New OpenDiagnostics Live CD Release :: 394 MB

Removed wine, stupid idea to put on there.


Added mc, lftp, mdadm, a few others I can't remember off the top of my head.
Updated ClamAV to 0.97 and virus defs are good as of today.
Updated metasploit to latest SVN head
Updated kernel to latest and lucid is fully updated.

Download Here

I have been doing a lot of research into AutoIt scripting lately, as it would help tremendously at the repair shop. I have written up a few scripts to automate a few common chores such as msconfig'ing, fixing up performance options, and am in the process of writing a driver backup and general backup script. I hope to include these with some sort of easy way to use them on the root of the CD. The scripts will be compiled to executables, but the scripts will of course be made available, possibly in a google code repo. If you have any suggestions on what type of scripts you would like, or concerns about this possible change, feel free to express them in the comments

New appliances for network auto-assessment script available

I have uploaded the beta od-autoassess 10.10 virtual appliances (VirtualBox) and have made them available through torrents (preferred) as well. I am getting close to capping my monthly bandwidth (450gb a month, dang!), so please use one of the torrents if possible. Please test them and report any issues by contacting me (or let me know how awesome it is!).

These appliances are fully configured to run all aspects of the autoassessment script. These are beta releases, though I don't think much will change between these betas and any official release. Credentials are rooty/ytoor and you can `sudo su` from there to get root and run a scan (a proper scan should be in the bash history on each appliance, getting root and running through the history should bring it up). But if you are lazy, here is a full scan command:

sh /opt/od-autoassess/od-autoassess.sh --client="FooBarWidgets" --range=192.168.1.0/24 --start-openvassd \
--openvas-user="rooty" --openvas-pass="ytoor" \
--metasploit-sql-driver="mysql" --metasploit-sql-conn="root:toor@127.0.0.1/metasploit" \
--enable-wapiti --enable-w3af

Also, if you like the appliances, the script, or any of my other projects, maybe a donation is in order! I am working part time at Joe's Crab Shack to pay my server and tuition costs while attending school, and any help will be much appreciated!

Personal scripts for maintaining OpenDiagnostics Live CD

I am posting my scripts for maintaining my OpenDiagnostics Live CD so others can use them and add on to them as they see fit. Quite a while ago, I posted a fairly long shell script that I used to keep the ClamAV Live CD up-to-date with virus definitions, but the OpenDiagnostics Live CD is more comprehensive and a single script didn't make sense in my mind. If someone wants to modify them to locally update and modify a custom distro, feel free to take the scripts and edit them as you wish. If you come up with anything particularly neat, feel free to send me the code!

It is relatively easy to setup the project folder. The 'chroot' folder is just the filesystem.squashfs unsquashed. You can mount the ISO (

mount -o loop image.iso tmp/

) to create the image folder (just copy the contents of tmp/ to image/).

And without further ado, here are the scripts I use, in order from first-used to last-used:

chroot.sh

#!/bin/bash

sudo cp /etc/hosts chroot/etc/hosts
sudo cp /etc/resolv.conf chroot/etc/resolv.conf
#sudo cp /etc/apt/sources.list chroot/etc/apt/sources.list

sudo chroot chroot mount -t proc none /proc
sudo chroot chroot mount -t sysfs none /sys
sudo chroot chroot mount -t devpts none /dev/pts
sudo chroot chroot export HOME=/root
sudo chroot chroot export LC_ALL=C

sudo chroot chroot

After chrooting, you can do what you wish with the chroot, install any apps you wants, modify or uninstall apps, etc...

clean.sh -- clean up the chroot before remastering. This is run after modifying the chroot.

#!/bin/bash

sudo chroot chroot apt-get clean

sudo chroot chroot rm -rf /tmp/*

sudo chroot chroot rm /etc/resolv.conf

sudo chroot chroot umount -lf /proc
sudo chroot chroot umount -lf /sys
sudo chroot chroot umount -lf /dev/pts

remaster.sh -- Create a beta iso that you can test to make sure all your changes made were successful.

