AutoSSH on Odriod XU4 running Kali Linux 2

In my last blog, SSH into Kali 2.0 on ARM (Odroid, Banana Pi, etc), I configured SSH with RSA public/private keys so that I could securely connect the Odroid with certificates instead of a username and password.

In this blog I am going to install autossh and setup the Odriod to automatically create an SSH tunnel to my Digital Ocean CentOS virtual server on boot. Why would you want to do this? Sometimes you want to leave the Odriod at a site and access it later. Having a tunnel that automatically comes up on boot and reconnects if the tunnel drops means you can always log in.

Install autoSSH

AutoSSH is in the Kali repository so no repositories need to be added.

root@kali:~# apt-get install autossh ssh

This will install autossh and the latest version of the SSH client.

Generate a new set of RSA keys

These keys will be created WITHOUT a pass phrase. We can't have a pass phrase on this set of keys because the Odroid needs to be able to automatically connect without any user intervention.

root@kali:~# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): /root/.ssh/nopwd
Enter passphrase (empty for no passphrase): LEAVE This Blank
Enter same passphrase again:
Your identification has been saved in /root/.ssh/nopwd.
Your public key has been saved in /root/.ssh/nopwd.pub.
The key fingerprint is:
SHA256:7ZmIPa2zD0YMtkvBpm9/juu5mjL98nrpG8nGurwmWFY root@kali

Review the keys

root@kali:~# ls ~/.ssh
authorized_keys  id_rsa  id_rsa.pub  known_hosts  nopwd  nopwd.pub

root@kali:~/.ssh# cat nopwd.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqsWLWXwoafVWsXAyNtZsnhYzn6PO2t5Ryr0U1JfQzVYwbmLB/MkUXTP57bwSGZ7XiljrsayrJwQny08Wxj11WYl74un1lsvBk+75HNiHC76F9iIF0jN12N0OgybdKymWGEIV5u9q7oqAw41ZXJDqgMA+ZglvGeyH9Ge2OWHyzSKSlGLl4bV51ww/FH0ZtPxXFKgoRSmQ8C7AP7IIFRLZJXJm1fSMdC+TpvUx68baCGo91PwZcdHY9dPnKaYZxcUlzRc0ou4pph3kr+b9beZsrJh/DGlrQC1uRy4HljKOGH4Bq1daf5GkrZQZNvfrXofT4WVyYWgzJ6u7Cs42/29tP root@kali

Copy the new keys to the Digital Ocean VPS

root@kali:~# ssh-copy-id -i .ssh/nopwd.pub -p 22 mhubbard@VPS-IP-Address
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: ".ssh/nopwd.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Enter passphrase for key '/root/.ssh/id_rsa':

Number of key(s) added: 1

Test that the key was copied

Note that we have to use the SSH parameter -i to explicitly use our now password key. This is because I have disabled passwords on my VPS.

root@kali:~# ssh -p 22 -i /root/.ssh/nopwd  mhubbard@VPS-IP-Address
Last login: Mon Sep  5 11:12:07 2016 from xxx-xxx-xxx-xxx-static.rvsd.ca.charter.com

mwhubbard.blogspot.com

This is a private system. Unless you have explicit
permission from Michael Hubbard logout immediately!

AutoSSH parameters

-M 10984 - autoSSH monitoring port. Used to keep the connection up
-o "PubkeyAuthentication=yes" Authenticate with SSH Keys instead of passwords.
-o "PasswordAuthentication=no" Explicitly disable password authentication
-i /root/.ssh/nopwd Explicitly use our no password key
-R 2223:localhost:22: reverse tunnel. forward all traffic on port 2223 on the VPS to port 22 on the Odriod.

Run autossh to connect to the Digital Ocean VPS

root@kali:~/.ssh# autossh -M 10984 -o "PubkeyAuthentication=yes" -o "PasswordAuthentication=no" -i /root/.ssh/nopwd -R 2223:localhost:22 mhubbard@107.170.203.230 -p 22
Last login: Sun Sep  4 21:52:16 2016 from xxx-xxx-xxx-xxx-static.rvsd.ca.charter.com

mwhubbard.blogspot.com

This is a private system. Unless you have explicit
permission from Michael Hubbard logout immediately!

Enable the tunnel on boot

These steps come straight from the "Persistent Reverse (NAT Bypassing) SSH tunnel" site listed in the references. It was the piece that I  didn't know how to do and the blog was excellent.

Here is a screen shot of my /etc/rc.local file

References
Persistent reverse (NAT bypassing) SSH tunnel access with autossh - This is a great site for system admins. I am really glad I found it.
autossh – Automatically restart SSH sessions and tunnels
Bypassing corporate firewall with reverse ssh port forwarding
SSH TUNNELLING FOR FUN AND PROFIT: AUTOSSH

SSH into Kali 2.0 on ARM (Odroid, Banana Pi, etc)

My latest pen testing tool is an Odroid UX4 from Ameridriod.com. The XU4 is an 8 core ARM based Single Board Computer (SBC). The team at Offensive Security have ported Kali 2.0 to run on the Odroid. I flashed Kali 2.0 onto the eMMC card and the image works great. My next step was to setup SSH for remote access.

Kali 2.0 follows the Debian model of not allowing Root logins without a key.  This is definitely the most secure way to use SSH for remote access and it easy to set up.

If you are running headless you will need to use the USB/UART that Hardkernel sells for the UX4. I have found the Logitech MK620 wireless keyboard/mouse works great with the Odroid XU4. The wireless keyboard does have security issues (see Keysniffer.net) but I don't use it anywhere but in my lab.

Generating the RSA private/pubic keys

If you need to create RSA keys on Windows please see my blog Authenticating to Cisco devices using SSH and your RSA Public Key on using puttygen to create the keys.

