TaoSecurity Blog

Sometimes this blog is just a place for me to take notes on tasks I want to repeat in the future, like burning CDs. In this case I'm running Ubuntu and using the new portable Sony DRX-S50U Multi-Format DVD Burner I bought to accompany my Thinkpad x60s on the road. First I created an .iso of the files I wanted on the CD-R. richard@neely:/var/tmp$ mkisofs -J -R -o /data/shmoocon2007hack.iso shmoocon2007/ INFO: UTF-8 character encoding detected by locale settings. Assuming UTF-8 encoded filenames on source filesystem, use -input-charset to override. Using shmoo000.pca;1 for /shmoocon_hack_rd2_timeadj.pcap (shmoocon_hack_rd1_timeadj.pcap) 1.68% done, estimate finish Wed Apr 11 21:23:45 2007 ...truncated... Second I asked cdrecord to find the burner. richard@neely:/var/tmp$ sudo cdrecord -scanbus Cdrecord-Clone 2.01.01a03 (i686-pc-linux-gnu) Copyright (C) 1995-2005 Joerg Schilling NOTE: this version of cdrecord is an inofficial (modified) release of cdrecord ...

File this in the small yet helpful utility bin. You can use YouTube-dl to download videos from YouTube . I don't have Flash installed on FreeBSD, but I do have Mplayer. This means I can use YouTube-dl as follows: orr:/home/richard$ python youtube-dl usage: youtube-dl [options] video_url options: -h, --help print this help text and exit -v, --version print program version and exit -u USERNAME, --username=USERNAME account username -p PASSWORD, --password=PASSWORD account password -o FILE, --output=FILE output video file name -q, --quiet activates quiet mode -s, --simulate do not download video orr:/home/richard$ python youtube-dl http://www.youtube.com/watch?v=bPXF-iZh488 Retrieving video webpage... done. Extracting video URL parameters... done. Video data found at http://youtube-082.vo.llnwd.net/d1/01/F3/bPXF-iZh488.flv Retrieving video data... 6608k of 6608k...

Several months ago I posted how I used Colin Percival's freebsd-update program to perform a binary upgrade from FreeBSD 5.4 to 6.0 remotely over SSH. Thanks to Colin's latest work , I was able to successfully perform a binary upgrade from FreeBSD 6.0 to 6.1 remotely over SSH. hacom:/root/upgrade# uname -a FreeBSD hacom.taosecurity.com 6.0-SECURITY FreeBSD 6.0-SECURITY #0: Tue Apr 18 08:56:09 UTC 2006 root@builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC i386 hacom:/root# fetch http://www.daemonology.net/freebsd-upgrade-6.0-to-6.1/upgrade-6.0-to-6.1.tgz upgrade-6.0-to-6.1.tgz 0% of 4706 kB hacom:/root# sha256 upgrade-6.0-to-6.1.tgz SHA256 (upgrade-6.0-to-6.1.tgz) = 29075fc5711e0b20d879c69d12bbe5414c1c56d597c8116da7acc0d291116d2f hacom:/root# tar -xzvf upgrade-6.0-to-6.1.tgz x upgrade x upgrade/upgrade.sh x upgrade/6.1-index x upgrade/6.0-index hacom:/root# cd upgrade hacom:/root/upgrade# ./upgrade.sh^M^M Examining system... done. The followin...

I just posted about the new FreeBSD Java packages. I figured I would try them out and show how the process works. It's been a while since I last described installing Java, back when compiling from source was required. After downloading the binary for FreeBSD 6.0, I tried to install it. orr:/tmp# ls -al diablo-jdk-freebsd6-1.5.0.06.00.tbz -rw-r--r-- 1 richard wheel 54624741 Apr 13 07:30 diablo-jdk-freebsd6-1.5.0.06.00.tbz orr:/tmp# pkg_add -v diablo-jdk-freebsd6-1.5.0.06.00.tbz Requested space: 218498964 bytes, free space: 4397770752 bytes in /var/tmp/instmp.FMG03P Package 'diablo-jdk-1.5.0.06.00' depends on 'xorg-libraries-6.8.2' with 'x11/xorg-libraries' origin. - already installed. Package 'diablo-jdk-1.5.0.06.00' depends on 'javavmwrapper-2.0_5' with 'java/javavmwrapper' origin. pkg_add: could not find package javavmwrapper-2.0_5 ! pkg_add: 1 package addition(s) failed That didn't work. Let me add the package it req...

Today I received a CD from Convention CDs , the company that recorded my presentation at RSA 2006 last month. The company Web site is basically blank, but if you want to order a copy of my talk "Traffic-Centric Incident Response and Forensics" you can send email to sales at conventioncds dot com. My CD bears number CD 94-2006, which may be its product number. I get no compensation from these CDs. I needed a way to listen to the CD in FreeBSD, so I decided to go a low-impact approach and use xmcd . I could not find a precompiled package, but after adding the packages needed for building the port I found the port a quick build. I had to run the following configuration routine before I could listen to CDs. # /usr/X11R6/lib/X11/xmcd/config/config.sh Xmcd version 3.3.2 Configuration Program Setting up for host: orr.taosecurity.com ---------------------------------------- *** CDDB(R) ACCESS CONFIGURATION *** If your system has Internet connectivity and functional domain name ...