#!/bin/bash


sudo chroot chroot dpkg-query -W --showformat='${Package} ${Version}\n' | tee image/casper/filesystem.manifest

sudo cp -v image/casper/filesystem.manifest image/casper/filesystem.manifest-desktop
REMOVE='ubiquity casper live-initramfs user-setup discover1 xresprobe os-prober libdebian-installer4'

for i in $REMOVE 
do
        sudo sed -i "/${i}/d" image/casper/filesystem.manifest-desktop
done

sudo rm image/casper/filesystem.squashfs
sudo mksquashfs chroot image/casper/filesystem.squashfs -e boot 

sudo rm image/casper/filesystem.size
sudo printf $(sudo du -sx --block-size=1 chroot | cut -f1) > image/casper/filesystem.size

(cd image && find . -type f -print0 | xargs -0 md5sum | grep -v "\./md5sum.txt" > md5sum.txt)


cd image

sudo rm ../OpenDiagnostics_beta.iso
sudo mkisofs -r -V "OpenDiagnostics Live CD" -cache-inodes -J -l -b isolinux/isolinux.bin -c isolinux/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table -o ../OpenDiagnostics_beta.iso .

cd ..

beta_to_stable.sh -- Finally, move your changes to stable and zip up the ISO for uploading.

#!/bin/bash

rm OpenDiagnostics_stable.iso OpenDiagnostics_stable.iso.zip
mv OpenDiagnostics_beta.iso OpenDiagnostics_stable.iso
zip OpenDiagnostics_stable.iso.zip OpenDiagnostics_stable.iso

It would be pretty easy to setup a cron to automagically update your chroot and remaster the ISO every week, month, whatever. Hope this helps.

New OpenDiagnostics Live CD Release

Updated ClamAV, Metasploit, od-autoassess script, and did an apt-get upgrade.

Installed netrw, really neat/easy utility for transferring files between computers without dealing with S/FTP. Similar to netcat.

Updated List Of Notable Apps.

Also removed all the fluxbox styles but the default Debian style. Current ISO size is 421 MB.

You can get the latest ISO here. Torrent will be available when I get around to making one (sometime today as well). This may hit the planets before being fully uploaded to my server, so if no release is there, just wait a bit.

Finding sensitive information from a drive or folder

A quick script for finding email addresses on a massive scale (for instance, on a drive).

#!/bin/env sh

SEARCHPATH="$1"

find "$SEARCHPATH" -type f -print | while IFS=$"\n" read file
do
        echo "\nSearching through $file..."

        MATCHES=`strings "$file" | egrep '([[:alnum:]_.-]{1,64}+@[[:alnum:]_.-]{2,255}+?\.[[:alpha:].]{2,4})'`

        if [ "$MATCHES" != "" ]
        then
                echo "---------------------------\nFound matches, beware false positives:"
                echo "$MATCHES"
        fi
done

unset IFS

False positives are pretty much guaranteed (as long as binary files are on the file system). Most sensitive data follows patterns, so the regex is interchangeable with SSN's or anything else you need to find.

Some example output from running the script on /usr/src/...

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/sched.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2005, Keir Fraser <keir@xensource.com>

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/version.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2005, Nguyen Anh Quynh <aquynh@gmail.com>
 * Copyright (c) 2005, Keir Fraser <keir@xensource.com>

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/physdev.h...

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/event_channel.h...

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/vcpu.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2005, Keir Fraser <keir@xensource.com>

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/memory.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2005, Keir Fraser <keir@xensource.com>

Searching through /usr/src/linux-headers-2.6.35-22/include/xen/interface/elfnote.h...

Searching through /usr/src/linux-headers-2.6.35-22/include/crypto/skcipher.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>

Searching through /usr/src/linux-headers-2.6.35-22/include/crypto/ctr.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>

Searching through /usr/src/linux-headers-2.6.35-22/include/crypto/compress.h...

Searching through /usr/src/linux-headers-2.6.35-22/include/crypto/algapi.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2006 Herbert <herbert@gondor.apana.org.au>

Searching through /usr/src/linux-headers-2.6.35-22/include/crypto/hash.h...
---------------------------
Found matches, beware false positives:
 * Copyright (c) 2008 Herbert Xu <herbert@gondor.apana.org.au>

Updated OpenDiagnostics Live CD

Took the beta release and added sslscan, arp-scan, and onesixtyone. Also updated metasploit to the latest development build (3.4.2 iirc), updated clamav, and did an upgrade through apt (no dist-upgrade). Moved it up to stable.

You can get it here.

Maverick (nmap 5.21) supported

If you get latest on the od-autoassess script, you will have support for nmap 5.21 on maverick, so you can use the script.

If you are running an older version (< 5.21), it will let you know you are running an older version of nmap, but it is just informational, it should not affect the script at all.

nmap -sP output changes from 5.00 to 5.21

Currently the od-autoassess script will not run on maverick because the nmap outputs it's findings differently on 5.21 (on lucid, nmap is at 5.00).

