..........
install base
* priv
passwd
nano -w /etc/ssh/sshd_config
ssh-keygen -t rsa -b 2048
apt-get update
apt-get upgrade
apt-get install build-essential libreadline-dev libssl-dev libpq5 \
libpq-dev libreadline5 libsqlite3-dev libpcap-dev openjdk-7-jre \
git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev \
libxslt1-dev vncviewer libyaml-dev curl zlib1g-dev ipmitool p7zip \
nmap tcpdump subversion cmake bison flex
..........
rbenv
* non-priv
cd ~
git clone git://github.com/sstephenson/rbenv.git .rbenv
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bashrc
echo 'eval "$(rbenv init -)"' >> ~/.bashrc
exec $SHELL
git clone git://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build
echo 'export PATH="$HOME/.rbenv/plugins/ruby-build/bin:$PATH"' >> ~/.bashrc
git clone git://github.com/dcarley/rbenv-sudo.git ~/.rbenv/plugins/rbenv-sudo
exec $SHELL
rbenv install 2.3.1
rbenv global 2.3.1
ruby -v
..........
postgre sql server
* non-priv
sudo -s
su postgres
cd ~
createuser msf -P -S -R -D
createdb -O msf msf
exit
exit
..........
hashcat (not a hot idea on a virtual machine)
* as priv user
sudo apt-get install ocl-icd-libopencl1 opencl-headers clinfo
sudo mkdir /usr/bin/OpenCL
cd /opt
wget https://hashcat.net/files/hashcat-3.10.7z
p7zip -d hashcat-3.10.7z
mv hashcat-3.10/ hashcat
cd hashcat
cp hashcat64.bin /usr/bin
ln -s /usr/bin/hashcat64.bin /usr/bin/hashcat
..........
john
* as priv user
apt-get install build-essential libssl-dev yasm libgmp-dev \
libpcap-dev libnss3-dev libkrb5-dev pkg-config libbz2-dev \
nvidia-cuda-toolkit nvidia-opencl-dev nvidia-352 nvidia-cuda-toolkit opencl-headers <- if you have an nvidia gpu
fglrx-updates-dev <- if you want to use your amd gpu as an opencl device
libopenmpi-dev openmpi-bin <- for mpi support
* a gpu note
lshw -C video
rexgen
apt-get install libboost-regex1.54-dev <- meh
svn checkout https://github.com/teeshop/rexgen.git rexgen
cd rexgen/trunk/src/
mkdir build && cd build
cmake ..
make && sudo make install
ldconfig
git clone git://github.com/magnumripper/JohnTheRipper -b bleeding-jumbo john
cd john/src
./configure --enable-mpi --enable-nt-full-unicode && make -s clean && make -sj4
* because unicode, yes.
./configure --enable-cuda --enable-mpi --enable-nt-full-unicode \
--enable-experimental-code && make -s clean && make -sj4
* if gpu
cd .. && mv run /opt/john
** test gpu
john --list=cuda-devices
john --list=opencl-devices
let's get some password lists
cd /opt/john
mkdir /opt/john/dictionaries
cd /opt/john/dictionaries
cp .. /wordlist.lst .
wget http://download.openwall.net/pub/wordlists/all.gz .
wget https://download.g0tmi1k.com/wordlists/large/crackstation-human-only.txt.gz .
* nb crackstation may show up as a binary file. i'd suggest after extraction:
strings crackstation-human-only.lst > crackstation.txt
fix the environment
edit:
/etc/environment
add /opt/john to PATH
add line JOHN="/opt/john/"
** odds and sods
john --list=formats --format=opencl
john --list=formats --format=cuda
john ~/shadow <- openmp crack session
john --format=sha512crypt-opencl ~/shadow <- opencl session
john --format=sha512crypt-cuda ~/shadow <- cuda session
** add'l chr files
wget https://www.korelogic.com/Resources/Tools/rockyou.chr
wget https://www.korelogic.com/Resources/Tools/rockyou-lanman.chr
* nb http://contest-2010.korelogic.com/rules.html
..........