This is one of those tasks that I want to remember for the future, because I can imagine encountering the same problem again. When I build servers with FreeBSD, I usually do not include packages for X.org . I access my servers using OpenSSH so I don't need any graphics support. Recently I needed a platform to QEMU . It turns out that QEMU opens an X session. The system where I wanted to run QEMU was a remote server (janney), so I needed to add X support. I figured "If I can export an xterm, I can export QEMU." So, I added the xterm package. Here are Xterm's dependencies as reported by pkg_tree: janney:/home/richard$ pkg_tree xterm xterm-203 |\__ pkgconfig-0.17.2 |\__ freetype2-2.1.10_1 |\__ expat-1.95.8_3 |\__ fontconfig-2.2.3,1 |\__ xorg-libraries-6.8.2 \__ libXft-2.1.7 So, you can see that installing Xterm added the following X.org package: xorg-libraries-6.8.2 X11 libraries and headers from X.Org So, I ssh to janney, using the -X option to enable X forwardi...

Thanks to the generosity of a TaoSecurity Blog reader, I have been experimenting with a dual-stack IPv4 and IPv6 system at a university. I connect to the IPv4 address using OpenSSH. Once on the box, I can use IPv6. I've been looking for ways to connect my home network directly to IPv6. At the moment I'm using a common gateway/router to perform NAT for my cable network connection. I needed a way to provide IPv6 for systems behind the NAT. Enter Teredo and the Miredo project. Now, before you decide that I'm giving this protocol my "thumbs up," I'm going to explicitly tell you I just wanted to get the software working and use ping6. That's it for now. Teredo, which is now a draft RFC , is a Microsoft protocol. Basically you take IPv6 traffic, tunnel it in UDP, and send it to a relay server. The relay pulls off the UDP and sends the traffic using IPv6 to the destination. The process is reversed for return traffic. Obviously sending your traffic e...

Maybe you've heard of QEMU , an "open source processor emulator." It's not quite VMware, since there doesn't seem to be a concept of persistent state and there are definitely not snapshots. However, when I saw the variety of ready-to-run system images at OSZoo.org , I decided to try it on FreeBSD 6.0. Luckily there are several QEMU ports. I installed emulators/qemu from the latest FreeBSD 6.0 package. I next installed emulators/kqemu-kmod using the port. janney:/root# cd /usr/ports/emulators/kqemu-kmod janney:/usr/ports/emulators/kqemu-kmod# make => kqemu-0.7.2.tar.gz doesn't seem to exist in /usr/ports/distfiles/kqemu. => Attempting to fetch from http://fabrice.bellard.free.fr/qemu/. kqemu-0.7.2.tar.gz 100% of 77 kB 102 kBps ===> Extracting for kqemu-kmod-0.7.2_1 => MD5 Checksum OK for kqemu/kqemu-0.7.2.tar.gz. => SHA256 Checksum OK for kqemu/kqemu-0.7.2.tar.gz. ===> Patching for kqemu-kmod-0.7.2_1 ===...

Here are the steps I took to create a DVD using a Plextor 708UF DVD burner connected to my ancient laptop over Firewire through an Adaptec DuoConnect PC Card Adapter . First I installed sysutils/dvd+rw-tools as a package. Next I placed all of the files I wanted backed up into /mnt/.burn_to_dvd/ and proceeded to use growisofs. orr:/root# growisofs -dvd-compat -Z /dev/cd0 -J -R /mnt/.burn_to_dvd/ Executing 'mkisofs -J -R /mnt/.burn_to_dvd/ | builtin_dd of=/dev/pass1 obs=32k seek=0' :-( /dev/pass1: 2297888 blocks are free, 2637323 to be written :-( write failed: No space left on device Oops. I put too many files into the directory. They are larger than the DVD capacity of 4.3 GB. After removing a file, I proceed to burn the DVD. orr:/mnt# du -h .burn_to_dvd/ 4.2G .burn_to_dvd/ orr:/mnt# growisofs -dvd-compat -Z /dev/cd0 -J -R /mnt/.burn_to_dvd/ Executing 'mkisofs -J -R /mnt/.burn_to_dvd/ | builtin_dd of=/dev/pass1 obs=32k seek=0' /dev/pass1: "Current Write S...

Earlier this month I posted how I use rdiff-backup to keep a copy of files on a remote system, along with incremental changes. I also have an external USB/Firewire 2.5 inch hard drive that holds older files. I decided I wanted to copy all of the files from my laptop hard drive that were not present on the external hard drive. The local data is stored in /data and the external drive is located at /mnt. I keep identical directories on each partition. orr:/home/richard$ ls /data Recycled iso misc tmp writing code lpc test vmware zip documents media tgz work orr:/home/richard$ ls /mnt Recycled iso misc tmp writing code lpc test vmware zip documents media tgz work I decided to use Rsync to get the files not on /mnt from /data to /mnt. In the following example I ...