On a Linux box

You should always move the default SSH keys on your distribution to a backup folder and create new keys before using SSH. See Duplicate SSH Keys Everywhere
If you need to generate an RSA key pair:
ssh-keygen
select the default location
enter a pass phrase to protect the keys.

Here's what it looked like on my Ubuntu laptop:

mhubbard@1S1K-SYS76:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/mhubbard/.ssh/id_rsa):
Created directory '/home/mhubbard/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/mhubbard/.ssh/id_rsa.
Your public key has been saved in /home/mhubbard/.ssh/id_rsa.pub.
The key fingerprint is:
3a:1f:82:3a:60:b5:99:e0:4e:9e:91:92:12:05:4d:fc mhubbard@1S1K-SYS76

Here are the keys in the hidden .ssh folder:
mhubbard@1S1K-SYS76:~$ ls -la ~/.ssh
total 20
drwx------  2 mhubbard mhubbard 4096 Aug 30 11:13 .
drwxr-xr-x 18 mhubbard mhubbard 4096 Aug 30 11:13 ..
-rw-------  1 mhubbard mhubbard 1766 Aug 30 11:05 id_rsa
-rw-r--r--  1 mhubbard mhubbard  401 Aug 30 11:05 id_rsa.pub
-rw-r--r--  1 mhubbard mhubbard  222 Aug 30 11:13 known_hosts

To display the fingerprint in the future:
mhubbard@1S1K-SYS76:~$ ssh-keygen -lf ~/.ssh/id_rsa
2048 3a:1f:82:3a:60:b5:99:e0:4e:9e:91:92:12:05:4d:fc  mhubbard@1S1K-SYS76 (RSA)

This pass phrase will be required the first time you connect to a device but is it much safer than not using one. If you lose control of your private key and didn't have a pass phrase set it could be used to log into any device you set up.

Once you have the key pair generated you need to copy the public key and paste it into the authorized_keys file on the Odroid.

mhubbard@1S1K-SYS76:cd ~/.ssh
mhubbard@1S1K-SYS76:~/.ssh$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUUfkp+xPLQDmGaPokHXxK6yhxG1a+pmdCHDzHFBSqsGJIMuVSSwzUksfJU7XG5PEcE8Yt9qU2WVieZXsjMcdZDphhNzdT4RSW63m12ov7jo35KBGFEHnNGv/m6cUEOq9oGfRD5sE7g2wF+QQh74Y4m1ld5VnOicGaR/qyYSazpBJlZKHP2lYfb2coDhHHsnoyBedZbtFxNK3lPKggd4mywmJ19XSZ9Bm2/HurcibYJodHdDn0BoP9Qlvc5vRiZqT6XAS9tIhzeydgkmhYQ8UnAYeclo/WiTR98FYEXzm+aGV0/bH4IZB6mlth53YyR/hxeeKzn7WqTc6/WKx9qrSB mhubbard@1S1K-SYS76

Copy the entire key including the ssh-rsa and username@system

On the Odriod

cd ~
mkdir .ssh
nano /root/.ssh/authorized_keys


ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCUUfkp+xPLQDmGaPokHXxK6yhxG1a+pmdCHDzHFBSqsGJIMuVSSwzUksfJU7XG5PEcE8Yt9qU2WVieZXsjMcdZDphhNzdT4RSW63m12ov7jo35KBGFEHnNGv/m6cUEOq9oGfRD5sE7g2wF+QQh74Y4m1ld5VnOicGaR/qyYSazpBJlZKHP2lYfb2coDhHHsnoyBedZbtFxNK3lPKggd4mywmJ19XSZ9Bm2/HurcibYJodHdDn0BoP9Qlvc5vRiZqT6XAS9tIhzeydgkmhYQ8UnAYeclo/WiTR98FYEXzm+aGV0/bH4IZB6mlth53YyR/hxeeKzn7WqTc6/WKx9qrSB mhubbard@1S1K-SYS76

CTRL+x to exit. Be sure to answer y and save the file.

Note: Make sure the key is on one line! This isn't an issue on Linux/Mac OX but if you copy the key from a Windows box it will probably have line feeds in it. MS can never follow the standards set by Unix decades ago!

On your favorite ssh client 

I use Perl Auto Connect (PAC) on Linux and Putty on Windows. If you are a Windows user my previous blog covers using an RSA key pair with Putty.

On PAC
Create a new connection
Click the Private Key Radio button
Browse to the ~/.ssh folder and select your private key
Enter root as the user:
Enter the pass phrase for the private key.
Click "Save and Close".

You can now log into Kali with your RSA key pair.

References
Kali Linux 2.0 Top 10 Post Install Tips
Kali SSH problems

Security Resources

Updated October 9, 2022
There are so many IT security resources on the Internet that it would be impossible to document them all. I curate this page roughly monthly with new things I have found. 

I hope you find something that you didn't know about!

Topics

• Twitter Feed
• Podcasts
• Cisco Specific links
• Aruba Specific Links
• Microsoft Specific
• Hacking IPMI (iLo, Drac, etc)
• Password Cracking
• Nmap
• Linux Specific
• Wireshark
• PowerShell
• PowerCLI
• Pen Testing
• Books
• Google Dorks
• Web Sites
• Privacy

IP Addresses for use in Documentation

Before I get started on resources, I want to talk about some little-known IP address blocks. Have you ever been watching a movie or TV show where they have a hacker banging away and they show IP addresses like 355.290.400.12?  It really turns me off on the show or movie when that happens. Think CSI-Cyber!

The IETF provides three IP blocks for documentation so using a nonsense IP isn't necessary. From the RFC - The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2) and 203.0.113.0/24 (TEST-NET-3) are provided for use in documentation. Addresses within the TEST-NET-1, TEST-NET-2, and TEST-NET-3 blocks SHOULD NOT appear on the public Internet and are used without any coordination with IANA or an Internet registry [RFC2050].