crunch
* priv user
wget https://sourceforge.net/projects/crunch-wordlist/files/latest/download -O crunch-3.6.tgz
tar xvfz crunch-3.6.tgz
make
make install
..........
metasploitframework
* non-priv
cd /opt
sudo git clone https://github.com/rapid7/metasploit-framework.git
sudo chown -R `whoami` /opt/metasploit-framework
cd metasploit-framework
gem install bundler
bundle install
sudo bash -c 'for MSF in $(ls msf*); do ln -s /opt/metasploit-framework/$MSF /usr/local/bin/$MSF;done'
..........
armitage (metasploit gui)
* priv
curl -# -o /tmp/armitage.tgz http://www.fastandeasyhacking.com/download/armitage150813.tgz
sudo tar -xvzf /tmp/armitage.tgz -C /opt
sudo ln -s /opt/armitage/armitage /usr/local/bin/armitage
sudo ln -s /opt/armitage/teamserver /usr/local/bin/teamserver
sudo sh -c "echo java -jar /opt/armitage/armitage.jar \$\* > /opt/armitage/armitage"
sudo perl -pi -e 's/armitage.jar/\/opt\/armitage\/armitage.jar/g' /opt/armitage/teamserver
sudo nano /opt/metasploit-framework/config/database.yml
production:
adapter: postgresql
database: msf
username: msf
password:
host: 127.0.0.1
port: 5432
pool: 75
timeout: 5
sudo sh -c "echo export MSF_DATABASE_CONFIG=/opt/metasploit-framework/config/database.yml >> /etc/profile"
source /etc/profile
..........
run it
* non-priv
msfconsole
Tuesday, October 11, 2016
soup to nuts install of metasploit on ubuntu 14.04 lts
soup to nuts install of metasploit on ubuntu 14.04 lts
Thursday, October 6, 2016
remove solaris 8 jumpstart services from a solaris 8 jumpstart server
yucky gross solaris 8 jumpstart server begone!
# grep -v "^#" /etc/inetd.conf <- shows what is defined.
hashed finger, tftp, &c in /etc/inetd.conf
# pkill -HUP inetd
bash-2.03# rm /etc/ethers
bash-2.03# rm /etc/bootparams
bash-2.03# rm -rf /tftpboot
bash-2.03# rm -rf /jumpstart
# ptree
to determine if bootparamd is forked (saw entiries in rpcinfo -p)
443 /usr/sbin/rpc.bootparamd
441 /usr/sbin/in.rarpd -a
looked for rarp in /etc/rc2.d ... then all of /etc
# find . -type f -exec grep -l "rarp" {} +
found it... "*nfs.server"
hashed out rard & bootparamd lines
# If /tftpboot exists become a boot server
# if [ -d /tftpboot ]; then
# /usr/sbin/in.rarpd -a
# /usr/sbin/rpc.bootparamd
# fi
Monday, October 3, 2016
netboot solaris 10 via ubuntu 14 using RARP
I did something bad and my Sun T1000 decided to stop booting due to the most
recent patchset.
Luckily ALOM was installed and I could ssh in and see:
Cross trap sync timeout: at cpu_sync.xword[1]: 0x1010
Flow across the console.
This is firmware issue as:
sc> showhost
SPARC-Enterprise-T1000 System Firmware 6.3.10 2007/12/08 15:48
Host flash versions:
Hypervisor 1.3.4 2007/03/28 06:03
OBP 4.25.11 2007/12/07 23:44
POST 4.25.11 2007/12/08 00:10
The patchset is for 6.4. Of course.
Happily the T1000 lacks an optical drive nor any means of connecting one.
No USB either Great.
The next option was to do a network boot. Oh boy.
I didn't feel like messing with my production Solaris systems, so I installed Ubuntu 14
with all the preqs for an old-stype Jumpstart server:
* TFTP
* Bootparamd
* NFSv4
* RARP
* Solaris 10 SPARC DVD (here: /opt/sol-10-u9-sparc.iso)
* Solaris Firmware 6.7.13 patch 139435-10 (here: /opt/solaris10.patches/139435-10.zip)
The reason why I am doing RARP is due to the fact that my network already
has a DHCPvM$ server.
