FreeBSD - Qemu with Multiple NICs

Previously I have setup qemu for testing by using the quick how-to at the taosecurity blog here. Everything is going well and I'm pretty satisfied to run qemu for my pre-deployment testing. However the setup won't allow me to connect to the Virtual Machine remotely by using localhost, which means that I can only interact with qemu VM by login to another machine and connect back to qemu VM. This is not a big problem anyway but it kills my need of running everything with my standalone notebook only.

After going through the man page of if_bridge, I decided to create bridge interface using it instead of the one mentioned in bridge man page. Both are different and you can read it anyway by just run man if_bridge and man bridge. With that I have successfully connect to qemu VM with localhost. All I need is just run my VM with the command,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap

Then create the bridge interface and adding the physical interface - bge0 and the pseudo interface - tap0 to the bridge interface.

shell>ifconfig bridge0 create

shell>ifconfig bridge0 addm bge0 addm tap0

You need to assign the IP to the bridge interface if you want to have the VM connecting to internet, and don't forget to delete the ip configuration of the bge0 interface.

shell>ifconfig bridge0 inet 192.168.0.199 \
netmask 255.255.255.0 up

shell>ifconfig bge0 inet delete

Now you may have the VM in the same LAN is the bridge interface, just configure your network interface in the VM to be something within range 192.168.0./24 will do. The NIC variable in my OpenBSD VM is ne3, just run ifconfig utility to configure the IP address will do.

Remember I have told that I'm creating the sguil qemu image, currently it is in the progress and I named it as NSM.img(OpenBSD VM), this is working properly with single NIC. I can ping each other and interact with VM perfectly fine.

But is this what I want? I remember I used to create multiple NICs in my VMware, I crawled the qemu man page and found that I can actually create multiple NICs by running,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap -net nic -net tap

Once the VM is started, I found ne3 and ne4 network interfaces in my VM, I thought that everything is going as expected, I add IP address 192.168.0.123 to ne3 and 192.168.0.124 to ne4, then I start to ping 192.168.0.123, now havocs started where I have tons of DUPLICATE ping packets. If this is the case that would be bad since I can't setup my VM with multiple NICs.

Since I'm not a give up type, I crawled against the qemu manual page. I found that I can actually create the NICs with different vlan setting. Thus I might give it a try, I run the commands,

shell>qemu -boot c -hda /nsm/i-VMimages/NSM.img \
-net nic -net tap,vlan=0,ifname=0 \
-net nic -net tap,vlan=1,ifname=1

Without making any assumption that it works, I start to ping 192.168.0.123, and this time everything goes fine and I don't see any problem, this is what I really want and I got it running this time. Now I can start tinkering with my NSM setup on qemu image. With the correct configuration of gateway and dns server, both my localhost and VM can connect to the internet. Check the screenshots below and look at the interface configuration and the ping result of my VM to localhost and internet, it just works!!!!!

My network interface configuration

VM pinging localhost and internet

If you don't want to use qemu anymore, and would like to delete the pseudo interfacessuch as tap and bridge interface, normally you don't have to do the ifconfig NIC destroy, you are better of doing this - unload the pseudo interfaces module,

shell>kldstat
Id Refs Address Size Name
1 19 0xc0400000 6a29c0 kernel
2 1 0xc0aa3000 5f60 snd_ich.ko
3 2 0xc0aa9000 22b88 sound.ko
4 1 0xc0acc000 58554 acpi.ko
5 1 0xc4ebd000 9000 if_iwi.ko
6 1 0xc4fe1000 16000 linux.ko
7 1 0xc5267000 5000 i915.ko
8 1 0xc526c000 e000 drm.ko
10 1 0xc5a69000 4000 if_tap.ko
11 1 0xc5a41000 8000 if_bridge.ko

shell>kldunload if_tap

shell>kldunload if_bridge

That's the right way of deleting pseudo interface instead of using ifconfig. On the other hand, I have found the mail thread where people are asking of problem when creating tap interface. Normally you just need to do this to avoid the unwanted error.

shell>kldload if_tap

shell>cat /dev/null > /dev/tap0

I just point out here in case this helps when people googling for answer :P

Though it is not as user friendly as VMware, I will still stick with qemu for the time being. I think the more I use qemu, the more I can do with it in practical environment.

Note: I will add this write-up to my handbook, for the section - Building cheapest testing lab environment.

Peace :]

FTP Commands & Codes

If I recall myself correctly, I did mentioned in my previous blog posts regarding the important of understanding http commands & codes, while I think it is pretty useful when analyzt need to perform analysis on http session, the same thing happens to ftp as well. One should at least know partial well known ftp commands such as RETR, STOR and codes like 226 or 250.

Normally you won't see much benefit until you get your hand dirty with ftp session, by looking at the ftp code you may know whether file is successfully uploaded or downloaded, here are two quick and straight forward urls that explaining about ftp commands and codes very well -

http://www.ftpplanet.com/ftpresources/ftp_codes.htm

http://www.nsftools.com/tips/RawFTP.htm

Or if you never feel enough of reading quick guides and would like to know more inner working of FTP, RFC is recommended as always -

http://www.faqs.org/rfcs/rfc959.html

I'm more to RFC guy, apparently not everyone like RFC due to the lenghty contents.

~ RFC is just ROX ~

Another Pcap File Editor - Bittwiste

If you feel that l33tness is important and you would like to do stuffs in CLI instead of GUI, no problem!!!!! Instead of using netdude, you can actually use bittwiste. What is bittwiste, it is a command line based pcap file editor that bundled with bit-twist(Libpcap-based Ethernet packet generator).

For more information, you can check out more info at it's main site, I pretty like the bittwiste reference sheet that located at

http://bittwist.sourceforge.net/doc/bittwiste_options_s.jpg

To change the destination address to 10.0.0.2, you can just run

shell>bittwiste -I /nsm/pcap/testing.pcap \
-O /nsm/pcap/testing1.pcap -T ip -d 10.0.0.2

To confirm that I have edited it correctly, I run tcpdump to check the output,

shell>tcpdump -qeXXttttnr /nsm/pcap/testing1.pcap -c 8

Bittwiste will automatically fix the checksum value as well, it is very quick and neat tool to modify pcap file indeed. Credit goes to Addy who create this interesting tool.

Peace :]

Pcap file editing with Netdude

Now you got cool pcap file that captured from the wire and would like to edit it to replay the traffics against your server, thus you need to change the destination IP address. Since there are so many packets and you want to change the destination IP address at one time, here's little tricks that you can do with netdude.

For example you can just load the pcap file into netdude, in my situation the destination IP is 172.16.0.99, then I need to change it to 10.0.0.1, thus I just need to go to Edit -> Select All or you can just right click in the pane and Select All, then click on the IPv4 tab below, choose the Dst.addr field and you can change the value from 172.16.0.99 to 10.0.0.1, once you have changed it, you may have almost the same thing like the screenshot below.

Since you have made changes to the IP header, the checksum value will be wrong and need to be recalculated, you can just correct it by click on Plugins -> Checksum Fixer.

The checksum value is corrected and you can save it by now and ready to replay the traffics with it.

Cheers :]

Bro-IDS - Signature Matching

Lately I have deployed a testing box on 30Mbps link by using Bro-IDS, apparently it is a small monster when running with default setting. Today I started to turn on the signatures matching engine. Guess what !!!!! The small monster starts to become hulk, let's see how it goes -

PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND
546 bro 1 -58 0 166M 164M bpf 80:40 81.42% bro

It seems that it is not a good idea to turn the signature matching engine on since it consumes too much processing power, I would rather having snort instance running for signatures matching and bro running as protocol analyzer indeed. Anyway it's up to you.

F34R teh Hulk!!!!!

Peace :]

Network Trace Files - Share it!???

I think people who work in Network Security should have chance to learn, and study the packet dump files, usually if we are following the Open Source Standard, libpcap is considered the most common format that widely been used everywhere including commercial companies.