I will work on this so that I can release another appliance (when maverick is released) fully configured for all the tasty features added since the last appliance

x86/x86_64 winexe binaries available

I have uploaded the x86 winexe binary, so now both the x86_64 and x86 binaries are available for download. I will look into making debs for them, but for now, binaries are just copied from the whole samba4 bin folder.


I also added the hydra debs because the will be optional later (kinda is now).

The neat command I learned today

On Windows XP and up, you get a neat utility called msinfo32 that you can run to get system and software information. Going to look into getting this working with winexe and the autoassess script.

The command I have found best is `start msinfo32 /report info.txt /categories +systemsummary`.

In lesser news, I added a binary for x86_64 winexe to the downloads page in google code. Probably tomorrow I will build a x86 chroot and build an x86 winexe binary and upload it as well.

I have also been working on the new gui for the autoassess script, it is my first real application written in python (pyqt), so feel free to (constructively) criticize. No events are wired up yet outside of some test events.

Added MBSA support (and other experimental things) to autoassess script

Please use --enable-mbsa, --mbsa-user, --mbsa-pass, and --mbsa-remote-path to perform a remote MBSA scan of a host on your network. It's pretty quick, a few seconds hang time per host run on. The report is saved in the mbsa folder of the scan archive.

A neat thing I added the other day, when public shares are found on a computer, the script will try to get a file list for each file in the share. It's super quick, so I left it alone and it runs on every scan. If something comes up, I can make this an optional thing.

I have also added _some_ experimental hydra support to the script for protocols such as ftp, ssh, and pop3. Please look at the code to see how to enable it, I won't take any bugs reports or complaints on speed when having these enabled.

Another small thing I added was the ability to email the scan archive to email@address.tld when the scan was finished using a local smtp server such as sendmail. (see --send-to)

I removed the --zenity option, I will be writing a GUI that is better suited to the options I have been adding.

Not sure if I have mentioned this previously, but a --print option has been added to automagically print pdf reports to the default printer. This can be a bad thing as a lot of paper can be used.

Optionally, you may define all of your variables in the .od-autoassessrc file in the user's home dir who is running.

Finally, for an example, if you wanted to run a single-host profile (no vulnerability scans) with MBSA enabled, your scan could look like this:

root@bperry-laptop:/opt/scripts/od-autoassess# sh od-autoassess.sh --client="Joe Badass" --single-host=192.168.0.102 --profile-only --enable-mbsa --mbsa-user=Test --mbsa-pass=password --mbsa-remote-path="C:\Program Files\Microsoft Baseline Security Analyzer 2\mbsacli.exe"

Creating scan folder -> ~/scans/Joe Badass-2010-09-12-14:50

Using 192.168.0.102 in single-host scan...

Scanning individual hosts...

 Scanning 192.168.0.102...
   --Finding shared directories and drives...
   --Trying to get file list for public share: C...
   --Trying to get file list for public share: desktop...
   --Running remote MBSA scan...
   --Interesting port found: 139 NetBIOS Datagram Service
   --Suspicious port found: 445 Nimda 
   --Interesting port found: 445 Microsoft-DS



Creating ZIP archive of scan...


Total time to analyze network:
0 minutes 57 seconds

Interesting port found on 192.168.0.102: 139 NetBIOS Datagram Service
Suspicious port found on 192.168.0.102: 445 Nimda 
Interesting port found on 192.168.0.102: 445 Microsoft-DS


Scanned 1 hosts in total in 0 m 57 s.


root@bperry-laptop:/opt/scripts/od-autoassess# 

So, in under a minute, you can have a pretty extensive source of information for the host at hand even without vulnerability scans.

You can see the latest code here.

Utilising the Microsoft Baseline Security Analyser remotely from Ubuntu

So, today one of my projects was to see if I could incorporate the Microsoft Baseline Security Analyser (MBSA) into the autoassess network script. Some of the options I thought about were running it in wine (doesn't work), running it remotely on the remote machine (works), running a remote scan from yet another dedicated remote server (kinda works, but not really).

I had to download winexe from sourceforge and compile it (not install it, ran it from the winexe/bin folder). It is a "clone" of psexec from the sysinternals suite.

So, onto the knitty-gritty. I first tried to use a remote server (virtual guest) to scan the remote machines. This would have been the second best (next to it just running in wine on the local Ubuntu machine), but alas, MBSA essentially segfaults with an invalid pointer for some reason...

bperry@bperry-laptop:~/Downloads/winexe-0.91/source4/bin$ ./winexe -U Test%password //192.168.0.102 "C:\Program Files\Microsoft Baseline Security Analyzer 2\mbsacli.exe /target 192.168.0.104 /u admin /p password"
Microsoft Baseline Security Analyzer
Version 2.2 (2.2.2170.0)
(C) Copyright 2002-2010 Microsoft Corporation. All rights reserved.

