssh stop 
Stopping OpenBSD Secure Shell server: sshd.
root@bt:~# 

When using a ssh server for the first time on Backtrack you will need to generate keys:

root@bt:~# sshd-generate

To enable a service at boot time, you can use the update-rc.d command, for example, having SSH start at boot time:

root@bt:~# update-rc.d -f ssh defaults
 Adding system startup for /etc/init.d/ssh ...
  /etc/rc0.d/K20ssh -> ../init.d/ssh
  /etc/rc1.d/K20ssh -> ../init.d/ssh
  /etc/rc6.d/K20ssh -> ../init.d/ssh
  /etc/rc2.d/S20ssh -> ../init.d/ssh
  /etc/rc3.d/S20ssh -> ../init.d/ssh
  /etc/rc4.d/S20ssh -> ../init.d/ssh
  /etc/rc5.d/S20ssh -> ../init.d/ssh
root@bt:~#

Common apt commands

apt-get install <package> Downloads <package> and all of its dependencies, and installs or upgrades them.
apt-get remove [--purge] <package> Removes <package> and any packages that depend on it. --purge specifies that packages should be purged.
apt-get update Updates packages listings from the repo, should be run at least once a week.
apt-get upgrade Upgrades all currently installed packages with those updates available from the repo. should be run once a week.
apt-get dist-upgrade [-u] Similar to apt-get upgrade, except that dist-upgrade will install or remove packages to satisfy dependencies.
apt-cache search <pattern> Searches packages and descriptions for <pattern>.
apt-cache show <package> Shows the full description of <package>.
apt-cache showpkg <package> Shows a lot more detail about <package>, and its relationships to other packages.
man apt Will give you more info on these commands as well as many that are in less common usage.

Common dpkg commands

dpkg -i <package.deb> Installs a package file; one that you downloaded manually, for example.
dpkg -c <package.deb> Lists the contents of <package.deb> a .deb file.
dpkg -I <package.deb> Extracts package information from <package.deb> a .deb file.
dpkg -r <package> Removes an installed package named <package>
dpkg -P <package> Purges an installed package named <package>. The difference between remove and purge is that while remove only deletes data and executables, purge also deletes all configuration files in addition.
dpkg -L <package> Gives a listing of all the files installed by <package>. See also dpkg -c for checking the contents of a .deb file.
dpkg -s <package> Shows information on the installed package <package>. See also apt-cache show for viewing package information in the Debian archive and dpkg -I for viewing package information extracted from a .deb file.
dpkg-reconfigure <package> Reconfigures an installed package
man dpkg Will give you more info on these commands as well as many that are in less common usage.

How do I find more information on a particular command or programs usage ?

Most commands will have what is called a man page (manual page) which can be viewed by typing:

root@bt:~# man <command you want more info on>

Another very good resource on linux command usage can be found at linuxcommand.org
Some programs do not have a man page, but you can usually get more information on it's usage by typing:

root@bt:~# <program name> Just the program name without any arguements.

or

root@bt:~# <program name> -help

or

root@bt:~# <program name> --help

or

root@bt:~# <program name> -h

Some programs use other methods, but they are usually just a variation of one of the above five commands.