However not much people want to share the network trace files, the critical and sensitive information yields many people stop doing that. I'm still looking forward to OpenPacket that soon will be launched, though I don't know when since Rich is busy with his stuffs. OpenPacket will serve a central repository for interesting network trace files. If you want to learn about protocol by studying the headers and payloads, you can check it out at,

http://wiki.wireshark.org/SampleCaptures

http://www.icir.org/enterprise-tracing/download.html

While you may wonder how you can share your network trace files, there are tools available to help you anonymizing the packet headers, I won't be showing how it can be done here but you can learn by reading the man page, or maybe waiting for my handbook that still in process. Here are the tools,

ipsumdump - http://www.cs.ucla.edu/~kohler/ipsumdump/

tcpdpriv - http://ita.ee.lbl.gov/html/contrib/tcpdpriv.html

tcpmkpub - http://www.icir.org/enterprise-tracing/tcpmkpub.html

There maybe other tools like netdude where it can edit network trace files on the fly. With those tools you can remove or modify the confidential data in the network trace files and share to the world.

P/S: For people wonder what I'm doing lately since not much updates in the blog, I'm still writing technical materials for the handbook that I plan to release after HITB conference.

Cheers :]

Aget - Flashget?

There's no open source flashget but there's a relatively good and fast http downloader which using multi threads to retrieve files from http server, though it is kinda old tool but I like it for the fact that it offers fast and consistent download speed, let's check out Aget. You may find the main site of aget at

http://www.enderunix.org/aget/

I run aget with the recommended -n 20 threads and use -f to force the usage of 20 threads, there it goes ----->>>>>

With my crap ISP home link, I can get roughly of 83Kb/s. This is not bad at all for my situation. The only thing that aget lacking would be support for ftp, however since aget is no longer in active development, I doubt that it will be updated with that functionability, you can use wget for that purpose as alternative.

Cheers :]

Netflow - One Useful Link

While digging the information regarding Netflow, I found a very good reference and useful link, I think I will read over it in details before jumping to other resources I found because this seems to be better and complete with the RFC reference as well.

http://netflow.caligare.com/

At the same time, I'm trying to learn about protocol tunnelling which I seldom get in touch with that used to evade IPS/IDS most of the time.

Cheers :)

Fluxbox 1.0 RC

Version jumping again from the project after Wireshark(ethereal), Fluxbox goes 1.0 RC after 0.9.15, here we see another open source project grows to be mature. Check it out at www.fluxbox.org.

Again I haven't been doing much blogging, real life sucks me out of it. I have been doing a lot of researches and studies on how one can use generic flow analysis to detect anomaly or malicious network activities.

Fosscar is around, for people who don't know about it, you may check it out at www.fosscar.com. Me and other OSS folks will be speaking and running workshops in the event. Hopefully I get a chance to have beer with them again.

Have fun :)

FreeBSD - IDS Sensor Tweaking

IDS used to suffer in high speed network where it need to sustain the heavy load traffics while detecting malicious traffic. Relying solely to the IDS software seems not to be a right idea, hence OS tweaking is supposed to be done in order to build a perfect Intrusion Detection System with commodity hardware, of course gigabit network card is preferred with lots of RAM. Here's my current testing configuration and I hope this is helpful to certain people who want to run IDS with comodity hardware and using either Bro-IDS or Snort. The OS I'm running is FreeBSD, you may find similar tweaking with Linux.

I added this to kernel config file in order to enable device polling,

options DEVICE_POLLING
options HZ=1000

After recompile the kernel and install it, I added those values below to the /etc/sysctl.conf

net.bpf.maxbufsize=8388608
net.bpf.bufsize=4194304
net.inet.tcp.sendspace=65536
net.inet.tcp.recvspace=65536
net.inet.tcp.rfc1323=1

Then I added this configuration to /etc/rc.conf for the network interface that used to capture network traffic and running IDS as well.

ifconfig_fxp1="polling promisc up"

I suggest if you are running IDS with commodity hardwares, you may need two network interface, one will be the management interface with access control enabled and another one just run as IDS interface, the configuration above applies to the IDS interface where IP is not needed and no other traffics inteference except the traffic you want to capture.

I'm currently testing how well this experimental IDS box in heavy load traffic, I run snort in sniffer mode,

shell>snort -i fxp1 -D

My snort PID is 738, since I have bpfstat installed, I try to run -

shell>bpfstat -i 3 -I fxp1 -p 738

You can view the result in the screenshot, 0 drop rate .....

If you happenned to know the better tweaking of OS or you are actually performing tweaking for your IDS box in different kind of OS as well, please do feedback or comment. I would like to learn more ways of building IDS boxen with commodity hardware.

Cheers (:])

FreeBSD - Google Earth

Since my friend told me the availabilities of Google Earth on Linux Platform with it's beta v4 release, I just browse to take a look there - http://earth.google.com/index.html, I downloaded the Linux version and think that it maybe fun to try to install it on FreeBSD, and with Linux ABI supports enabled, I then just go to directory that I have google earth downloaded and run sh ./GoogleEarthLinux.bin, the installation works flawlessly and you may check out the screenshots below.

Configure and Install .....

Installation Done ..... :)

Running Google Earth at the first time .....

Check out where I'm now .....

I'm kinda happy with Google Earth on FreeBSD, though it maybe slow because of soft emulation. Enjoy .....

Cheers :]

FreeBSD last.fm

I know you like radio station with cool musics don't you, and last.fm might be one of the popular fm these days, in fact last.fm been very Open Source Oriented, you can even download the player for various OS including Linux and FreeBSD, I have just downloaded the FreeBSD version and try installing it, tada!!!! It goes perfectly and I can now have fun with last.rm. Remember to register in last.fm.

Downloading it .....

Install with pkg_add after downloading it and start playing with last.fm.

That's all, folks.

Cheers :)

Session Data - Useful Links

I have been doing a lot of reading on netflow and session data collections and methodologies, and since I'm now moving to more systematic learning method, I always collect all the useful links and documentations before reading it in one shoot, there may be information overflows but I think that's more easy to make comparisons when reading and intepret. Since I find them useful, I might share the links as well, here you have it -

http://www.cs.dal.ca/~mchugh/netanalysis/slides/01-Introduction-2up.pdf

http://www.dynamicnetworks.us/netflow/index.html
http://www.networkuptime.com/tools/netflow/
http://www.hcs.ufl.edu/~park/tracearchive.html
http://events.ccc.de/congress/2005/fahrplan/attachments/560-Paper_IntrusionDetectionSystems.pdf

http://users.pandora.be/jurgen.kobierczynski/jkflow/eindwerk.pdf

www.educause.edu/ir/library/powerpoint/MWR0574A.pps

www.cert.org/flocon/2005/presentations/Trammell-Translator-FloCon2005.pdf

http://www.acsac.org/2005/case/wed-1030-yurcik-paper.pdf

http://cansecwest.com/core03/jhaile-cansec03.ppt


You can subscribe Argus Mail List at

https://lists.andrew.cmu.edu/mailman/listinfo/argus-info

Most of the links are presentation type so it should not take too much times to read. Hopefully you enjoy reading them.

Peace :]

Desktop Tips - icon

Again this is small tips for desktop users, if you happenned to have lovely icons that not available in your Open Source OS, you can actually convert it with the small util which is called iconconvert, just grab it via port/package will do,

shell>pkg_add -vr iconconvert

And if you have file with png format and you want to convert it to xpm which is loadable via fluxbox, you can use the small script that written by tenner via,

http://tenr.de/files/png2xpm.sh

There you will have tons of icons that you can use now.

Cheers :)

Xtra for ThinkPad X series Fluxbox users

If you are happenned to have Thinkpad X series and you are Fluxbox user, this is for you. I have few keys mapping work perfectly, here's how my configuration.