An unexpected error has occurred. The operating system returned error message  -2147467261 Invalid pointer

bperry@bperry-laptop:~/Downloads/winexe-0.91/source4/bin$ 

So, when I saw this, I lost most of my hope of having MBSA run remotely on the remote machine themselves. But, running MBSA on the actual server works! Removing the /target, /u, and /p switches outputs the report MBSA should print.

bperry@bperry-laptop:~/Downloads/winexe-0.91/source4/bin$ ./winexe -U Test%password //192.168.0.102 "C:\Program Files\Microsoft Baseline Security Analyzer 2\mbsacli.exe"
Microsoft Baseline Security Analyzer
Version 2.2 (2.2.2170.0)
(C) Copyright 2002-2010 Microsoft Corporation. All rights reserved.


Security assessment: Severe Risk
Computer name: GENERIC\TEST-8A3888C308
IP address: 192.168.0.102
Security report name: GENERIC - TEST-8A3888C308 (11-09-2010 12-02)
Scan date: 11/09/2010 12:02
Scanned with MBSA version: 2.2.2170.0
Catalog synchronization date: 
Security update catalog: Microsoft Update


  Security Updates Scan Results
 
...

bperry@bperry-laptop:~/Downloads/winexe-0.91/source4/bin$ 

I found this pretty neat, and will be adding support for running MBSA on the remote machine (if applicable) to the autoassessment script. This is a huge step in being able to make a judgement of host security by getting lists of patches and other things the computer both has and does not have installed.

One thing that really frustrated me, and hopefully this helps others who have this problem, but I had disable "Simple File Sharing" on the remote host in order to login remotely from Ubuntu or another Windows host.

Basically, go to My Computer -> Tools -> Folder Options -> View tab -> bottom of the list, uncheck Simple File Sharing. Click apply and the change should work instantly. No need to reboot.

If you get an error saying something about not being able to install winexe service or something, look at the --uninstall and --reinstall flags. (sorry if this got reposted to planets due to the update :-/)

OD AutoAssess VirtualBox Appliance updated

Updated the VirtualBox appliance for the OpenDiagnostics Network AutoAssessment script.

Updated metasploit, od-autoassess, openvas definitions
Installed traceroute, smbclient, nbtscan

You can get it here.

See `sh /opt/od-autoassess/od-autoassess.sh --help` for new arguments and such. A lot of work has gone into the script since updating the last appliance.


ALSO: You can just use svn up /opt/metasploit3/msf3/ and /opt/od-autoassess/ on a current appliance and install the previously mentioned programs it now uses.

OpenDiagnostics Live CD beta release

Making this a beta release until next weekend as long as no bug reports are reported (or they are fixed by then).

Added w3af (dunno how I missed this!)
Added traceroute
Added smbclient
Added nbtscan
Added openvas-scanner (run openvas-nvt-sync to sync vulnerability database... but make sure you have the RAM or are using a thumb drive)
Updated ClamAV definitions
Updated metasploit
Updated od-autoassess

http://volatileminds.net/content/opendiagnostics-live-cd-0

OD AutoAssess Network Script v0.1-beta

I have one bug left before I want to release a non-beta version, but if anyone can download the latest beta of the script here. Feel free to contact me if you find a bug or have a suggestion. Maybe you can fix the last bug I have open atm!

One change that you may need to install, traceroute is now run as well on hosts during the individual host scans. This is appended to the $HOST.nmap file.

USAGE: sh od-autoassess.sh options

Example:#sh od-autoassess.sh --client=joemama --range=192.168.0.0/24 --profile-only

Options:

--profile-only Only profile the network, run no vulnerability assessments and create no reports. Requires --client and --range or --zenity.
--zenity Get user information via zenity (GUI text fields) rather than as arguments. Ignores all other arguments when provided except --profile-only.
--client Name of the client whose network is being scanned.
--range IP range to be scanned.
--company-name Name that you would like the PDF reports created with.
--logo-path Path to the logo you want to customize reports with. Requires --company-name
--openvas-server IP address to a remote (or local) server for openvassd.
--openvas-port Port which openvassd will be listening on.
--openvas-user Username for openvassd server.
--openvas-pass Password for openvassd server.
--help Prints this help.

Added some small features

Added some small features to the OpenDiagnostics auto-assess script. A little better forensics, checks for common suspicious ports now and added a profile-only script (openvas/metasploit aren't run, only nmap and nikto). It is much faster, but only good for topological research.

