Github

Hello,

I stumbled on github tagging recently. It is a feature I was not aware of.

For example if I am very interested in RAT (remote access trojans) I can find these projects with https://github.com/search?q=topic%3Atrojan&type=Repositories and https://github.com/search?q=topic%3Arat&type=Repositories.

The syntax of the repo list is thus:
https://github.com/search?q=topic%3&type=Repositories

This a list of interesting keywords I've been looking at:

• trojan
• rat
• keylogger
• spyware
• malware-research
• malware-development
• steganography
• pentesting
• blacklist
• code-injection
• virus
• persistence
• meterpreter
• reverse-shell
• malware
• threat
• bypass-av
• powershell
• sniffer
• scanner
• xss
• sql-injection
• sqli
• denial-of-service
• phishing
• man-in-the-middle
• exploit
• fuzzer
• poc
• attacker

One should of course not jump to conclusions and understand that a knife can be used for killing but I used one this morning to cut my bread.

Powershell try catch, quick demo

This post is for the person to whom I explained try catch today ;)

When you do things in powershell you will need try-catch blocks to handle your errors.

Try, catch and finally
The try block contains the things you want to do. The catch block handles the error types, the generic catch is a catch all (usually not the right solution) and finally is what to do when you are finished.

$error
The $error variable is the variable that will be your friend. When you run a script the $error.count() should be 0. When you are running in an IDE this can be different so as a matter of safety to avoid headache you might want to put as first lines of your script:

# clearing output and $error
clear-host
$error.clear()
 
Making errors
To demo the try catch I did a division by zero, as we all know this will give error and is thus an excellent candidate to learn try-catch.

$a = 1
$b = 0
$a / $b

Getting the errors from $error
Now that we have an error we can ask $error what type of error we created.

$error[0].Exception.GetType().Fullname

This returned [System.Management.Automation.RuntimeException]

When you are developing, check $error.count() to see if you handled all errors and did not forget one. During development, you can put as last line

write-host $error

To check if you handled everything.

Handling the error
Now that we know the error type we can handle it:

try {
    $a = 1
    $b = 0
    $a / $b
}
catch [System.Management.Automation.RuntimeException]{
   write-host "You caught your an error"
   break
}
finally{
   write-host "This is the finally block"
   $error.clear()
}

The break statement instructs the catch block to go to the finally block and the $error.clear() in the finally block is cleaning up after yourself.

makepasswd generating passwords on linux

I was writing a script the other day and had to generate a password and found the nifty tool call makepasswd.

makepasswd is a command that generate true random passwords using /dev/random.

To install you do
sudo apt-get install makepasswd

To generate a password you do

makepasswd

and if you want a 16 character password you do

makepasswd --chars 16

FIR (fast incident response) in docker

FIR (Fast Incident Response) is a project by CERT Société Générale. It is a nice system to do incident tracking and I use it on a regular basis for over a year now. After a year of daily use, I gathered the users and a series of issues and wanted features where expressed.

To make things go forward in an easy way I decided it was time to dockerize the installation so the end users can give quick feedback on features under development.

Although there is a Dockerfile in the repo, I decided to make my own based on the existing one:

# Dockerfile to build FIR container
# Original Dockerfile by Kyle Maxwell https://github.com/certsocietegenerale/FIR/blob/master/docker/Dockerfile
#
# to build: docker build -t fir .
# to run: docker run -d p 8000:8000 fir
# webinterface: http://x.x.x.x.:8000
#
# default administrator: admin
# default password:  admin

# Based on ubuntu:latest
FROM ubuntu:16.04
MAINTAINER Erik Vanderhasselt

# Set environment variables
ENV DEBIAN_FRONTEND noninteractive

# Upgrade Ubuntu
RUN \
  apt-get update && \
  apt-get dist-upgrade -y && \
  apt-get autoremove -y && \
  apt-get clean

# Set the timezone
# https://bugs.launchpad.net/ubuntu/+source/tzdata/+bug/1554806
RUN ln -fs /usr/share/zoneinfo/Europe/Brussels /etc/localtime
RUN dpkg-reconfigure -f noninteractive tzdata

# Install dependencies
RUN apt-get install -y python-dev
RUN apt-get install -y python-pip
RUN apt-get install -y python-lxml
RUN apt-get install -y git
RUN apt-get install -y libxml2-dev
RUN apt-get install -y libxslt1-dev
RUN apt-get install -y libz-dev