Here's my ~/.Xmodmap

keycode 92 = F13
keycode 111 = SunPrint_Screen
keycode 233 = XF86Forward
keycode 234 = XF86Back

Here's the keys file under ~/.fluxbox

Mod1 l :ExecCommand xlock -mode matrix -geometry 1x1 -enablesaver

None XF86Forward :NextWorkspace
None XF86Back :PrevWorkspace
None Print :ExecCommand scrot '%Y%m%d%R_$wx$h_scrot.png' -e 'mv $n ~/i-Screenshots/'

You can now jump to previous/next workspace with the mail forward and mail backwad key, and the printscreen will work too after you install scrot via package. Alternate + L will lock the machine if you install xlockmore.

Remember to add xmodmap ~/.Xmodmap at ~/.fluxbox/startup, this is important to get the key mapping works.

And guess WHAT?!!! Lenovo now turns their head again, check out the link below -

http://www.desktoplinux.com/news/NS5301096581.html

Again, we cheers :]

FreeBSD - Fluxbox + Gdm

I have been in Freenode #fluxbox channel for a while, it seems that many people are asking the same question regarding how to setup fluxbox on FreeBSD, previously I have written how to setup Fluxbox + Gdm in OpenBSD and I think I should write this one for FreeBSD. I will discard the X configuration part because it is similar to the previous OpenBSD Fluxbox post. Here's the quickies -

Installing fluxbox-devel and gdm, remember don't install the old fluxbox, many FreeBSD used to install the old stable version which is not actually stable compare to the recent devel version.

shell>pkg_add -vr fluxbox-devel gdm

Configure it to load through gdm,

shell>cd /usr/X11R6/share/gnome/xsessions

shell>touch Fluxbox.desktop

Adding the lines below to Fluxbox.desktop,

[Desktop Entry]
Encoding=UTF-8
Name=Fluxbox
Exec=/usr/X11R6/bin/startfluxbox
Icon=
Type=Application

Configuring ~/.xsession

Add this line,

exec startfluxbox

To add it into gdm session alternative,

shell>echo "exec /usr/X11R6/etc/gdm/Xsession \
/usr/X11R6/bin/startfluxbox" >> /usr/X11R6/etc/gdm/Xsession

Now you can find that you have fluxbox as alternative in your gdm menu when you login, just choose it if you want Gdm to lauch Fluxbox after login.

- Go Fluxy -

Cheers (:])

Bro-IDS - The learning process

Since I want to have more tools to provide valuable alert data for clues when accessing network traffic, I have installed bro-ids on my FreeBSD workstation. It is installed fine on FreeBSD, however when I try to run bro against pcap file, I get an error where bro.init not found, bro.init file is in policy directory and running bro in that directory works, so that must be path issue and it can actually be resolved easily by adding the following lines to your .bash_profile if you are using bash shell.

BROHOME=/usr/local/stow/bro-1.1
BROPATH=/usr/local/stow/bro-1.1/policy:/usr/local/stow/bro-1.1/site

export BROHOME BROPATH

That's it and now bro runs perfectly fine.

$BROHOME is your default Bro home directory and for your local config tweaking, you need to check for site directory under $BROHOME. Bro disables it's signatures detection capability by default, to turn it on, you just need to load the line below to the file - local.site.bro or one with your host.domain.bro,

@load brolite-sigs

Then restart Bro with the command /usr/local/etc/bro.rc checkpoint. In snort, those protocol decoders are defined as preprocessor, however in bro, it is called analyzer. Those analyzers are mainly the policy scripts that under $BROHOME/policy. You can write your own analyzer if you need one, that's pretty similar where you can write your own preprocessor for snort, especially version 2.6 now that you no longer need to patch snort to get unofficial/external preprocessors. You have dynamic preprocessor loading capability in snort 2.6!

I try to correlate the similarities of bro and snort so that I can take bro easily in my learning process, though Bro is developed for research purpose, it can be very powerful when comes to provide alert data. And those documentation and manual are comes with the source tarball when you downloaded Bro, so I read through the documentation and there are few chapters that pretty interesting such as Bulk Traces & Off-Line Analysis. Those mentioning how to analyse pcap file and using Bro to extract the packet payloads. I still feel adventureous with trying more stuffs with Bro and maybe getting a sensor running Bro to see how it goes.

That's all for Bro now, peace :]

Sguil Client - Quick && Easy

I remember I have problem installing Sguil Client on FreeBSD previously that push me to use source installation for one of the tcl libraries, however in FreeBSD 6.1, this is no more case, it is even rather easy to get sguil client works compared to other OS now. The steps are, should be the step is

shell>pkg_add -vr tcl tk tcllib tclX itcl itk iwidgets

Now just download sguil client from source forge, untar and run

shell>wish8.4 ./sguil.tk

Here's the screenshot,


By the way I'm now updating my snort to 2.6, hopefully I can play with it later.

Cheers :]

Multipurposes post :]

I have been out of posting due to some serious matters, anyway I think I should be writing some stuffs to keep me going. First of all, I'm pretty satisfied and happy that I have reached 200 blog posts where I never think of writing so much. Thanks for the comments and feedbacks along.

Few things I want to blog about are I will no longer be supporter of IBM ThinkPad after Lenovo bought over it's brand name, the bad design and idea that put the Thinkpad to the dead, what can I say, Lnv you sux big time - check the link below.

http://hardware.slashdot.org/article.pl?sid=06/06/04/0415221

I guess my main choices would be either Toshiba or HP now, seriously Lnv is a real ass hole. Bye beloved IBM ThinkPad. For people who haven't have chance to look at the new Z series, the design is utterly ugly.

I have fun playing with Bro-IDS under FreeBSD, it is installed fine on FreeBSD 6.1R, here's are the note when I install it. You need to install the package below first

shell>pkg_add -vr p5-Config-General adns

Then just run the usual configure, make and make install, since I'm not integrating bro as the tool to provide alert data, I prefer it to be on /nsm for management wise, so that's what I do, again I use stow for source installation management. I untar the bro-1.1 and start my installation process with

shell>mkdir /nsm/stow

shell>./configure --prefix=/nsm/stow/bro-1.1

shell>make && make install

shell>make install-brolite

It will ask you a series of questions for configuration settings.

shell>cd /nsm/stow && stow bro-1.1

Installation are done now and you can start bro with

[root@trinity /nsm/stow]# /nsm/stow/bro-1.1/etc/bro.rc --start
bro.rc: Running as non-root user bro
bro.rc: Starting ..........bro.rc: Failed to start Bro
/usr/local/stow/bro-1.1/bin/bro: problem with interface bge0 - pcap_open_live: (no devices found) /dev/bpf0: Permission denied
... FAILED

Since I get permission denied, I change the permission setting of bpf0

[root@trinity /nsm/stow]# ls -la /dev/bpf0
crw------- 1 root wheel 0, 115 Jun 6 07:28 /dev/bpf0
[root@trinity /nsm/stow]# chmod 604 /dev/bpf0
[root@trinity /nsm/stow]# /nsm/stow/bro-1.1/etc/bro.rc --start
bro.rc: Running as non-root user bro
bro.rc: Starting ............. SUCCESS

To check if it is running,

[root@trinity /nsm/stow]# ps auxww | grep bro
bro 17459 0.0 0.1 1760 1104 p3 I 10:29AM 0:00.03 /bin/sh /usr/local/stow/bro-1.1/etc/bro.rc --start
bro 17464 0.0 1.1 12716 11512 p3 R 10:29AM 0:04.76 /usr/local/stow/bro-1.1/bin/bro -W -i bge0 trinity.dissectible.org.bro
bro 17510 0.0 0.1 1760 1104 p3 I 10:29AM 0:00.00 /bin/sh /usr/local/stow/bro-1.1/etc/bro.rc --start
bro 17512 0.0 0.5 6836 5584 p3 S 10:29AM 0:00.12 /usr/local/stow/bro-1.1/bin/bro -W -i bge0 trinity.dissectible.org.bro print-filter.bro