New output is a bit more verbose will look similar to this...

Mapping network...

Scanning individual hosts...


 Scanning 192.168.0.1...
  --Suspicious port found: 53 ADM worm, li0n, MscanWorm, MuSka52
 Scanning 192.168.0.103...
  --Suspicious port found: 1234 KiLo, Ultors Trojan

...

In this example, 53 is a false-positive for my router (DNS). 1234 was `netcat -p 1234 -l` on my home server. Shouldn't catch most common ports like http/s, ftp, ssh, etc...

You can check out the latest source here.

Updated OpenDiagnostics Live CD and other news

Added puf
Added dsniff suite
Added od-autoassess script to /opt

Updated ClamAV and Metasploit

Removed some un-needed fluff, brought ISO down to 367mb.

You can get the CD here.

Also, added the network autoassessment scripts to code.google.com and you can update it on the CD using svn up on the fly (but I will update it as it is needed on the CD).

OD AutoAssessment Server Tutorial (w/ VirtualBox Appliance!)

I wrote up a quick tutorial on getting the AutoAssess Network Script running on a fresh Ubuntu 10.04 install, and since, to verify everything, I used a virtual machine, I have made an easy to use appliance (and small! 600 MB). If you plan on running the appliance on Linux, you will need to fix the Sound/Audio setting to not use Windows DirectSound.

Credentials are rooty/ytoor, then you can `sudo su` from there to get root. Try setting up a cronjob and letting it run for a month, see what things might be creeping up. I think this would be great for a geek dad who likes to keep his home network secure.

The auto-assess script is in /root (you need to be root to run the script anyway).
The following is an example on how to run it:

sh base_scan.sh local 192.168.0.0/24

'local' is the name of the location, or client, whomever, whatever. '192.168.0.0/24' is the IP range of YOUR network (you can find this out with ifconfig).


A short explanation of the files generated during the scan.

*.nkt are nikto files (the output of running nikto on a host on the network. This is useful for NAS drives, printers, routers, many things you wouldn't suspect).

*.nmap are nmap files, the output of a portscan and OS detection of the host at hand.

*.msf is the entire metasploit session. The end of the file is most important, it tells you how many exploit sessions were able to be opened during the scan and the vulnerability that was used.

*.db is the sqlite3 DB metasploit generates when performing it's scan. I keep this DB strictly for record-keeping, in case I need to go back to my scans for any reason.

*.pdf are the PDF files generated for average person use... main.pdf is a general overview whereas IP specific PDFs go into detail about each host.

network_ips and included are both lists of IP addresses on your network (included does not have the scanner host). The script removes its host from the lists of things to be scanned because it is a foreign host only on the network during the scan (in most of my uses anyway). This can be fixed by making openvas-client and the for loops in the script use network_ips instead of included.

If you have any comments or suggestions, feel free to contact me!

OD AutoAssess Network Script

A few days ago, I posted a small bit on automating OpenVAS. I have written a small shell script that I use to automate (almost) full network testing and assessment. The reason I say almost is because you still need to go through the data collected to make sure nothing serious is up.

This script requires htmldoc, metasploit, openvas-client and -scanner, nmap, and zip. I have posted it to my random script and snippets page and will maintain it there, but posting here as well.

May not be perfect, my bash-fu is rusty. Some extra info, htmldoc is quite neat. You can actually specify a logo image to use if you want for your company adding '--header l --logoimage /path/to/logo.jpg'.

UPDATE: Updated code w/ svn repo here.

SteganoSSH: A theoretical SSH client

How would this work? Obviously, it could work in many ways, here are just a few that would be pretty neat:

First Scenario: 2 streams, 2 ports

The client encrypts the stream through normal SSH means, then using predefined bit offsets, patterns, etc... the client splits the one SSH stream into two streams, lets say that mimic HTTPS and SFTP (ports 443 and 22 respectively, by default).

Both streams could mimic these streams with false header information and junk data, and both being encrypted, any prying 3rd-parties would not be able to say "Oh hey, that stream looks funky".

The server, being configured with the correct bit offsets, patterns, etc would be listening on ports 443 and 22 respectively, would piece the puzzle back together, then hand it off to standard SSH doings.

This would be the more secure out of the two scenarios.

Second Scenario: 1 stream 1 port

The client merely mimics a well known protocol (HTTP/S, S/FTP). Any will do and the server would be able to be configured to strip the fake headers from any stream being sent through the port being listened on.

This would be the easiest, and probably most used.