Today transzorp in the #snort-gui channel convinced me to try Stow ( sysutils/stow ), described as "a program for managing the installation of software packages, keeping them separate (/usr/local/stow/emacs vs. /usr/local/stow/perl, for example) while making them appear to be installed in the same place (/usr/local)." First I installed the Stow package and made a directory. # setenv PACKAGESITE ftp://ftp2.freebsd.org/pub/FreeBSD/ports/i386/packages-5-stable/Latest/ orr:/root# pkg_add -vr stow # mkdir /usr/local/stow Here is running Stow with no switches. $ stow stow: No packages named stow (GNU Stow) version 1.3.3 Usage: stow [OPTION ...] PACKAGE ... -n, --no Do not actually make changes -c, --conflicts Scan for conflicts, implies -n -d DIR, --dir=DIR Set stow dir to DIR (default is current dir) -t DIR, --target=DIR Set target to DIR (default is parent of stow dir) -v, --verbose[=N] Increase verboseness (levels are 0,1,2,3; ...

I've previously posted about running Debian on my October 1994-era 90 MHz Pentium Quantex QP5/90 PM-3 with 80 MB RAM. I hadn't booted the box since June 2004. Today while reading a book on Debian I decided to try upgrading to Debian stable , also known as sarge or 3.1 at the moment. When I started the process, this was my uname output: Linux oates 2.4.18-1-386 #1 Wed Apr 14 17:34:59 UTC 2004 i586 GNU/Linux This is all I had to do: cat /etc/apt/sources.list deb http://ftp.us.debian.org/debian sarge main non-free contrib deb http://non-us.debian.org/debian-non-US sarge/non-US main contrib non-free # apt-get update # apt-get --show-upgraded upgrade Building Dependency Tree... Done The following packages have been kept back: honeyd libldap2 libopencdk8 lilo mutt The following packages will be upgraded: adduser apt apt-utils aptitude ash base-config base-files base-passwd bash ...edited... util-linux wget whiptail zlib1g 125 upgraded, 0 newly installed, 0 to remove and 5...

I admit I am not vigilant enough when it comes to backing up personal files. For the new year I decided to at least keep a copy of important directories on a backup server, and keep those copies fairly fresh. rsync initially seemed attractive, thanks to its ability to transfer only incremental changes to files. Upon further reflection it didn't meet my needs. For example, if I delete a file from a directory and then rsync it, the file will be deleted from the backup server. Today I learned of rdiff-backup , in the ports tree as sysutils/rdiff-backup . This program makes incremental backups of files, but it also supports restoring old versions of files and even deleted files. In the following example, I want to back up selected directories in my /data partition on laptop orr. Here are the contents of /data: orr:/data$ ls Recycled iso misc vmware zip code lpc tgz work documents media tmp ...

I am setting up a VM for students in my USENIX LISA classes next week. While I would prefer students to use tools on their own laptops to analyze packet traces I provide, I realize some may not be able to get all of the requisite software working. Rather than leave them stranded, I am deploying a FreeBSD 6.0 VM that will run on my laptop. Students can SSH to the VM and analyze traces there. Alternatively, I plan to create a simple VM that students can run in VMware Player . I decided I would create 33 student accounts, named student0 - student32. I would perform demos as student0. I was not about to run adduser 33 times to create the necessary accounts, so the following shows how I added those accounts using a simple shell script. First I created a default configuration file using the -C switch. samsonov:/root# adduser -C Login group []: Enter additional groups []: Login class [default]: Shell (sh csh tcsh bash nologin) [sh]: bash Home directory [/home/]: Use password-based aut...

Today the subject of deleting hard drives was raised in the #snort-gui IRC channel. jrk and geek00L mentioned using Darik's Boot and Nuke (DBAN), an open source (GPL) "self-contained boot floppy that securely wipes the hard disks of most computers." I found DBAN very easy to use. It boasts some impressive features too. When you boot from the floppy image or CD-ROM .iso you see this screen. The About screen offers warnings and caveats. I like the ability to boot using one of the available deletion methods. I simply hit [enter], which started DBAN in interactive mode. Here you can set parameters for wiping the drive. In the future I plan to carry a DBAN floppy with me to wipe hard drives prior to installing my own NSM software.

This morning I worked with several remote administration tools on my Windows Server 2003 system. First I enabled the native Remote Desktop (aka Terminal Services) capability via My Computer -> Properties -> Remote At this point I am only letting administrator connect remotely. Since administrator can connect remotely by default once the service is activated, I didn't need to make any other changes. Once Remote Desktop is listening, it will appear active on port 3389 TCP. To access the Windows server remotely from Unix using the RDP protocol, I use Rdesktop . It's available in the FreeBSD ports tree as net/rdesktop . I like the option to change screen geometry, e.g., 'rdesktop -g 80% 192.168.2.2'. To access the RDP server from my Windows 2000 laptop, I installed the MSRDPCLI.EXE package. Next I tried RealVNC . This program has client and server components. I installed the entire package on the Windows server. Setup is fairly simple, and the server sh...