Check if it adds the cron entry correctly,

[root@trinity /nsm/stow]# crontab -e
BROHOME=/nsm/stow/bro-1.1
# checkpoint Bro once a week
0 0 * * 1 /nsm/stow/bro-1.1/etc/bro.rc --checkpoint
10 00 * * * ( nice -n 19 /nsm/stow/bro-1.1/scripts/site-report.pl )
10 3 * * * (/nsm/stow/bro-1.1/scripts/mail_reports.sh /usr/local/stow/bro-1.1
/etc/bro.cfg)
0 3 * * * (/nsm/stow/bro-1.1/scripts/bro_log_compress.sh)
# If you are process logs on a front end host, add this:
#10 3 * * * (/nsm/stow/bro-1.1/scripts/push_logs.sh FrontendHost)

Bro suggests tweaking bpf buffer size and its max value, I tweak it manually, I'm thinking of testing this sysctl settings for my sguil sensor as well and guess it should be applicable.

shell>sysctl net.bpf.maxbufsize=8388608

shell>sysctl net.bpf.bufsize=4194304

To uninstall it cleanly, again we will make use of stow,

shell>cd /nsm/stow && stow -D bro-1.1

Go to the bro source directory and run

shell>make uninstall

shell>rm -rf /nsm/stow/bro-1.1

shell>make distclean

Now everything back to the previous state where you haven't installed bro-ids. Since bro-1.1 is installed cleanly, I supposed it should be easy to make into port/package, the FreeBSD package which is version which is version 0.8 is kinda dated, may need to email the porter for updates.

For sleuthkit on FreeBSD, you need to install the package below or else mactime won't work,

shell>pkg_add -vr p5-Date-Manip

Autopsy is not working when install via package, as it can't find Main.pm. Thus I install using port and it works now.

shell>cd /usr/ports/sysutils/autopsy && make && make install

Now what?!!! Of course snort, snort-2.6 Final is released, you may find out all interesting features and updates in the link below, go go snorting .....

http://www.snort.org/pub-bin/snortnews.cgi#445

Hopefully I can make to 300 blog posts !

Cheers (:])

BackTrack v1.0 Final Release

Just to pretend like I have something updated in my blog, BackTrack - one of the coolest Cyber Security LiveCD unleashed. I'm currently downloading it and hopefully I can spend some times to play with it. You can find the BackTrack info here.

The LiveCDs that worth to be kept in my pocket are Helix and BackTrack at the moment since both LiveCDs are the quickies for me when I need to use the related tool. Maybe there are other alternatives out there but then I have no time to try out so many distros for current moment.

That's all for now .....

- Peace -

Busy .. busy ..

I have been very busy with my personal life lately and having no times to tinker with much stuffs, will try to update my blog as soon as possible once I have time in hand.

Yeah regarding the progress of OpenNSM project, me and my pal are still working on it, it is ongoing project that need to be done correctly in timely manner, if any of you have experience in writing OpenBSD port, indeed we need more hands since we are busy.

For myDEFCON LiveCD, the outline is done and proceed to work on enhancements and modifications. Again like I said, need more hands on that too, 24 hours never enough for a person like me.

Anyway Cheers :]

Forensic Analysis

I have been reading about file system forensic and analysis here and there, and without putting it into my practical work, it seems that I can't get to master or at least handy when performing file system forensic analysis, I decide to be more systematic where I have collected the documentations online and few good and recommended books, that may help me to learn in more efficient way. Of course my priority always falls to Open Source Tools, Sleuthkit/Autopsy and Pyflag will be my primary tool through out the learning process. Helix Live CD will be used since it contains lots of forensic tools as well. Here are my to-learn list in sequence -

http://www.efense.com/helix/docs.php

http://www.realdigitalforensics.com/real-digital-forensics-blog

http://www.porcupine.org/forensics/forensic-discovery/

http://www.sleuthkit.org/informer/index.php

http://www.digital-evidence.org/fsfa/

By the way, I have just successfully installed Sleuthkit/Autopsy which is the latest release that support Export Witness and AFF file format on OpenBSD. In order to get it install, you need to use gmake instead of make, just install gmake via package/port will do. Since both Sleuthkit and Autopsy are not too tricky to install, I won't show here again. However if you do have problem of getting them installed, feel free to email me. Below are the only screenshot I have taken for Autopsy.

Cheers (:])

Sguil Sensor Monitoring & Reporting

People are concerning about their network security most of the time, so monitoring network security is important, however rarely that we hear people concerning about whether their monitoring devices go wrong or malfunction instead of working properly. Especially in distributed sensors setup environment, monitoring the health and status of sensors considered part of the important role.

If you happen to use OpenBSD, there's a tool that available in the port called symon, it has been ported to FreeBSD and linux as well. Symon is light weight system monitor that used to monitor the health of system either locally or remotely with symux collecting and displaying the statistic. The beautiful part of it should be priviledge dropping so that symon won't run as root, and you can download syweb which will draw the rrd graphs based on your configuration that works perfectly with chrooted Apache as well.

With symon, you can even specify what process to monitor such as snort, httpd and etc. That is useful to know how much resources been used by your IDS or daemon. I'm currently still testing it before deploying on productive environment and quite satisfy with the result. I won't be showing you here how I get it done since the documentation that you can view here good enough to get it work.

Symon is one fine tool that you can use to monitor the health of your sensor remotely with it's small footprint. I supposed people will love it for the sake of it's flexibilities too.

Below are the 4 screenshots of symon -

Another application that I have tried would be the project that developed by one of Sguil fellow, Paulh. Squert is a so called Simple Query And Report Tool for Sguil. It is useful because it is connected directly to the mysql DB and allows you to perform Sguil DB query and generate the reports out of it, it has been claimed very useful in mass sensors environment by Paulh :P.

Below are 2 screenshots of Squert -

Symon and Squert are both incredible tools for people who are deploying distributed mass sensors. One for the sake of health monitoring and another for the sake of reporting, I do wish that Squert can generate graphic report in the future which lacks in the NSM suite.

That's all for now, cheers :]

Bro-IDS - Be Loved

During my off day, I take my time to read about another interesting Open Source Network Intrusion Detection System - Bro-IDS. Beside Snort, I think it is another Open Source NIDS with riches of protocol analyzers and cool features.

I'm reading almost all the papers that published by Bro-IDS community which you can find here. I'm pretty enjoyed when reading the papers regarding Dynamic Application Layer Protocol Analysis For Network Intrusion Detection and Building a Time Machine for Efficient Recording and Retrieval of High-Volume Netowrk Traffic. The first one outlines the problem of static port based protocol decoding such as using http analyzer when traffic flowing through port 80 and what if the http traffic that flowing through other port instead of standard well-known port or maybe non-http traffics that tunneling through port 80. Bro-IDS implements the protocol identification analyzer[PIA] to solve the problem. The second paper emphasizes on the important of collecting full content data in high speed network and providing workaround of storage issue with various methods such as traffic prioritizing, cutoff, classification, bpf filter and etc. In NSM approach, full content data is very important and I think this paper is very useful especially most of the sguil users deploy NSM by using commodity hardware and that's what has been used to test in the paper with very impressive result.

I'm quite fascinated by what Bro-IDS offers, though it is not as popular as Snort, however the capabilities of Bro-IDS can't be underestimated at all.

At the time of writing, I have no luck with compiling Bro-IDS 1.1 which is current release on OpenBSD , previous version(0.9) was compiled succesfully however I would like to try out the latest release since it has more advance features and bugfixes.

If you have deployed Bro-IDS, feel free to comment and I would like to know your experience on it.

Peace :]

PADS Signature Writing

Since PADS lacking of signatures, it is not efficient enough to do services profiling, so I think adding signatures to it might be good since it is now integrated to Sguil. After navigating the PADS signature file with my slightly understanding of PCRE, I start working on it, the services signature looks similar to nmap services probe sig, I decide to use nmap -sV to generate the traffic and grabbing the banner for sig writing.

In my case, I copy all the PADS config files to /etc/sguils. The main configuration for PADS is pads.conf, I renamed it to pads-test.conf, here's my config -

# Pads Configuration - pads-test.conf

daemon 0
pid_file /var/run/pads.pid
sig_file /etc/sguils/pads-signature-list
mac_file /etc/sguils/pads-ether-codes
user pads
group pads
interface pcn0
network 192.168.1.0
output screen

You may see I choose to output it to screen, that is useful when you are experimenting with the new signatures writing as well as testing. The signatures file for PADS are pads-signature-list and pads-ether-codes, pads-ether-codes only storing the info of vendor's code that map to the first 24 bits of MAC address, pad-signature-list is the heart of PADS where it stores all the services signatures.