So, when you are writing a blog on some new nmap script you discovered use one of these blocks!
IPv4 Address Blocks Reserved for Documentation

If you are doing an IPv6 document the /32 range that has been reserved for documentation is: 2001:0DB8::/32

IPv6 Documentation prefix

Open Source

If you want to get into Cyber security you will need to learn some Linux and how the Open Source software ecosystem works. This link is a Twitter thread showing how to get started.

How to get started with open source:

Twitter 

There are so many good security sources on Twitter it's hard to keep up with the tweets!

My feed is @rikosintie and it is about 95% IT security info.

@snowden - Edward Snowden
@johullrich - He runs the SANS Internet Storm podcast.
@mikko - This is Mikko Hypponen from FSecure
@dakami - This Dan Kaminsky of DNSSec fame. Dan passed away in 2021. 
@bgpstream - BGP outages. An eye-opening feed.
@schneierblog - The great cryptographer Bruce Schneier
@Routerpwn - A site dedicated to hacking consumer routers
@SCADAhacker - Industrial Control System (ICS) hacking
@langnergroup - Industrial Control System (ICS) hacking
@DarkReading - General security news
@nmap - Low volume tweets about nmap
@KevinMitnick - no introduction needed
@hdmoore - again, no introduction is needed
@briankrebs - a genius at infiltrating the dark net
@Unix-Ninja - Team Hashcat
@InfoSecHotSpot - Your Source For InfoSec News
@CiscoSecurity - Official Cisco Security feed.

Podcasts

I listen to these podcasts on a regular basis. Any podcast app should be able to find them. It is surprising how much you can learn for free by listening to podcasts.

Security Podcasts

• Brakeing Down Security– Bryan Brake’s podcast. Some really good guests appear on this podcast.
• Brakeing Down Incident Response - Brian Boetcher from Braking Down Security discusses Incident Response.
• Darknet Diaries - Jack Rhysider covers famous hacks and breaches
• Dark Secret Place - Not an IT podcast but if you want the real story about the world melting down this is the podcast you want.
• Defensive Security Podcast - A Cybersecurity podcast covering breaches and strategies for defense.
• Down The Security Rabbithole– Sometimes XXX rated but worth the time.
• SANS Internet Stormcast - 5-minute daily update. An absolute must!
• SecurityNow - One of the oldest podcasts on the Internet. Focused more on general security topics than network security but very entertaining. SecurityNow did a series of podcasts on Public Key Infrastructure (PKI) and cryptology. It was 10 years ago but the theory hasn't changed. Episodes 30-35 and 37 will get you up to speed on Crypto. Episode 456 "Harvesting Entropy" is a must listen to. You can go to http://www.grc.com/securitynow.htm and download the podcast and transcripts that you can read.
• Paul's Security Weekly - Covers InfoSec news, techniques, technical How-tos, etc.
• The Social-Engineer Podcast– They can be long-winded but there have been some great podcasts. There is one called “Don’t Scan me Bro” that is an hour long interview with the great HD Moore. I can’t recommend it enough.
• Sound Security - Braxton Ehle and Osman Surkatty rant about the latest in information security news to help enterprises and mere mortals defend their information.
• Standard Deviant Security – cyber security for the truth-seekers, mavericks and square pegs. Blog, and podcast by Tony Martin-Vegue.
• The Complete Privacy & Security Podcast - This podcast, hosted by Michael Bazzell, will explain how to become digitally invisible.
• Open Source Security Podcast - Short weekly podcast on open source security
• Smashing Security - Graham Cluely and Carole Theriault laugh at the state of security
• Security in Five - short 5-minute daily podcast
• Unsupervised Learning - Daniel Miessler discusses the state of security  
• Ubuntu Security Podcast - Canonical employees discuss current patches

General Sysadmin and Linux podcasts

• 2.5 Admins - Allan Jude, Jim Salter, and Joe Resington discuss Sys Admin topics
• Art of Charm - How to succeed by understanding human interaction
• Ask Noah - Noah owns an MSP that converts customers to Linux
• BSD Now on Jupiter Broadcasting – Allan Jude is a genius and has a great teaching podcast.
• Destination Linux - weekly dose of Linux goodness. They have a whole network of podcasts now.
• Command Line Heros - a Redhat sponsored podcast on how we got here
• Home Assistant Podcast - Everything Home Assistant
• Iron Sysadmin - three Redhat employees discuss topics of the week
• Late Night Linux - Joe, Phalen and Graham discuss Linux. Can be XXX!
• Linux Unplugged on Jupiter Broadcasting - a general show on Linux.
• Linux Action News on Jupiter Broadcasting - a general show on Linux.
• Linux in the Ham Shack - Ham radio focused podcast
• Software Gone Wild - Dedicated to software-defined networking
• TechSNAP on Jupiter Broadcasting - General IT technology podcast.
• This week in Enterprise Tech - Hosted by Robert Ballecer, Curtis Franklin and Brian Chee.
• IPv6 Buzz - Podcast on the current state of IPv6 deployments
• The Network Break - weekly update on who bought who and new network announcements

General Web Security

HTTP Archive’s annual state of the web report - A great turtorial on web technologies and security.

12 websites that will help you learn web development faster (completely free): - The more you know about web dev the better.

Cisco specific

Cisco Best Practices to Harden Devices Against Cyber Attacks Targeting Network Infrastructure Cisco is aware of the recent joint technical alert from US-CERT ((TA18-106A) that details known issues that require customers to take steps to protect their networks against cyber-attacks.

Cisco Guide to Harden Cisco IOS Devices - The three functional planes of a network,  the management plane, control plane, and data plane, each provide different functionality that needs to be protected.

Cisco Guide to Harden Cisco IOS XR Devices - This document contains information that will help users secure Cisco IOS XR system devices to increase the overall security of a network.

