Compiling/Installing Ettercap from Source Ubuntu 9.10

Ok, so my mission has thus been to compile all the tools I use from source. This is to guarantee that I have the most recent version, and for the experience. Now you can use the repositories to install most of these tools, but often times the versions are outdated. It wasn't until recently here that nmap was upgraded from 4.76 to 5.00. But this is just my personal task for all the tools I end up needing to use. So to start, download ettercap from ettercap.sourceforge.net. Download the latest tarball, in my case 0.7.3.

CD to the download location and issue the following command:

tar xzf ettercap-NG-0.7.3.tar.gz
cd ettercap-NG-0.7.3

Now we have to install some dependencies...and this I will use apt-get for. Kind of a work around, but one that I'm fine with at the moment.

sudo apt-get install libpcap0.8-dev libpcap-dev libnet1 libnet1-dev

Make sure you have libssl and the development libraries installed as well (libssl0.9.8 and libssl-dev).
Now you will want to make one change to a source file to avoid make errors.

nano src/ec_log.c

Change the following line from

fd->fd = open(filename, 0_CREAT | 0_TRUNC | 0_RDWR | 0_BINARY);
to
fd->fd = open(filename, 0_CREAT | 0_TRUNC | 0_RDWR | 0_BINARY, 0666);

Now issue the following commands, hopefully without error:

./configure
make
sudo make install

If all goes well, ettercap should be installed and you can access the GUI by issuing:

sudo ettercap -G

Hope this works for everyone, leave comments if you run into problems.Technorati Tags: ettercap

Setting Up and Configuring Ubuntu Server 9.04 VMWARE with SSH, VSFTPD (TSL/SSL), OpenVPN, Fail2ban (PART 2)

Continuing from Part 1...

With installing and configuring VSFTPD...here is what we want to accomplish:

   1. Setup a FTP server that only allows secure (TSL/SSL) connections so passwords and data aren't sent in the clear.
   2. Have virtual users who are linked to a local user account with no shell privledges.
   3. Be able to access it from outside of our private network.

Lets start by creating a user with no shell privledges:

nano /etc/shells
(Add the following entry at the bottom: /usr/sbin/nologin)
mkdir /home/luigi
groupadd ftpaccess
useradd -d /home/luigi -G ftpaccess -s /usr/sbin/nologin luigi
chown luigi /home/luigi
chgrp ftpaccess /home/luigi

Then we will install VSFTPD:

apt-get install vsftpd libdb4.7 db4.7-util
cd /etc
mkdir vsftpd
mv vsftpd.conf vsftpd.bak
nano vsftpd.conf
(Make your vsftpd.conf look like the following) *UPDATE: the config file cannot have spaces between the entries and the values (i.e. 'listen = yes' is bad, it should be 'listen=yes').

listen=YES
listen_port=21
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=NO
xferlog_file=/var/log/vsftpd.log
ftpd_banner=ITSA ME...MARIO
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=ftp
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
pasv_min_port=13000
pasv_max_port=12300
hide_ids=YES
guest_enable=YES
guest_username=luigi
user_config_dir=/etc/vsftpd

nano users.txt (with alternating lines of username and passwords; exclude the markings when making the file)

bill #username
verysecure #password
sue
filetransfer
bob
protocol

db4.7_load -T -t hash -f users.txt /etc/vsftpd_users.db
nano /etc/pam.d/ftpservice

auth required /lib/sercurity/pam_userdb.so db=/etc/vsftpd_users
account required /lib/security/pam_userdb.so db=/etc/vsftpd_users

Now we must specify a user config file for each virtual user.

nano /etc/vsftp_userconfig

Now add the following:

write_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
anon_upload_enable=YES
local_root=/home/luigi
chroot_local_user=YES
dirlist_enable=YES
download_enable=YES
guest_username=luigi

Save and exit. Now lets make a link to this file for each user:

ln -s /etc/vsftp_userconfig /etc/vsftpd/bill
ln -s /etc/vsftp_userconfig /etc/vsftpd/sue
ln -s /etc/vsftp_userconfig /etc/vsftpd/bob

Now open up your router and set it to forward the port range specified in pasv_min_port and pasv_max_port...in this case port forward 12300-12400. Then use IPTABLES to set an outbound exception with the following commands:

iptables -A OUTPUT -p tcp --dport 12300:12400 -j ACCEPT
iptables -L (to verify the exception was added)