RARP uses reverse ARP to receive its IP address. So, by sending out RARP packets, my
Solaris system is able to get an address and not rely on DHCP. Neat? Yeah.
My systems for this exercise are:
netboot
10.97.32.186
hostnix01 10.97.32.166
0A6120A6 (IP as hex)
00:14:4f:e5:f7:9a
..........................................
netboot
..........................................
packages:
# apt-get install rarpd tftpd-hpa bootparamd nfs-kernel-server
rarpd:
# vi /etc/default/rarpd
Change the last line to match the tftpd-hpa directory and the NIC name:
OPTS="-v -b /var/lib/tftpboot/ eth0"
iso mount:
# mount -o loop /opt/sol-10-u9-sparc.iso /media/solaris10/
nfsd:
# mkdir -p /media/solaris10
# mkdir -p /opt/solaris10.patches
Define a share in NFS for this mount point as this mount will be used to serve
the patches. Open the following file:
# vi /etc/exports
Add the following entries:
/media/solaris10/ *(insecure,rw,no_root_squash,no_subtree_check,sync)
/opt/solaris10.patches/ *(insecure,rw,no_root_squash,no_subtree_check,sync)
bootparamd:
# vi /etc/bootparams
sunfire root=netboot:/media/solaris10/Solaris_10/Tools/Boot install=netboot:/media/solaris10 boottype=:in
per URL: Some explanation for the above: This defines which host gets the specified
NFS share. NFS4 uses relative pathnames, but I am not using this, so therefore I’ve
specified the absolute path. Note that server: is the hostname of the server running
the NFS service and was mentioned in my post earlier as my server is originally named
"netboot". The name used is the hostname of your server, substitute it to the correct name.
rarpd:
# vi /etc/hosts
Add the following entry:
10.97.32.166 hostnix01
Create the ethers file:
vi /etc/ethers
Add the following entry:
00:14:4f:e5:f7:9a hostnix01
per URL: Replace the MAC address with the MAC of your Sun server. You can change the
hostname as well, but needs to be the same everywhere!
tftpd:
vi /etc/default/tftpd-hpa
Change the TFTP_ADDRESS line to the following:
TFTP_ADDRESS=":69"
per URL: The configuration of the server is now complete One last step we need to do is
to copy the netboot kernel for the Sun server. This resides on the mounted Solaris
install image. By default OpenBoot will look for a kernel using TFTP when using network
boot. Based on it’s IP-address it will look for a matching HEX filename. We can find out
which filename that would be by running the following:
# printf "%02X%02X%02X%02X" 10 97 32 166
This will result in the following (for my IP-address):
0A6120A6
The above will be the netboot kernel for the Sun server. Place the netboot kernel in place:
# cp /media/solaris10/Solaris_10/Tools/Boot/platform/sun4u/inetboot /var/lib/tftpboot/C0A800E6
restart the services in order
service tftpd-hpa restart
service bootparamd restart
service nfs-kernel-server restart
service rarpd restart
..........................................
hostnix01
..........................................
# ssh admin@hostnix01-alom (remote management shell)
sc> poweron
sc> console -f
When you see mac address, get into openboot
#.
sc> break -y
Switch back to console and netboot the kernel
sc> console -f
ok > boot net:rarp -avs
* https://docs.oracle.com/cd/E19455-01/805-7228/hbsparcboot-60/index.html
* interactive, verbose, single user mode (does not include install flag)
After waiting next to forever...
# mkdir /tmp/mount
# mount -F nfs 10.97.32.186:/opt/solaris10.patches /tmp/mount
# cd /tmp/mount
# unzip 139435-10.zip
# cd 139435-10
# ./sysfwdownload /pwd/patch.bin
Run patching command via sysfwdownload. If you see:
"sysfwdownload: file could not be opened"
that means the installer requires the full path; e.g.:
/tmp/mount/139435-10/Firmware/SPARC_Enterprise_T1000/Sun_System_Firmware-6_7_13-SPARC_Enterprise_T1000.bin
# ./sysfwdownload Sun_System_Firmware-6_7_13-SPARC_Enterprise_T1000.bin
.......... (10%).......... (20%).......... (30%).......... (41%)..........