Cisco TAC Security Show Podcasts
The Cisco Security TAC guys do an occasional podcast. All of them are worth listening to but these three are mandatory in my opinion!

• Useful ASA and IPS Commands and Features You Might Not Know About
• ASA Version 9.2 and Interesting TAC Cases - This is one is great. Not the ASA part but the "Interesting TAC cases" section.
• Investigating Syslogs: Tips and Tricks

Aruba Specific

I have started deploying a lot of Aruba gear. I am starting to get into the Aruba flow and really like Clearpass and their security products.

Aruba Network Security Essentials for the Intelligent Edge!

Aruba Network Security Fundamentals Webinar - This requires registration but is a 2-hour presentation.

I am also creating a "Cookbook" of Aruba configurations on my github at Aruba Cook Books

Microsoft specific

It's a Microsoft world in the enterprise and you will need to know how certain Windows technologies work to secure or attack Windows machines.

1. A mind map for Pen Testing Active Directory
   
2. Tracking Lateral Movement Part One - A must-read if you are responsible for AD Security.
3. Monitoring what matters – Windows Event Forwarding for everyone
4. Pass the Hash - If you don't know what that means you should read this blog.
5. Active Directory Security - An outstanding site on AD attacks. 
6. Domain Admin in Active Directory, Guy Franco - Paul's Security Weekly #520 - Guy shows us how to abuse service accounts to get yourself a golden ticket
7. Domain Network Systems (DNS) Information - A site dedicated to W2008 AD/DNS
8. Domain Name System - Microsoft's official DNS documentation site
9. 'Web Server' Certificate Template not an option on http://server/certsrv
10. Troubleshooting autoenrollment - Certificate Services Troubleshooting
11. Certificate Enrollment - The RPC Server is unavailable
12. Event ID 91 — AD CS Active Directory Domain Services Connection
13. Linux Essentials for Windows Admins – Basics
14. Linux to the rescue! How Ubuntu can help a computer in distress
15. How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server
16. How do you check what version of Server Message Block client a workstation is using on Windows?
17. Weekend Scripter: Install PowerShell 4.0 in Windows 7
18. Cheat Sheets to help you in configuring Windows Logging
19. Avoiding Ransomware with built-in basic changes
20. How to prevent your computer from becoming infected by CryptoLocker
21. Attacking Active Directory - A gitlab.io blog on pen testing AD.
    
22. Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization
23. Detecting Responder via LLMNR Honey Tasks on User Workstations - A great YouTube on how Responder is used to capture hashes.
    

Hacking iLo/iDrac/IMM

1. Risks of Using the Intelligent Platform Management Interface (IPMI) - US Cert warning
2. IPMI: The most dangerous protocol you've never heard of
3. Hacking IPMI Cipher 0 Using Kali Linux
4. A Penetration Tester's Guide to IPMI and BMCs - HD Moore's guide to hacking IPMI
5. IPMI++ Security Best Practices
6. HewlettPackard/PowerShell-ProLiant-SDK
7. Scripting Tools for Windows PowerShell User Guide iLO cmdlets v1.4
8. PowerShell cmdlets for HPiLO boards V1.2.0.0
9. About Execution Policies
10. supermicro-ipmi-conf - NMAP script to pull Super Micro credentials
11. Owning Dell DRAC for ONE AWESOME HACK!

Password Cracking

How I became a password cracker - A good ARS Technica article on using HashCat.

Hashcat home page - Be sure to read as much of the wiki as possible. There is a wealth of information in the wiki.

Building a Password Cracking Rig for Hashcat
Building a Password Cracking Rig for Hashcat - Part II

Below is a great three-part blog series on cracking IKE on Cisco ASA. If you are responsible for securing a VPN (Cisco, SonicWall or other) you should read these posts.

August 3rd, 2016 Update: Cisco wins Pwnie at Blackhat
Pwnie for Best Server-Side Bug - Cisco's ASA (Ancient Security Architecture) firewalls had a vulnerability in their IKE fragment re-assembly that permitted remote unauthenticated heap memory corruption.

Make sure you know how to use this!

• Cracking IKE Mission:Improbable (Part 1)
• Cracking IKE Mission:Improbable (Part 2)
• Cracking IKE Mission:Improbable (Part 3)

The RADIUS protocol 

Using RADIUS or TACACS for device authentication is a Cisco best practice. Here are two links that discuss the weaknesses in the RADIUS protocol:

An Analysis of the RADIUS Authentication Protocol

What is a RADIUS server?

And one on using an evil twin to get 802.1x password hashes

Cracking WPA2 Enterprise wireless networks with FreeRADIUS WPE, hostapd and asleap & John the Ripper

Keepass

A Case Study in Attacking KeePass - A great blog on attacking KeepassX with Powershell and hashcat 3.0.
KeePass Cross-Platform Community Edition - A new fork of Keepass. KeepassXC has support for Yubikey.
Powershell to find KDB files - I wrote a simple Powershell script to find Keepass database files on all attached drives on a Windows machine.