Then finally restart the vsftpd service:

/etc/init.d/vsftpd restart

Now for fail2ban...the configs are pretty self-explanitory, but read up on it if you have questions:

apt-get install fail2ban
cd /etc/fail2ban
mv jail.conf jail.bak
nano jail.conf

[DEFAULT]
ignoreip = 127.0.0.1
bantime  = 600
maxretry = 3
backend = polling
destemail = root@localhost
action = iptables[name=%(__name__)s, port=%(port)s]

[ssh]

enabled = true
port    = 12345
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 3

[vsftp]

enabled = tue
port = 21
filter = vsftpd
logpath = /var/log/vsftpd.log
maxretry = 3

/etc/init.d/fail2ban restart

Try to SSH into your machine from another virtual or another computer and enter the wrong credentials...check /var/log/fail2ban.log to see if it worked. You can also look at the IPTABLES again.

Please give me feedback on if this worked for you or any problems you encounter by dropping a comment.

Part 3 with OpenVPN coming soon...

Setting Up and Configuring Ubuntu Server 9.04 VMWare with SSH, VSFTPD (TSL/SSL), OpenVPN, Fail2ban (PART 1)

Finally, after much tinkering and reading many guides...

My goal was to make a server with these components installed so I could practice breaking into it. Like any logical "practice" server, I made it a VM. Here's a guide on how to set up one of your own...

Things assumed and required:

1. You have VMWare Server Installed
2. You have Ubuntu Server 9.04 installed in a VM with no services preinstalled (i.e. LAMP)
   
3. You have mounted the VMWare tools installer
4. I am using the username mario for my default username and have set the server IP to 192.168.3.100
5. You have a free domain name setup and registered with DynDNS.org.
   

Let's get started:

The first thing to do is to login, via VMWare console, and change some fundamental settings. What we are going to do is change the root password, update the server with any patches available, and install some needed dependencies:

sudo su
passwd root
apt-get update
apt-get upgrade
uname -r
apt-get install g++ gcc gawk make unzip zip linux-headers-'uname -r' build-essential

Now to install VMWare tools...its not necessary, but might be helpful in some instances:

mkdir /mnt/cdrom
mount /dev/cdrom /mnt/cdrom
cp /mnt/cdrom/VMWare*.tar.gz /home/mario
tar xzf VMWare*.tar.gz
cd vmware*
vmware-install.pl
(Use all the defaults and when finished)
reboot

Once the system has rebooted, log back in and set a static IP on the interface eth0 and remove apparmor:

su
nano /etc/network/interfaces
(Modify your config to look like this)

inet eth0 iface static
      address 192.68.3.100
      netmask 255.255.255.0
      network 192.168.3.0
      broadcast 192.168.3.255
      gateway 192.168.3.1

/etc/init.d/networking restart
echo techaccesstips.servehome.net > /etc/hostname

/etc/init.d/hostname.sh start
nano /etc/hosts (Make the top portion look like the following)

127.0.0.1            localhost.localdomain                  localhost
192.168.3.100     techaccesstips.servehome.net     servername

/etc/init.d/apparmor stop
update-rc.d -f apparmor remove
apt-get purge apparmor apparmor-utils

Now install the SSH server and configure it:

apt-get install ssh openssh-server
nano /etc/ssh/sshd_config
(Change "PermitRootLogin" to "no" and change the port number if you wish)
/etc/init.d/ssh restart

Ok, now SSH into your server to test it out with the following command:

ssh -l mario -p 12345 192.168.3.100
(Leave the -p switch out if you didn't change the port number)

Continue with Part 2...

Cracking Cached Passwords with Cachedump and John the Ripper (JTR)

So if you are looking to audit password strength in a Windows Domain environment, there are two tools that will be of help to you. FGDump is a compilation of PWDump and Cachedump. It also has a some useful switches, but documentation for those can be found here. PWdump will pull hashes for local accounts such as Administrator. Cachedump however will pull the cached hashes from network users who have logged into the machine.

Here is how to grab the hashes.