After tinkering with it, I had these two signatures written and adding it to pads-signature-list. One for X11 and another for ssh.

ssh,v/OpenSSH/$2/Protocol $1/,SSH-([.\d]+)-OpenSSH[_-]([\S]+)[\s]+[\n]

x11,v/Xorg//Access Denied/,^\0\x16\x0b...\x06.No\x20protocol\x20specified\x0a\x04\x3c

I rerun PADS again this time, instead of getting unknown applications, now I seem to get the result I wanted.

shell>pads -c pads-test.conf
pads - Passive Asset Detection System
v1.2 - 06/17/05
Matt Shelton

[-] Filter: (null)
[-] Listening on interface pcn0

[*] Asset Found: Port - 22 / Host - 192.168.1.55 / Service - ssh / Application - OpenSSH 4.3 (Protocol 1.99)
[*] Asset Found: Port - 6000 / Host - 192.168.1.55 / Service - x11 / Application - Xorg (Access Denied)

[-] 1107 Packets Received
[-] 0 Packets Dropped by Software
[-] -2116931312 Packets Dropped by Interface

The services are recognized after I have added the signatures, however there's one thing I found weird, if you look at the last line - 2116931312 Packets Dropped by Interface, I'm not sured why it shows this negative amounts of packets which is huge. Anyone have experienced and figured out why, please comment!

By the way, this is about PADS Sig writing, I will add more sigs once I have time which I have done the same thing to tcpxtract. By the way I learn a few PCRE tricks when writing the signatures.

Cheers (:])

OpenBSD PF logging with NSM

I haven't tried on this yet but this is just my shameless idea, since PF allows logging traffic of interest with log modifier, I'm thinking is it possible to just log only the network traffics that passing through the Firewall then running snort IDS on the PF logging pseudo interface which is pflog0. Additionally we also log the full content data of that interface. Yet with this method we only concentrate on the traffics that passing through the Firewall and ignoring the blocked traffic, we also save the space without logging every single bit(I bet you don't want to detect the blocked intrusion which is unsuccessful).

Another idea of mine would be The Automated Worm Screening System. I think this can be done with Open Source Tools. With snort2c, p0f, tcpkill/pfctl and OpenBSD PF, that's possible to block the worms propagation across networks. This is to create sort of Intrusion Prevention System but only concentrate on certain type of malicious traffics.

Last but not least, for people who have problem when writing PF filtering rules, you should enable the log features so that you know which filtering rules allow or deny the network traffic. That will slightly easier to debug instead of guessing blindly.

Just my 2 cent of da day .....

Cheers :]

FreeBSD Mass Installations Using OpenBSD PXE Setup

I try to setup PXE environment to install FreeBSD by using OpenBSD box. After tinkering with it, I have a great success and I think this should be shared in case anyone may find it useful, for OpenBSD installation, it is rather easy by following the OpenBSD faq. Here's how I get things work.

Setting up Tftp server

Uncomment the line with tftp in /etc/inetd.conf

tftp dgram udp wait root /usr/libexec/tftpd tftpd -s /tftpfbsd

shell>kill -HUP `pgrep inetd`

Setting up dhcp server

Adding the part below to /etc/dhcpd.conf

shared-network LOCAL-NET {
option domain-name "dissectible.org";
option domain-name-servers 192.168.0.100;

subnet 192.168.0.0 netmask 255.255.255.0 {
option routers 192.168.0.1;
filename "pxeboot";
option root-path "/usr/pxeboot";
range 192.168.0.201 192.168.0.240;
default-lease-time 84600;
max-lease-time 90000;
}
}

Now add one liner to /etc/rc.conf.local

shell>echo "dhcpd_flags=" >> /etc/rc.conf.local

To start without rebooting, change the $NIC to your network interface variable -

shell>dhcpd $NIC

Filename refers to the pxeboot that you copy to /tftpfbsd which the client will fetch it once getting IP from dhcp server.

Root-path refers to the nfs path that storing freebsd base files(for installation) that extracted from the FreeBSD 6.1 iso.

Setting up the Nfs Server

Create the directory you want to export as network file system.

shell>mkdir /usr/pxeboot

Adding the line belows to /etc/exports

/usr -alldirs -maproot=nobody

Or if you want to be stricter and only allow hosts in the 192.168.0.0/24 network to access only,

/usr /usr/pxeboot -maproot=nobody -network=192.168.0 -mask=255.255.255.0

To run everything manually,

shell>/sbin/nfsd -tun 4

shell>echo -n > /var/db/mountdtab

shell>/sbin/mountd -d /etc/exports

You can check the nfs server info with rpcinfo -p and showmount -a

To mount nfs filesystem

shell>mount -o ro -t nfs 192.168.0.55:/usr /mnt

Or to have it mounted on boot, add this to /etc/fstab

192.168.0.55:/usr/pxeboot /mnt nfs ro.nodev,nosuid 0 0

To put nfs starts onboot, add them to /etc/rc.conf.local

portmap=YES
nfs_server=YES
nfsd_flags="-tun 4"

After you have setup all the servers, you need to download FreeBSD installation iso.

shell>cd /tmp; wget \ ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/ISO-IMAGES/6.1/6.1-RELEASE-i386-disc1.iso

Now I have the iso, I need to extract the image contents out of it.

shell>vnconfig svnd0 /tmp/6.1-RELEASE-i386-dist.iso

shell>mount -t cd9660 /dev/svnd0c /mnt

Sync the content of the image to /usr/pxeboot/

shell>rsync -avH /mnt/ /usr/pxeboot/

By now you have the content of FreeBSD 6.1 image in /usr/pxeboot.

Then append this part to /usr/pxeboot/boot/loader.rc

load /boot/kernel/kernel

load -t mfs_root /boot/mfsroot

set vfs.root.mountfrom="ufs:/dev/md0c"

boot

Copy the pxeboot to the tftp server directory

shell>cp /usr/pxeboot/boot/pxeboot /tftpfbsd

Reboot it once you have everything configured.

It's done now and you can start the network client with netboot. If you are installing fbsd using nfs, just specify /usr/pxeboot as base directory when asked.

I use this setup to install FreeBSD 6.1, for anyone who owns IBM Thinkpad x41 where you don't have the docking station, this is the best way to install FreeBSD 6.1 on it since you can't install with your usb combo drive.

Here are the internet resources I found useful,

http://typo.submonkey.net/articles/2006/02/12/having-a-bad-day

http://gja.space4me.com/things/Using_pxeboot_Install53.html

http://www.openbsd.org/faq/faq6.html#PXE

I wrote a simple pxe setup script to automate the setup since I hate doing the same things over and over again. You can download it here.

Peace :]

HTTP Request

There are different kind of http request methods that supported by the web servers that based on thier implmentation and configuration. The recent OpenBSD team that decides to turn off trace method of their apache distribution to protect against XSS considered a right move since it is not much in used and render the server vulnerable to attack.

If you are heavy curl user, you may already know that curl allows you to custom your own http request method with -X switch. However I have recently came across this tool call metoscan that allows you to perform checking on the http requests that enabled and supported by the web server. It is considered a nifty tool to initiate pentest against web server. You may find other http related tools as well from here.