Nmap

My first Python script was a wrapper for my most used nmap scripts. It saves me a lot of time when I'm scanning for specific information. It's free/Open Source and available here: Python Wrapper for nmap

I also recommend subscribing to the nmap mailing list. It is very active and you will get advanced notification of new scripts and ideas for nmap. Subscribe here: https://nmap.org/mailman/listinfo/dev

• Top 30 Nmap Command Examples For Sys/Network Admins
• 10 nmap Commands Every Sysadmin Should Know
• Nmap Cheat Sheet
• Advanced Nmap: NMap Script Scanning
• ip-geolocation-geoplugin
• hnap-info - Home Network Automation Protocol
• More on HNAP - What is it, How to Use it, How to Find it
• Digital Bond's Industrial Control System Enumeration Tools
• Identifying Firewalls from the Outside-In. Or, "There's Gold in them thar UDP ports!"
• python-nmap : nmap from python
• Enumerate DNS Hostnames using NMAP
• A Pen Testers Guide to the Network Time Protocol (NTP)
• How to spoof your IP address using NMAP in Windows
• Banner-Plus - HD Moore's replacement for nmaps banner script
• SSHv1 or SSHv2? What's the big deal?
• Scanning for SNMP services with default community strings
• Scan for Heartbleed using nmap from a Windows machine
• Video Tutorial: Introduction to Pen Testing Simple Network Management Protocol (SNMP)
• NMAP Script Library - 534 scripts you need to look at!
• Decrypting TLS Browser Traffic With Wireshark – The Easy Way!
• 7 Nmap NSE Scripts for Recon

Linux Specific

• Top 20 OpenSSH Server Best Security Practices
  
• Creating an UEFI bootable Linux USB stick
• VPN setup in Ubuntu – General introduction
• What is best way to install a Cisco VPN client application in Ubuntu?
• HOWTO: PPTP: Ubuntu Client connect to Windows VPN Server
• Configure Linux VLANs - Add a Vlan sub interface to your Linux laptop
• What is the Linux equivalent to Windows' Program Files?
• Simplify Your Life With an SSH Config File
• 30 Handy Bash Shell Aliases For Linux / Unix / Mac OSX
• 80 Linux Monitoring Tools
• Using Virtual Ethernet Adapters in Promiscuous Mode on a Linux Host
• Compile keepassX 2.0.3 on Linux
• How To Set Up Multi-Factor Authentication for SSH on CentOS 7 - Use Google Authenticator
• Linux/Unix/BSD Post-Exploitation Command List

Wireshark

WYSIWYG Network Packet Editor: WireEdit - WireEdit is a full stack WYSIWYG network packets editor.
Sharkfest 2013 - Inside the TCP Handshake (Betty DuBois) - A great introduction to TCP

Powershell

Microsoft open-sourced its scripting language called Powershell. For a security professional this is good news as you can write a script and run it on Windows, macOS, or Linux. 

Installing Powershell

Windows

Powershell is built-in, simply tap the Windows key, type Powershell select the PowerShell terminal or the PowerShell ISE. 

Linux

On Ubuntu, I prefer to use snapd for installing PowerShell. Simply open a terminal and run

sudo snap install code --classic

Microsoft has instructions for installing using APT at this link - Installing PowerShell on Linux

Microsoft instructions for installing with snapd

Running PowerShell

After you have Powershell installed, open a terminal and enter pwsh.

macOS

I have a blog on installing and using PowerShell on macOS here

Now that you have PowerShell installed you can use this script from Black Hills Information Security on macOS, Linux, or Windows to check open outbound ports. 

You can read about it here

1..1024 | % {$test= new-object system.Net.Sockets.TcpClient; $wait = $test.beginConnect("allports.exposed",$_,$null,$null); ($wait.asyncwaithandle.waitone(250,$false)); if($test.Connected){echo "$_ open"}else{echo "$_ closed"}} | select-string " "

Running Powershell on macOS

Open a new tab in terminal and enter:

pwsh 

Here is a link to a simple PowerShell script I wrote to create DHCP reservations for printers. It ran perfectly on macOS:

Printer-DHCP

A simple script to create DHCP reservations for a Windows Server.

Today I needed to create DHCP reservations for some Access Points. I had the script above but I wanted to read the data from a CSV file. Here is the script modified to read the data from a CSV file.

param([string]$server = "server", [string]$scope = "scope")
$a = Import-Csv DHCP.csv
foreach ($item in $a) {
$ip=$($item.IP)
$mac=$($item.MAC)
#remove colons since MS DHCP can't deal with a real mac address
$mac=$mac-replace'[:]'
$name = $($item."AP-Name")
write-host "netsh dhcp server $server scope $scope add reservedip $ip $mac $name"
}

I created an Excel sheet like this:

Notice that the first MAC address doesn't have colons. When I get an asset sheet from my office the MAC addresses don't have colons. The script removes colons if they are there.

Here is the output:

PS /Users/mhubbard/GoogleDrive/Test/configs> ./dhcp-csv.ps1 -server 192.168.10.221 -scope 10.112.105.0
netsh dhcp server 192.168.10.221 scope 10.112.105.0 add reservedip 10.112.105.100 a44c1138fa5b AP1
netsh dhcp server 192.168.10.221 scope 10.112.105.0 add reservedip 10.112.105.101 04d5900e779b AP2
netsh dhcp server 192.168.10.221 scope 10.112.105.0 add reservedip 10.112.105.102 b0faebdde8a6 AP3
netsh dhcp server 192.168.10.221 scope 10.112.105.0 add reservedip 10.112.105.103 a44c1138fa59 AP4
netsh dhcp server 192.168.10.221 scope 10.112.105.0 add reservedip 10.112.105.104 5057a86e4b49 AP5

I know that you could do the same thing in Python. But most customers are on Windows and Python isn't installed by default but PowerShell is. If you use PowerShell you can give the script to any Windows user and they can run it.

Note: Guido Von Rossum, the inventor of Python, now works at Microsoft! Maybe Python will be installed by default in the future.

Using Visual Studio Code to create PowerShell scripts

The PowerShell ISE isn't available on Linux/macOS but Microsoft has a plugin for Visual Studio Code. The link to how to install the plugin is in the references below.