Download FGDump from here and place the executable on a flashdrive (if you have a U3 device, I will soon be posting how to run fgdump without any user interaction).
Plug the flashdrive into the target computer and open up a command prompt.
Navigate to your flashdrive and execute fgdump.exe.
Wait for it to finish and once it is successful, open up the 127.0.0.1.cachedump file in notepad to see the hashes.
Copy the hashes to a file and save in this format: filename.txt.
Next download John:

wget http://openwall.com/john/f/john-1.7.2.tar.gz
tar xzf john-1.7.2.tar.gz

Now we are going to have to patch it to let it recognize the cachedump format:

wget http://openwall.com/john/contrib/john-1.7.2-mscash-alainesp-4.1.diff.gz
cd john-1.7.2
zcat ../john-1.7.2-mscash-alainesp-4.1.diff.gz | patch -p1 -Z

If you do not have the zcat command, then patch it with gzip:

gzip -dc ../john-VERSION-WHAT-REVISION.diff.gz | patch -p1
cd src
make
make clean SYSTEM (which ever system type you have as displayed with make)

Once successful:

cd run
./john --test

Now lets crack the cached file

./john -format:mscash hashes.txt

or

./john -w:passwordlist.txt -format:mscash hashes.txt

Give me some feedback if this helped you.

SSH into Linux Web Server and find what version of Apache it is running...

So I was sitting at my desk and was approached with a favor. They needed to know what type of web service was running on a specific server. All that was given to me was the name of the server. Ok, so first we need the IP of the server:

Ping servernames

That should give an output similar to this

• PING servername (10.100.1.15) 56(84) bytes of data.

Now secure shell into the server by typing

ssh -l username ipaddress

Enter your password then once you have successfully connected, type uname -a to see the system details. This includes Kernel version, time stamp, computer name/hostname, and some other goodies.
Now to find the type of web service running, type:

httpd -v

This will give you the version of Apache that is running.

To find out what flavor of Linux the server is running, search /etc for a file that should have the distro-release. If that is all too tedious, then type rpm -qa. This will display all the packages installed, and you should see either some redhat, fedora, debian, or whatever version. That is usually a good indicator of which flavor is installed.

Installing BT3 in VMware *UPDATED*

There are a couple of ways to run BT3 in VMware, but when it comes to down to speed and function ability, you should really just install it. *NOTE: Now you can just download a preconfigured VM with an early version of VMWare tools installed. Just download it and when first booting up the VM, select the option "I copied it". Here is a link for the download. The installation process is rather easy. Just make a new virtual machine, select all your settings, and then just format your virtual HDD to ext2 and install.

Here are the steps:

• Create a new virtual machine.
• File > New > Virtual Machine
• Click Next > Typical > Linux (select "Other Linux 2.6 x kernel")
• Name it what you want and select the storage location of the VM
• Choose "Use bridged networking" if you want the VM to look like an actual device on your LAN
• Then select the size of your virtual HDD, and uncheck "allocate disk space now"
• Click finish
• Add a USB device to your VM
• This is real simple to do, and very useful to have done. Select your VM and select "Edit this virtual machine".
• Under the Hardware tab select "Add".
• Then select USB controller.
• Boot into the VM with the BT3 CD in the cd drive.
• Select Boot into KDE (default selection)
• Then once BT has booted, open Konsole
• Prepare the disk for formatting
  
• Type fdisk -l
• See your HD, it should be /dev/sda
• Assuming it is /dev/sda, enter fdisk /dev/sda
• Enter n to create a new partition
• Then p to make it the primary partition
• Then 1 to assign it as the first partition
• Then press enter to accept the default first cylinder
• Then enter again to accept the default last cylinder
• Finally enter w to write the changes
• Now format the disk in ext2 format
• mke2fs /dev/sda1
• Once the disk is properly formatted, make a mount directory for the hard drive.
• mkdir /mnt/sda1
• mount /dev/sda1 /mnt/sda1
• mount
• Now you should see that device sda1 is mounted at /mnt/sda1 and is formatted in ext2
• Install Backtrack
• K > Backtrack > Backtrack Installer
• Keep all defaults except change "Installation method" to "Real" and uncheck "Restore Original MBR After LILO".
• Click install
• After the installation is finished, reboot the VM without the CD inserted.

After the installation of Backtrack, it might be a good idea to install VMware tools. I am currently writing and figuring out the steps to do so. It will hopefully be up in a few days.