I downloaded metoscan and start compiling with gcc -o bla bla bla. To scan the web server, one just need to run it with target url provided. For example,

shell>./metoscan 1.2.3.4

MetoScan - Simple HTTP Method Scanner

Method: GET => 302 (MOVED TEMPORARILY)
Method: POST => 500 (INTERNAL SERVER ERROR)
Method: HEAD => 302 (MOVED TEMPORARILY)
Method: PUT => 302 (MOVED TEMPORARILY)
Method: TRACE => 200 (OK)
Method: TRACK => 302 (MOVED TEMPORARILY)
Method: SEARCH => 302 (MOVED TEMPORARILY)
Method: INDEX => 302 (MOVED TEMPORARILY)
Method: OPTIONS => 302 (MOVED TEMPORARILY)
Method: DELETE => 302 (MOVED TEMPORARILY)
Method: CONNECT => 400 (BAD REQUEST)
Method: PATCH => 302 (MOVED TEMPORARILY)
Method: PROPFIND => 302 (MOVED TEMPORARILY)
Method: PROPPATCH => 302 (MOVED TEMPORARILY)
Method: MKCOL => 302 (MOVED TEMPORARILY)
Method: COPY => 302 (MOVED TEMPORARILY)
Method: MOVE => 302 (MOVED TEMPORARILY)
Method: LOCK => 302 (MOVED TEMPORARILY)
Method: UNLOCK => 302 (MOVED TEMPORARILY)
Method: CHECKOUT => 302 (MOVED TEMPORARILY)
Method: SHOWMETHOD => 302 (MOVED TEMPORARILY)
Method: LINK => 302 (MOVED TEMPORARILY)
Method: UNLINK => 302 (MOVED TEMPORARILY)
Method: CHECKIN => 302 (MOVED TEMPORARILY)
Method: TEXTSEARCH => 302 (MOVED TEMPORARILY)
Method: SPACEJUMP => 302 (MOVED TEMPORARILY)
Method: ORDERPATCH => 302 (MOVED TEMPORARILY)
Method: ACL => 302 (MOVED TEMPORARILY)
Method: VERSION-CONTROL => 302 (MOVED TEMPORARILY)
Method: REPORT => 302 (MOVED TEMPORARILY)
Method: UNCHECKOUT => 302 (MOVED TEMPORARILY)

If you understand what's the http status code, you may understand better the output of it. I have mentioned the important of understanding http status code previously and now it helps me to intepret the result easily.

Enough for now, it's Saturday nite here :P

I should go out to get some b33r5,

Ch33r5 :]

Bad Day

My lovely testing machine is dead, I totally have no idea how to fix it since it keeps popping error after booting, it must be hardware issue.

I have been busy with my hardware stuffs and trying to clean things up, however sometimes when luck is not with you, you may always get things like OS dropping into debugger shell, OS can't be loaded properly and other mess. I have been trying hard to fix them now. Old hardware is always sensitive where you can't simply pull the plug!!!!!

I'm still looking around to get old hardware which is abandonned. There are lots of people out there abandon their old hardware and just putting it at home in dead state, I would like to give a life to those hardware and one of my friend says that he has tons of old hardwares that he hasn't tested and may pass it to me, I'm looking forward to build my better testing lab with them.

Don't put the machine aside, give them life :]

Large Scale of Sguil Sensor Installation

After sometimes of installing Sguil manually, and with sguil installation script done that easing my installation process, I still feel that it is not efficient enough when comes to the large scale of NSM deployments. Instead of working for the machine, I would prefer the machine working for me. Thus, I'm pretty interested in using PXE BOOT to perform massive Sguil Sensors installation which almost having the same set of installation and configuration that may save whole lots of times. Anyone has done OpenBSD PXE NETBOOT installation, please comment.

There's nifty guide on OpenBSD faq, check it out here.

By the way, me and my pal who want to keep himself low profile, are working on the project called OpenNSM. We are targetting on making OpenBSD Sguil Installation ISO. Work in progress and may release once we finished it. Stay tuned.

Peace :]

The Art Of Defensive

Firewalling used to be very versatile and effective in defending and guarding your network. However it is only useful in the situation where it can block most of the network traffics with malicious packet header.

However one weaknest point about Firewall should be its lacking of capability to throttle the already initiated and established connections. Hence the hackers used to take advantage of this especially when they are performing DDOS.

A single host connecting to web services with multiple threads enough to consume http resources easily to reach the max client limit and render your web services down. Especially if the malicious host connecting with validate tcp 3 way handshake where we can't just block by the packet header. In OpenBSD PF, you can add the malicious hosts IP to the table to drop it's connection, however that's not enough to kill massive DDOSING since you have to define the malicious hosts and adding them to the table. Furthermore, you can't drop the already established connection and this is totally causing havoc where the services hardly offer it's resources to the legitimate connection from your web client. This problem not only bounced to web services but any services that utilizing TCP such as dns, smtp as well.

However I will concentrate on web services here. HTTP is stateless, though it is carried over TCP, however the connection itself shouldn't be sticky. Thus we know that if same IP appears in the netstat output multiple times which connecting to port 80.

This shouldn't be right. Thus we need to find a way to throttle/kill the connections from this particular IP which should be malicious before adding it to either iptables chain or PF table. With that we will be able to kill the already established connections from the malicious IP and blocking it's further connections.

There are 4 tools that allows you to kill TCP connections easily -

Flowgrep - http://monkey.org/~jose/software/flowgrep/

Cutter - http://www.lowth.com/cutter/

TCPkill - http://monkey.org/~dugsong/dsniff/

TCPdrop - OpenBSD Native tool

I have mentioned flowgrep for couple of times and just save my words for other tool here. To kill the connections, what you need to do is specify the IP that you want to kill or you can be more specific by killing hosts that initiated connected connection with certain port.

Cutter is useful if you install in the Firewall Device, it can't do much when you are trying to kill the connection to the host with cutter installed but only good in killing connections that going through the Firewall Device with cutter installed. Cutter installation is straight forward, just gcc -o cutter cutter.c will do. The cutter syntax is pretty straight forward which is - cutter DST IP DST PORT SRC IP SRC PORT. For example if you want to kill the connection from 1.2.3.4,

shell>cutter 1.2.3.4

Or if you want to kill all http connections from 1.2.3.4

shel>cutter 1.2.3.4 80

That's pretty self-explanatory. The other useful tool should be TCPkill which is actually come together with dsniff-suite. TCPkill is used to kill the connection as well, however it is more powerful than cutter since you can use it to kill any TCP connection to your host instead of relying on border router ACL or Firewalling. For example to kill the connection from 3.4.5.6, just run

shell>tcpkill -i eth0 host 3.4.5.6

TCPkill is powerful as it supports bpf filter. You can kill multiple hosts at once with

shell>tcpkill -i eth0 host 3.4.5.6 or host 4.5.6.7 or host 5.6.7.8

The last one I would like to mentionned is TCPdrop that actually installed by default in OpenBSD base system. Not much people know about it and it should be used to throttle malicious network traffic without relying third party tools. To drop the connections from 6.7.8.9, just run

shell>tcpdrop 6.7.8.9

The syntax is kind of similar to cutter and you can kill by specifying port as well.

Now we have all the alternative tool, how can we make use of it in DDOS situation, we should drop those connections that already initiated and established by malicious host and adding those IP to either IPtables or PF. In PF, you can use source tracking to disallow certain IP to exceed the state or if you are on Linux, you can make a counter on netstat output and if a single IP exceed the counter, just add it to iptables with -I on the fly. This may insert it into the rules and blocking further connections from that particular IP. I won't show the full script here that doing everything where it kills the non-legitimate connections add to the IPtables of PF. But here's the simple tip to check on it, I have tried this on CentOS and having very good result defending DDOS. To make a counter per IP, just run -

shell>netstat -plan|grep :80|awk {'print $5'}| \
cut -d: -f 1|sort|uniq -c|sort -nk 1 | \
awk '{if ($1 > 10 && $2 != 0.0.0.0) print $2 }'

With the command above, you maybe able to get all the hosts with more than 10 connections to the same port(80) in netstat result. Once you have those IPs, you can throttle them with the tools mentioned above and add them to firewall rules on the fly. This will be really helpful. In order to automate it, you may need to write your own script to do it all for you but I think that's not too hard, right! And if you don't want to block the IPs forever, just make use of expiretable that I have mentioned here.