This article gives some tips on writing PowerShell scripts that work on Windows/Mac/Linux

Tips for Writing Cross-Platform PowerShell Code

This blog was my motivation for learning some PowerShell

A Case Study in Attacking Keepass

I extended Matt's script to look at all mounted drives - Hard drives, USB flash drives, network shares. During testing, I mounted some old flash drives and laptop drives. I found 8 or 10 keepass databases that I had thought were lost forever

Reference

Installing PowerShell on macOS

Powershell Template Development

Using Visual Studio Code for PowerShell Development

read data from csv file using PowerShell and store each line data in an array

Manage Windows Firewall with PowerShell

Oh My Posh - Similar to Oh My ZSH for Powershell

You need to install Nerd Fonts to use POSH

PoSh-R2PowerShell - Rapid Response (PoSH-R2)... For the incident responder in you!

VMware PowerCLI

ESXi is the most popular Hypervisor in the enterprise. VMware has a module for PowerShell called PowerCLI. It exposes almost everything that you can do in VMware. I have used it to slipstream a RealTek network driver into the installer so that I could use a NUC like computer to run ESXi.

• Installing PowerCLI
• Getting Started with VMware PowerCLI – A Beginner’s Guide

Connecting to a vCenter server

Connect-VIServer -Server 10.23.112.235 -Protocol https -Username 'Adminis!ra!or' -Password 'pa$$word'

  

Pen Testing

Top Five Ways SpiderLabs Got Domain Admin on Your Internal Network
Scapy and Snort, Packet Peanut Butter and Jelly - Packet creation and SNORT sigs
So You Want to be a Hacker 2021 edition

0xSlaxo Blog - Various web hacking tutorials

Simple Penetration Testing Tutorial for Beginners! - A decent YouTube video on getting started.

Hacking Tools Cheat Sheet

a simple text based file format for creating binary files and data buffers. - A python tool that makes working with binary files easier.

SANS Articles

Finding the Clowns on the Syslog Carousel

Egress Filtering? What - do we have a bird problem? - Why you should block outbound ports

Who inherits your IP address? - Along these same lines, when you decommision a server that had rules on the firewall, make sure you delete the firewall rules. I have seen an internal server exposed to the Internet by mistake this way.

Who owns your typo?

Let's Trade: You Read My Email, I'll Read Your Password!

Administrator's Password Bad Practice

Books

These are all Kindle books. I like a good thick paperback book as much as the next IT guy but with Kindle books, I can carry my complete library with me on my iPhone, iPad, or laptop.

• The Hacker Playbook: Practical Guide To Penetration Testing Kindle Edition by Peter Kim  - This book is an absolute must-read if you want to understand how a Windows box gets hacked. I would go so far as to say it was an epiphany for me. The chapters on Social Engineering and Open Source Intelligence (OSINT) really opened my eyes. Peter has released The Hacker Playbook 2 and 3 now. I would still recommend the original if you are just starting out. It's available on Kindle for $15.
• The Linux Command Line Beginner's Guide Kindle Edition - Jonathan Moeller - A good introduction to the Linux command line.
• The Ubuntu Beginner's Guide - Seventh Edition Kindle Edition by Jonathan Moeller - A good introduction to Ubuntu.
• Nmap 6 Cookbook: The Fat-Free Guide to Network Security Scanning by Nicholas March - Nmap is the tool I use the most and this is a great reference to it. Nmap is up to version 7 but everything in this book is still useful.
• CEH v9: Certified Ethical Hacker Version 9 Study Guide - Sean Phillip Oriyano A really good read. I couldn't put it down and ended up buying the practice test book to go with it.
• Python: Learn Python in One Day and Learn It Well by Jamie Chan - Learning Python is mandatory for a security specialist or even an outstanding network engineer. This book is an easy-to-follow introduction to Python.
• Basic Security Testing with Kali Linux Third Edition - Daniel Dieterle. A really good introduction to Security Testing with Kali. 
• Wireshark Network Analysis (Second Edition): The Official Wireshark Certified Network Analyst Study Guide - A deep dive for Wireshark.

• Influence - Robert Cialdini. I have it on Audible. Great book on "Compliance Science". I know it sounds creepy but it will help your career for sure. The book was written as a text book so it is a bit of work to follow.
• Pre-Suasion - Robert Cialdini. I have it on Audible. The second edition of influence. This one is easier to follow than Influence.
• Social Engineering: The Science of Human Hacking - The great Chris Hadnagy's update to his classic book on social engineering.
• Learn MySQl in a Day - Jamie Chan. An easy-to-read book that will jump-start your MySQL learning.
• Automate the Boring Stuff with Python - Practical Programming for Beginners - Al Sweigart. 
•  SSH Mastery - Michael Lucas. A great book that explains everything about SSH. There is a lot more to SSH than putty!
• Building a Pentesting Lab for Wireless Networks
• Burp Suite Cookbook - Sunny Weart
• Kali Linux Web Penetration Testing Cookbook - Gilberto Nájera-Gutiérrez

Google Dorking

In The Hacker Playbook Peter covers Google Dorking in depth. If you haven't bought it yet here are a couple sites that will get you up to speed. The Google Dorking skills will make your searches much more productive. Recently, I scanned a website with a 
Google Dork - A tech target intro to syntax
Google Hacking Database (GHDB) - Huge database of Google Dork commands

Advanced Google Search Tricks - A very good article on Dorking

For example, if I want to search for PDF files but only on flowserve.com  I can enter

site:flowserve.com filetype:pdf

The results will be any PDF file that is on the flowserve.com

You can use just the site: or just the filetype: keyword depending on what you are searching for.