# Install the latest version of pip
RUN pip install --upgrade pip

# create the user and group
RUN groupadd -r fir
RUN useradd -r -g fir -d /home/fir -s /usr/sbin/nologin -c "FIR user" fir

# Download FIR from Github
WORKDIR /home
RUN mkdir /home/fir
RUN cd /home/fir
RUN git clone https://github.com/certsocietegenerale/FIR.git
RUN mv FIR fir
RUN chown -R fir:fir /home/fir

# install the requirements
WORKDIR /home/fir/FIR
# remove psycopg2==2.6.2 from requirements.txt since we are not using PostgreSQL
RUN sed '/^psycopg2/d' /home/fir/FIR/requirements.txt > /home/fir/FIR/req1.txt
# run pip
RUN pip install -r /home/fir/FIR/req1.txt

# prepare to run
USER fir
ENV HOME /home/fir
ENV USER fir
WORKDIR /home/fir/FIR
RUN ./manage.py migrate
RUN ./manage.py loaddata incidents/fixtures/seed_data.json
RUN ./manage.py loaddata incidents/fixtures/dev_users.json

###############################################################################

# make it run
EXPOSE 8000
ENTRYPOINT ["/home/fir/FIR/manage.py"]
CMD ["runserver", "0.0.0.0:8000"]



To build the container you do sudo docker build -t fir .
To run the container you do sudo docker run -d p 8000:8000 fir
To access fir you point your browser to http://localhost:8000, the default login is admin and the default password is admin too.

Now you have a nice system to record your incidents which is a good start but you need incident response procedures. If you got no idea what I am talking about I recommend you read up on the documents written by ENISA, NIST, CERT.org, etc.

Adding disks to an LVM

One of my virtual machines ran out of disk space the other day because I wasn't sure of disk sizing when I initially started playing with it. The solution was simple the LVM had to be extended. This is how you do it:

1. sudo apt-get install system-config-lvm
2. sudo pvcreate /dev/your_disk
3. sudo vgextend VG_Name /dev/your_disk
4. sudo lvextend -1 +100%FREE LV_PATH 
5. sudo resize2fs LV_PATH
6. sudo init 6

That is it, simple right?

To determine the disk(s) you want to add you do ls /dev/sd* it will return your disks, you will probably want to add the disks with no numbers at the end.

To figure out your volume group (VG_NAME) you do sudo vgdisplay and to figure out the logical volume path (LV_PATH) you do sudo lvdisplay.

Virtualbox guest additions on ubuntu

When I want to try something out I often use a virtualbox to play in. My guest operating system is often an Ubuntu. One of the things you want to do is share a folder with the guest operating system and thus you need to install the virtualbox guest additions.

Where in the past I use to work with the additions CD-rom, I now use the package that Ubuntu offers called virtualbox-guest-additions-iso. It is important to be aware about the fact that Ubuntu has split things up a bit and thus you have other packages to install too if you need some functionalities like vitualbox-guest-dkms, virtualbox-guest-x11 and virtualbox-guest-utils.

These virtualbox-guest packages are DKMS aware, which means that they can update without changing the whole kernel.

A common operation is to share a directory with the virtual machine. You do this by setting up a directory and permanently mounting it. It will be mounted in /media.

Can you hack my mac?

A couple of weeks back this was the question I got by text message. It was from a friend who had some issues and asked one of his other friends to have a look at it and since then he was totally locked out.

This is the procedure I used to access his Mac.

Removing the setup file.
I booted the system with the command (that weird Apple key for Windows users) + S. This boots the system into single user mode and gives back a terminal.

Next I did a file system check with fsck -fy. The file system was ok.
The following step was to mount the root drive as writable:
mount -uw /

Finally I renamed the .AppleSetupDone
mv /var/db/.AppleSetupDone /var/db/.AppleSetupDone.old

Creating a new Admin.
After the reboot the "Welcome wizard" screen came on, I made a new account, which automatically made me an Admin account.

Reset of the old Admin's password.
The only thing left to do was reset the old admin password. This is done via the system preferences, accounts. You have to unlock the little lock icon at the bottom, and reset the original Admin account.

I logged out of the new admin and logged my friend in to his familiar session.