Have fun, cheers (:])

OpenBSD and FreeBSD New Release

This is late news, and I suppose everyone already knew it, OpenBSD 3.9 is out and so do FreeBSD 6.1. I'm currently downloading FreeBSD 6.1 and may install it later. If you love OpenBSD, please donate to the project as it is currently lack of fund. If you ever happen to use OpenSSH, please consider donating to keep the project going as well. For freeBSD team, thanks again for creating such brilliant OS, you guys rox!!!!!

- When {Puffy} Meets ^RedDevil^ -

Cheers :]

OpenBSD 3.9 Sguil Client Installation

I finally get Sguil Client installed in more clean method, I compiled everything from source and making use of stow for application management purpose. I have written a very simple Sguil Client installation script which will merge to Sguil Server and Sensor installation script later. I have also tar all the necessary source tarball and hosting it at dissectible.org. I have also included the md5 and sha1 checksum value for security purpose. Here's the script -

#!/bin/sh

# OpenBSD-3.9 Sguil Client Installaition Script - sguilC-install.sh
# Written by geek00L[20060505]

# Note: Please install wget and stow from port/package
# It is needed in order to get Sguil Client installed!

sguilC_REPO=/tmp/sguilC
Appdir=/usr/local/stow

# Creating Application Directory
mkdir $Appdir

# Download all the sources
wget http://www.dissectible.org/anonymous/Misc/sguilC.tar.gz

# Untar the Source
cd /tmp
tar xvzf sguilC.tar.gz

# Installation started .....

# Tcl Installation

cd $sguilC_REPO/tcl8.4.13/unix

./configure --prefix=$Appdir/tcl-8.4.13

make && make install

cd $Appdir && stow tcl-8.4.13

ln -s /usr/local/bin/tclsh8.4 /usr/local/bin/tclsh


# Tk Installation

cd $sguilC_REPO/tk8.4.13/unix

./configure --prefix=$Appdir/tk-8.4.13

make && make install

cd $Appdir && stow tk-8.4.13

ln -s /usr/local/bin/wish8.4 /usr/local/bin/wish

# Copy tclConfig.sh and tkConfig.sh from /usr/local/lib to /usr/local/lib/tcl8.4
# and /usr/local/lib/tk8.4 so that itcl and iwidgets installing fine.

cp /usr/local/lib/tclConfig.sh /usr/local/lib/tcl8.4

cp /usr/local/lib/tkConfig.sh /usr/local/lib/tk8.4


# Tcllib Installation

cd $sguilC_REPO/tcllib-1.8

./configure --prefix=$Appdir/tcllib-1.8

make && make install

cd $Appdir/ && stow tcllib-1.8


# Tcltls Installation

cd $sguilC_REPO/tls1.5

./configure --prefix=$Appdir/tls-1.5 --with-ssl-dir=/usr

make && make install

cd $Appdir && stow tls-1.5


# Tclx Installation

cd $sguilC_REPO/tclx8.4

./configure --prefix=$Appdir/tclx-8.4

make && make install

cd $Appdir && stow tclx-8.4


# Itcl Installation

cd $sguilC_REPO/itcl3.2.1

./configure --prefix=$Appdir/itcl-3.2.1 \
--with-tcl=/usr/local/lib/tcl8.4/ --with-tk=/usr/local/lib/tk8.4

make && make install

cd $Appdir && stow itcl-3.2.1


# Iwidgets Installation

cd $sguilC_REPO/iwidgets4.0.1

./configure --prefix=$Appdir/iwidgets-4.0.1 \
--with-tcl=/usr/local/lib/tcl8.4 --with-tk=/usr/local/lib/tk8.4 \
--with-itcl=$sguilC_REPO/itcl3.2.1

make && make install

cd $Appdir && stow iwidgets-4.0.1


# Now just downloading the Sguil Client and run sguil.tk will do

cd $Appdir

wget http://nchc.dl.sourceforge.net/sourceforge/sguil/sguil-client-0.6.1.tar.gz

tar xvzf sguil-client-0.6.1.tar.gz

cp -fR sguil-client-0.6.1 $Appdir/sguilC-0.6.1

# Other Sguil Client Repo
# http://superb-west.dl.sourceforge.net/sourceforge/sguil/sguil-client-0.6.1.tar.gz

# Testing the installation to see if tcl suite works properly
#tclsh
#% package require Tclx
#8.4
#% package require tls
#1.50
#% package require Itcl
#3.2
#% package require Iwidgets
#4.0.1

# EOF (:])

After the installation, you may need to tweak the sguil.conf in /usr/local/stow/sguilC-0.6.1 and run sguil.tk will do.

Have fun with sguil :]

OpenBSD Terminal - Adding Font

Most of the time I use either mrxvt or rxvt, and the default font is killing my eye when I launch rxvt in my OpenBSD box. It is better to change the font type for better view. Here's the quicky, I like how the linux font project - lfp font type looks like and that's quicky to get it work.

Download the lfp-var and lfp-fix at

http://sourceforge.net/project/showfiles.php?group_id=3465

Then untar and install it easily

shell>bzip2 -d lfpfonts-var-src-0.84.tar.bz2 | tar xf -

shell>bzip2 -d lfpfonts-fix-src-0.83.tar.bz2 | tar xf -

shell>cd lfpfonts-var-src/src

shell>compile

After compile, you may fine lfp-var directory in lfpfonts-var-src directory. Do the same with lfpfonts-fix as well, and now you need to copy them to the font directory

shell>cd .. && cp lfp-var /usr/X11R6/lib/X11/fonts/

Again copy the lfp-fix that you have after compiling it to /usr/X11R6/lib/X11/fonts.

Then add the lines below to the File Section of xorg.conf which located at /etc/X11

FontPath "/usr/X11R6/lib/X11/fonts/lfp-fix:unscaled"
FontPath "/usr/X11R6/lib/X11/fonts/lfp-var"

Now you can run

shell>xset fp+ /usr/X11R6/lib/X11/fonts/lfpfonts-var

shell>xset fp+ /usr/X11R6/lib/X11/fonts/lfpfonts-fix

shell>xset fp rehash

To know what font types you have and make sure lfp is there, run

shell>xlsfonts

Or you can use xfontsel to select and preview the font styles.

shell>xfontsel

To add the font to the xterm or maybe rxvt, just add them to .Xdefaults under user directory. For example

# XTERM Settings
xterm*fonts: -lfp-gamow-bold-r-normal--9-90-75-75-c-90-iso8859-5

# RXVT Settings
rxvt*fonts: -lfp-gamow-medium-r-normal--9-90-75-75-c-90-iso8859-5

Here's the result, I think it is better and intuitive compare to the default font which is small.

Cheers :]

Snort - Rule Writing

I supposed to blog other stuffs but since there's someone asking me regarding snort rule, I think it would be nice to share with others. Sputera, has asked me about -

It came to my attention where any strings in "content" basically in ASCII. Now, attackers are intelligent enough. Can they translate the ASCII to HEX and detected in Snort.

WEB-IIS cmd.exe
Based on the rules, any strings with the word "cmd.exe" will trigger this alert.

Now, let say the attackers traslate it to HEX code, "63 6d 64 2e 65 78 65". Then, we write the rules content "63 6d 64 2e 65 78 65". Can or not?

But, basically HEX code are written in C/C++...

Let's correct the situation. Sputera, to clear your idea of how snort examines the packet, you should start learning looking at the packet content especially the payload itself, you should try either tcpdump or using snort in logger mode and read it with -r. Or if you find it too hard at first, try ethereal.

Snort normally will examine the payload, and the hex value normally will be converted to ascii for payload detection, so normally either the hex value "63:6d:64:2e:65:78:65" or "cmd.exe" will be detected when you using the content as payload detection method, remember content not only can be used to examine string but raw bytes. Normally attacker not translating it to hex but when the cmd.exe string sent through the wire, it will convert to binary form and translate back when it reaches the destination host and the packet is processed. That is nothing to do with bypassing the IDS, normally most of clever attackers will choose to either protocol tunneling, fragmentation or using covert channel to avoid detection of IDS instead.