Security Related Web Sites

LogRythm has a great page with links to dozens of security resources - Top Cybersecurity Resources for Students and Professionals

1. Security Now Episodes by category
2. CVE Details - The ultimate Security vulerabilities
3. Cryptography Engineering - Matthew Green's Blog
4. Digital Shadows Blog
5. Down The Security Rabbit Hole podcast home page
6. Emergent Chaos - General IT security blog
7. Erratasec - Advanced persistent cybersecurity
8. Graham Cluley's blog - A Brit, but don't let that keep you away!
9. Journey into IR - Digital forensics and incident response
10. Kaspersky Lab Securelist
11. Malwarebytes Blog
12. Naked Security - The Sophos Blog
13. On the Wire podcast homepage
14. Risky Business - It's a jungle out there
15. SANS StormCast - InfoSec Podcasts. Great 5-6 minute daily podasts.
16. SANS InfoSec Diary Blog Archive  - A great resource for vulnerabilities
17. SSH Fingerprints Are Important - I got published here! See the last comment. You can see my username on my MAC - [mhubbard@1s1k-do .ssh] 
18. Security Ledger - IoT Focused Security
19. Symantec's Blog
20. TechNet JE Payne - An MS focused security blog
21. Trend Micro Security Intelligence blog
22. Tripwire's Blog
23. Troy Hunt's Home Page
24. Uncommon Sense Security blog - Jack Daniel's blog
25. Vectranetworks - Cyber security information center
26. Veracode's AppSec Blog

Privacy

I made this a separate category because most of the IT security websites and blogs focus on penetration testing and vulnerabilities. The sites in this list are focused on making you invisible or less visible on the Internet and protecting your privacy.

intel techniques - This is Michael Bazzell's site. He has a podcast on privacy that is very good. Michael and the host's/guests take it to a level that is way beyond what I need but I almost always learn something useful on each podcast.

Custom Linux builds for privacy - They did a podcast for privacy-focused Linux distros. They discuss Buscador along with other distros.

Your Ultimate Security Guide - Justin Carroll's website on privacy and security.

Troy Hunt's have I been pwned -  A site where you enter your email address and it checks to see if you are in any of the breaches that Troy tracks.

hacked emails - A site similar to Troy Hunt's "Have I been Pwned". It never hurts to have options when it comes to checking your email addresses for breaches.

Compromised Accounts for OSINT and Digital Security - One of Bazzell's blogs on email breaches.

GRC SSL Cert Fingerprints - More and more companies are using Man in the Middle (MiTM) appliances so that they can inspect TLS encrypted traffic. This site will display the finger print of the site's certificate and let's you determine if a MiTM appliance is in use.

sync.me - An app to detect spam calls. Also allows you to look up unknown numbers from calls and texts.

 Private Internet Access - A VPN provider. You should NEVER use the free WiFi at coffee shops or airports without a VPN. There are a lot of VPN providers now but a many of them are new and untested. PIA has been around for a while and has a good reputation for NOT keeping logs and accepting anonymous gift cards from Starbucks, Walmart, BestBuy and 100's of others for payment.

sudoapp.com - From the home page "Have up to 9 Sudo avatars for free. Each includes a custom phone number, email address, private browser and SudoPay virtual cards."

ESXi vSwitch Configuration for Cisco Cross Stack Etherchannel

There are a lot of examples of how to set up an ESXi vSwitch to work with Cisco Etherchannel available on the Internet. But I still get asked quite often how to do it so I decided to document how I do it.

References

Best Practices for Virtual Networking
Host requirements for link aggregation for ESXi and ESX (1001938)
Sample configuration of EtherChannel / Link Aggregation Control Protocol (LACP) with ESXi/ESX and Cisco/HP switches (1004048)
VMware KB: Understanding IP Hash load balancing

The Hardware

In this example there are two Dell servers running ESXi.

There are two Cisco 2960x switches with stacking modules but this example will work with most Cisco Catalyst switches that are configured as a stack. 

Server Connections

Each server has a four built in Gb interfaces and a four port add in Gb adapter. We will use one port from each adapter for VMware management and one port from each adapter for Guest traffic. You can easily scale the example to use all eight NICs.

Two ports for VM management

• Dell Built in port 1 (vmnic0)
• Dell Add on Port far Left (vmnic7)

vSwitch0 used for Management

vmk0, vlan 54

Click on Properties… and select vSwitch, Edit.

vSwitch0

Click the NIC Teaming tab

Set Load Balancing to "Route based on IP hash"

Set Network Failover Detection to "Link status only"

Set Notify Switches to "Yes"

Set Fallback to "Yes"

Make sure vnmic0 and vmnic7 are the Active Adapters. You may have to select and then use the "Move Up" button if one of them is in standby.

Click Ok and select the Management Network, Edit.

Select the NIC Teaming tab

Set Load Balancing to "Route based on IP hash"

Set Network Failover Detection to "Link status only"

Set Notify Switches to "Yes"

Set Fallback to "Yes"

Make sure vnmic0 and vmnic7 are the Active Adapters. You may have to select and then use the "Move Up" button if one of them is in standby. Click Ok.

Two Ports for Guest Traffic

• Dell Built in port 4 (vmnic3)
• Dell Add on port Far right (vmnic4)

vSwitch1 used for Guest traffic

vmk1, vlan 50

Click on Properties… and select vSwitch, Edit.

Select the NIC Teaming tab

Set Load Balancing to "Route based on IP hash"

Set Network Failover Detection to "Link status only"

Set Notify Switches to "Yes"

Set Fallback to "Yes"

Make sure vnmic3 and vmnic4 are the Active Adapters. You may have to select and then use the "Move Up" button if one of them is in standby.

Click Ok and select the Management Network, Edit.

Select the NIC Teaming tab

Set Load Balancing to "Route based on IP hash"

Set Network Failover Detection to "Link status only"

Set Notify Switches to "Yes"

Set Fallback to "Yes"

Make sure vnmic3 and vmnic4 are the Active Adapters. You may have to select and then use the "Move Up" button if one of them is in standby.

Here's a look at the physical network adapters

That's it for the server. 

Cisco Switch Configuration

From VMware KB 1001938
The switch must be set to perform 802.3ad link aggregation in static mode ON and the virtual switch must have its load balancing method set to Route based on IP hash.
Ensure that the participating NICs are connected to the ports configured on the same physical switch or stacked switch.