(51%).......... (61%).......... (71%).......... (82%).......... (92%)........ (100%)
Download completed successfully
# init 0
Now you should be back at the 'ok' prompt. Now on the ALOM:
sc> poweroff
SC Alert: SC Request to Power Off Host.
SC Alert: Host system has shut down.
sc> setkeyswitch -y normal
sc> flashupdate -s 127.0.0.1
sc> resetsc
Your ssh console will be terminated due to a broken pipe.
ssh back in and issue:
sc> poweron
sc> console -f
And you're back!
verify:
SPARC Enterprise T1000, No Keyboard
Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
OpenBoot 4.30.4.e, 3968 MB memory available, Serial #82179994.
Ethernet address 0:14:4f:e5:f7:9a, Host ID: 84e5f79a.
Boot device: disk File and args:
ufs-file-system
Loading: /platform/SUNW,SPARC-Enterprise-T1000/boot_archive
ramdisk-root hsfs-file-system
Loading: /platform/SUNW,SPARC-Enterprise-T1000/kernel/sparcv9/unix
SunOS Release 5.10 Version Generic_150400-38 64-bit
Copyright (c) 1983, 2016, Oracle and/or its affiliates. All rights reserved.
os-io WARNING: failed to resolve 'scsa,probe' driver alias, defaulting to 'nulldriver'
WARNING: failed to resolve 'scsa,nodev' driver alias, defaulting to 'nulldriver'
Hostname: hostnix01
Configuring devices.
LDAP NIS domain name is
No panics. Yay!
#.
sc> showhost
SPARC-Enterprise-T1000 System Firmware 6.7.13 2013/09/24 08:10
Host flash versions:
OBP 4.30.4.e 2013/09/23 16:06
Hypervisor 1.7.3.d 2013/09/24 07:19
POST 4.30.4.b 2010/07/09 14:25
All is as it should be.
....
some of this was lifted from here:
https://www.arm-blog.com/installing-solaris-10-on-a-sunfire-v210-via-network/
Friday, September 16, 2016
Thursday, September 15, 2016
solaris 10 sysidcfg example
sometimes you get tired of pressing esc 2. after you create your zone, plop this file in: /zonename/root/etc/sysidcfg issue: # zoneadm -z zonename boot # zlogin -C zonename and have a ball, y'all
system_locale=en_US
timezone=US/Eastern
terminal=vt100
timeserver=localhost
name_service=DNS {domain_name=nothere.com
name_server=10.6.7.8,10.6.7.9
search=nothere.com}
nfs4_domain=dynamic
root_password=nVgCm2Wm0wNVZ <---- from /etc/shadow, fool.
network_interface=primary {hostname=hostfromhades
default_route=10.6.6.1
ip_address=10.6.6.6
netmask=255.255.255.0
protocol_ipv6=yes}
security_policy=none
the fabled ipv6 sol 10 post
IPv6 in Shared-Stack Zones
By user12618912 on Oct 08, 2009
I was recently at an OpenSolaris user-group meeting where a question was asked regarding how IPv6 could be used from a shared-stack zone. For the benefit of anyone who has a similar question, here is an example of a working configuration:
bash-3.2# zoneadm list -iv
ID NAME STATUS PATH BRAND IP
0 global running / native shared
- test installed /export/home/test native excl
- test2 installed /export/home/test2 native shared
The exclusive-stack zone "test" has all of its own networking configured within it, so IPv6 inherently just works there. The question, however, was about shared-stack, and so I setup the "test2" zone to demonstrate this.
bash-3.2# zonecfg -z test2
zonecfg:test2> add net
zonecfg:test2:net> set physical=e1000g0
zonecfg:test2:net> set address=fe80::1234/10
zonecfg:test2:net> end
zonecfg:test2> add net
zonecfg:test2:net> set physical=e1000g0
zonecfg:test2:net> set address=2002:a08:39f0:1::1234/64
zonecfg:test2:net> end
zonecfg:test2> verify
zonecfg:test2> commit
zonecfg:test2> exit
bash-3.2# zonecfg -z test2 info
zonename: test2
zonepath: /export/home/test2
brand: native
...