And here's why it is not good to use hex value for detection but stick with the ascii strings with nocase. Before that, let's look at the default snort rule that used to detect cmd.exe through port 80 web service.

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS \
(msg:"WEB-IIS cmd.exe access"; flow:to_server,established; \
uricontent:"cmd.exe"; nocase; classtype:web-application-attack; sid:1002; rev:7;)

Since HTTP is TCP based, flow:to_server,established is perfect for the situation where connection should be established. URIcontent is used for http normalization, you should use uricontent instead of content matching since this is about http packet inspection.

About your idea to use hex value, I write a simple rule for it.

alert tcp any any -> any 80 (msg: "HTTP cmd.exe Access"; \
flow:to_server,established; content: "|63 6d 64 2e 65 78 65|"; \
rawbytes; classtype: web-application-activity;offset:5; sid;4000005)

This rule is simple, examine packet content with "63 6d 64 2e 65 78 65" hex value which is cmd.exe , if you are writing your own rule, put it in local.rules. I use rawbytes to avoid using http inspection.

I start running snort with

shell>snort -c /etc/snort.conf -l /nsm/snort-test/log -K ascii -i vr0

Then I tail the /nsm/snort-test/log/alert file

shell>tail -f /nsm/snort-test/log/alert

Let's see what happen when I try to test it. This part you can use netcat to connect to port 80 but I just open the url with the internet browser -

http://202.75.42.254/bigsis/cmd.exe

Both rules was hit and alert shown ....

[**] [1:1002:7] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/04-18:05:52.672196 192.168.0.50:62552 -> 202.75.42.254:80
TCP TTL:64 TOS:0x0 ID:20087 IpLen:20 DgmLen:497 DF
***AP*** Seq: 0xA818A623 Ack: 0x9637D2D2 Win: 0xFFFF TcpLen: 20

[**] [1:4000005:0] HTTP cmd.exe Access [**]
[Classification: access to a potentially vulnerable web application] [Priority:2]
05/04-18:05:52.672196 192.168.0.50:62552 -> 202.75.42.254:80
TCP TTL:64 TOS:0x0 ID:20087 IpLen:20 DgmLen:497 DF
***AP*** Seq: 0xA818A623 Ack: 0x9637D2D2 Win: 0xFFFF TcpLen: 20

When we look at the packet content, here's what I get

2006-05-04 17:02:26.970419 00:0f:3d:a0:c9:a9 (oui Unknown) > 00:0c:41:92:56:ee (
oui Unknown), IPv4, length 511: 192.168.0.50.64276 > 202.75.42.254.http: tcp 457
0x0000: 000c 4192 56ee 000f 3da0 c9a9 0800 4500 ..A.V...=.....E.
0x0010: 01f1 4764 4000 4006 3b7f c0a8 0032 ca4b ..Gd@.@.;....2.K
0x0020: 2afe fb14 0050 da63 30fb a627 b2bd 5018 *....P.c0..'..P.
0x0030: ffff f869 0000 4745 5420 2f62 6967 7369 ...i..GET./bigsi
0x0040: 732f 636d 642e 6578 6520 4854 5450 2f31 s/cmd.exe.HTTP/1
0x0050: 2e31 0d0a 486f 7374 3a20 3230 322e 3735 .1..Host:.202.75
0x0060: 2e34 322e 3235 340d 0a55 7365 722d 4167 .42.254..User-Ag
0x0070: 656e 743a 204d 6f7a 696c 6c61 2f35 2e30 ent:.Mozilla/5.0
0x0080: 2028 5831 313b 2055 3b20 4672 6565 4253 .(X11;.U;.FreeBS

I supress the output, and the packet matches the rule. However what if I'm drunk and accidentally hit the caplock :P

http://202.75.42.254/bigsis/Cmd.exe

You may notice the cmd.exe changed to Cmd.exe and this time, only the default snort rule showing

[**] [1:1002:7] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/04-18:06:10.533189 192.168.0.50:64120 -> 202.75.42.254:80
TCP TTL:64 TOS:0x0 ID:20097 IpLen:20 DgmLen:497 DF
***AP*** Seq: 0xB89146AD Ack: 0x979C40E9 Win: 0xFFFF TcpLen: 20

The rule I write is bypassed, and if we examine the packet content -

2006-05-04 18:11:50.573240 00:0f:3d:a0:c9:a9 > 00:0c:41:92:56:ee, IPv4, length 5
11: 192.168.0.50.60670 > 202.75.42.254.80: tcp 457
0x0000: 000c 4192 56ee 000f 3da0 c9a9 0800 4500 ..A.V...=.....E.
0x0010: 01f1 4e9a 4000 4006 3449 c0a8 0032 ca4b ..N.@.@.4I...2.K
0x0020: 2afe ecfe 0050 7a06 b8bb aca1 254e 5018 *....Pz.....%NP.
0x0030: ffff 8612 0000 4745 5420 2f62 6967 7369 ......GET./bigsi
0x0040: 732f 436d 642e 6578 6520 4854 5450 2f31 s/Cmd.exe.HTTP/1
0x0050: 2e31 0d0a 486f 7374 3a20 3230 322e 3735 .1..Host:.202.75
0x0060: 2e34 322e 3235 340d 0a55 7365 722d 4167 .42.254..User-Ag
0x0070: 656e 743a 204d 6f7a 696c 6c61 2f35 2e30 ent:.Mozilla/5.0
0x0080: 2028 5831 313b 2055 3b20 4672 6565 4253 .(X11;.U;.FreeBS

The Cmd.exe turns out to be "43 6d 64 2e 65 78 65". The default rule which matching with case insensitive seems to be better choice in this situation, the hex value is good when we want to detect those non-printable data such as : which is 3a in hex value. This has been mentionned in this tutorial by Vorant.

Your idea of using hex value in this situation is bad since it is easily bypassed and you may need to write multiple rules if you want to detect cmd.exe, CMD.EXE, cMD.exe and etc. That's not a right way. I suggest for anyone who want to learn to write snort rule, for me the best reference is still Snort Manual where you can download from www.snort.org.

By the way, the hex value here has nothing to do with C/C++, you remind me of one CEH Conductor who tells me that the hex value has something to do with assembly language and you have to learn assembly language to understand it.

Sputera, I hope that helps.

Cheers (:])

Latest Sguil with PADS

Thanks to Scottder and Bamm, I finally get Sguil with PADS working after some tries, it's a bit tricky at first but after some tinkering it is just work, my fault to bug Bamm and thanks for the reply. Here's the lovely screenshot and you may notice PADS in third pane of Sguil Analyst Console. One thing I found lacking would be the signatures of PADS, I will start to write some sigs and may contribute back since I'm using it. F34R the power of PADS .....

The pop-up menu shows the PADS table in the Sguil DB.

Peace :]

OpenBSD - Monitoring Network Interface

Sometime we need to monitor our network interface and having it's statistic shown in real time. If you are using OpenBSD, that's actually a nifty system tool to help you to monitor your network interface - systat, systat is used to monitor the system and showing it's statistic in real time. This nifty tool not only has capabilities such as monitor network interface but network stat(netstat) too, others such as disk usage and iostat can be monitored as well in real time. But here I just want to show how you can use it to monitor the network interface.

To monitor your network interface with 1 sec screen refresh rate, just run

shell>systat -w 1 ifstat 1

The first term shows the statistic of multiple network interface, the second one shows the bandwidth which I use the ifstat that installed from the OpenBSD package. Like I said, you can monitor netstat too, just run

shell>systat netstat

I think monitoring netstat in real time is sweet because most people might find it useful especially the Send-Q and Recv-Q that showing you the current network statistic of certain port/services.

If you want to switch to monitor your swap or iostat, you don't have to quit, for example if you want to switch to monitor swap, just run : with any other statistic you want to monitor. For example,

:swap

Other statisitcs that can be tracked are iostat, vmstat and etc. To refresh the screen manually, just type Control+L will do or if you want to suspend the monitoring, just run Control+Z.

Enough for now, I need to work on my Sguil stuffs again, ciao.

Cheers (:])