If this is a new deployment you can configure the switch to use src-dst-ip for Etherchannel and connect the ESXi servers.

But if you are adding ESXi servers to an existing switch that already has Etherchannels defined you should check the current port-channel load balancing mode before making any changes (and make a backup of the current switch configuration).

Use Show Etherchannel load-balance to see the current setting. For a 2960x the default is src-mac.

TEST#sh etherchannel load-balance
EtherChannel Load-Balancing Configuration:
        src-mac

EtherChannel Load-Balancing Addresses Used Per-Protocol:
Non-IP: Source MAC address
  IPv4: Source MAC address
  IPv6: Source MAC address

You can see that the default uses the Source MAC address instead the IP address. I haven't had any problems connecting a 2960x to a 4507R+E using Etherchannel after making the change but you should be aware of what is in use before making a change.

In global configuration mode:

port-channel load-balance src-dst-ip

This sets the Etherchannel load balancing to match the ESXi vSwitch mode.

In the interface configuration we will add:

channel-group X mode on

On is used instead of Active because VMware doesn’t support negotiation. 

Switch configurations

port-channel load-balance src-dst-ip

interface Port-channel1

 description < Uplink to Core >

 switchport mode trunk

no shut

!

interface Port-channel2

 description < ESX02 management >

 switchport trunk allowed vlan 54

 switchport mode trunk

no shut

!

interface Port-channel3

 description < ESX02 VM >

 switchport mode trunk

no shut

!

interface Port-channel4

 description < ESX01 management>

 switchport trunk allowed vlan 54

 switchport mode trunk

 no shut

!

interface Port-channel5

 description < ESX01 VM >

switchport mode trunk

no shut

!

interface GigabitEthernet1/0/45

 description < ESX01-MG1 >

 switchport trunk allowed vlan 54

 switchport mode trunk

 channel-group 4 mode on

!

interface GigabitEthernet1/0/46

 description < ESX01-VM1 >

 switchport trunk allowed vlan 50

 switchport mode trunk

 channel-group 5 mode on

!

interface GigabitEthernet1/0/47

 description < ESX02-MG1 >

 switchport trunk allowed vlan 54

 switchport mode trunk

 channel-group 2 mode on

!

interface GigabitEthernet1/0/48

 description < ESX02-VM1 >

 switchport trunk allowed vlan 50

 switchport mode trunk

 channel-group 3 mode on

!

interface GigabitEthernet2/0/45

 description <  ESX01-MG2 >

 switchport trunk allowed vlan 54

 switchport mode trunk

 channel-group 4 mode on

!

interface GigabitEthernet2/0/46

 description < ESX01-VM2 >

 switchport trunk allowed vlan 50

 switchport mode trunk

 channel-group 5 mode on

!

interface GigabitEthernet2/0/47

 description <  ESX02-MG2 >

 switchport trunk allowed vlan 54

 switchport mode trunk

 channel-group 2 mode on

!

interface GigabitEthernet2/0/48

 description < ESX02-VM2 >

 switchport trunk allowed vlan 50

 switchport mode trunk

 channel-group 3 mode on

!

Show commands

• Show Etherchannel Sum – Shows status of the port channel and each port
• Show Etherchannel load-balance – Shows load balance mode. Should be src-dst-ip.
• Show Etherchannel detail – Shows detailed information about the port channel.

Show Etherchannel Sum

TEST#Show Etherchannel Sum

Flags:  D – down P - bundled in port-channel

I - stand-alone s - suspended

H - Hot-standby (LACP only)

R - Layer3      S - Layer2

U - in use      f - failed to allocate aggregator

M - not in use, minimum links not met

u - unsuitable for bundling

w - waiting to be aggregated

d - default port

Number of channel-groups in use: 5

Number of aggregators:           5

| Group | Port-channel | Protocol | Ports                   |

|:-----: |:------------: |:--------: |------------------------- |

|   1   |    Po1(SU)   |   LACP   | Te1/0/1(P)  Te2/0/1(P)   |

|   2   |    Po2(SU)   |     -     | Gi1/0/47(P) Gi2/0/47(P) |

|   3   |    Po3(SU)   |     -     | Gi1/0/48(P) Gi2/0/48(P) |

|   4   |    Po4(SU)   |     -     | Gi1/0/45(P) Gi2/0/45(P) |

|   5   |    Po5(SU)   |     -     | Gi1/0/46(P) Gi2/0/46(P) |

Show Etherchannel load-balance

TEST#Show Etherchannel load-balance

EtherChannel Load-Balancing Configuration:

        src-dst-ip

EtherChannel Load-Balancing Addresses Used Per-Protocol:

Non-IP: Source XOR Destination MAC address

  IPv4: Source XOR Destination IP address

  IPv6: Source XOR Destination IP address

Test the load balancing 

test etherchannel load-balance interface port-channel 3 <source IP> <dest IP>

TEST#test etherchannel load-balance interface port-channel 3 ip 10.26.50.100 10.26.50.101

Would select Gi1/0/48 of Po3

TEST#

TEST#test etherchannel load-balance interface port-channel 3 ip 10.26.50.100 10.26.54.102

Would select Gi2/0/47 of Po3

TEST#

Trouble Shooting

The reference link "IP Hash Load Balancing" lists the following under "Disadvantages" of using Port-channels:

Beacon probing is not supported with IP Hash. Only link status can be used as a failure detection method. If a link fails without the link state going down, there is no way to avoid network communication issues on the vSwitch.

This is a serious problem if one of the links is UP but the protocol is down. Symptoms are some servers are reachable and some aren't. The first time you run into this it can be a challenge to figure out, especially if you are remote and depending on someone on site to give you information. Keep this in the back of your mind.