net:
address: 10.8.57.111/24
physical: e1000g0
defrouter not specified
net:
address: fe80::1234/10
physical: e1000g0
defrouter not specified
net:
address: 2002:a08:39f0:1::1234/64
physical: e1000g0
defrouter not specified
Here I configured a link-local address fe80::1234/10, and a global address 2002:a08:39f0:1::1234/64. Each interface within each zone requires a link-local address for use with neighbor-discovery, and the global address is the address used for actual IPv6 communication by applications and services. The global address' prefix is one that is configured on the link to which the interface is connected. In the zone, we end up with:
bash-3.2# zlogin test2 ifconfig -a6
lo0:1: flags=2002000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv6,VIRTUAL> mtu 8252 index 1
inet6 ::1/128
e1000g0:2: flags=2000841<UP,RUNNING,MULTICAST,IPv6> mtu 1500 index 2
inet6 fe80::1234/10
e1000g0:3: flags=2000841<UP,RUNNING,MULTICAST,IPv6> mtu 1500 index 2
inet6 2002:a08:39f0:1::1234/64
The global zone has IPv6 connectivity using this same prefix as well as a default IPv6 route: [2]
bash-3.2# netstat -f inet6 -rn
Routing Table: IPv6
Destination/Mask Gateway Flags Ref Use If
--------------------------- --------------------------- ----- --- ------- -----
2002:a08:39f0:1::/64 2002:a08:39f0:1:214:4fff:fe1e:1e72 U 1 0 e1000g0:1
fe80::/10 fe80::214:4fff:fe1e:1e72 U 1 0 e1000g0
default fe80::1 UG 1 0 e1000g0
::1 ::1 UH 1 21 lo0
From the non-global zone, we have IPv6 connectivity:
bash-3.2# zlogin test2 ping -sn 2002:8194:aeaa:1:214:4fff:fe70:5530
PING 2002:8194:aeaa:1:214:4fff:fe70:5530 (2002:8194:aeaa:1:214:4fff:fe70:5530): 56 data bytes
64 bytes from 2002:8194:aeaa:1:214:4fff:fe70:5530: icmp_seq=0. time=4.654 ms
64 bytes from 2002:8194:aeaa:1:214:4fff:fe70:5530: icmp_seq=1. time=2.632 ms
64 bytes from 2002:8194:aeaa:1:214:4fff:fe70:5530: icmp_seq=2. time=2.501 ms
64 bytes from 2002:8194:aeaa:1:214:4fff:fe70:5530: icmp_seq=3. time=2.571 ms
\^C
----2002:8194:aeaa:1:214:4fff:fe70:5530 PING Statistics----
4 packets transmitted, 4 packets received, 0% packet loss
round-trip (ms) min/avg/max/stddev = 2.501/3.090/4.654/1.044
enable ipv6 on solaris10 afterthefact
effing oracle.
you have this:
# ifconfig inet6 interface plumb up
which in my case is:
# ifconfig inet6 igb0 plumb up
and it spits out:
ifconfig: igb0: bad address (try again later)
no. your doc writers are jerks. here's what it should look like:
root@host:~$ ifconfig igb0 inet6 plumb
root@host:~$ ifconfig igb0 inet6 token ::10/64
root@host:~$ svcadm enable svc:/network/routing/ndp:default
root@host:~$ pkill -HUP in.ndpd
root@host:~$ ifconfig -a6
igb0: flags=2000840<RUNNING,MULTICAST,IPv6> mtu 1500 index 2
inet6 fe80::210:e0ff:fe0c:ea9a/10
ether 0:10:e0:c:ea:9a
make it permanent.
root@host:~$ vi /etc/hostname6.igb0
hostname
addif fe80:0000:0000:210:e0ff:fe0c:ea9a/10 up
* note: : is a series of :0000:
oracle, eat a bug. eat a lot.
Subscribe to:
Posts (Atom)