Just recently i was looking at some alternative partition cloning software to the one i frequently use, driveimagexml. Not that their was anything wrong with DriveImageXML, i just was looking for a linux alterative. Little did i know, built into backtrack 4 was a piece of software called partimage which would accomplish pretty much what i would want. As in my recent posts on dd, one disadvantage to dd is that it backs up an entire partition, not just the used space. So if you have a 10 gig partition and only 2 gigs is used up, dd would produce a 10 gig exact copy of the partition. Partimage however only backs up the used portion of the partition saving you time and space.
To launch/use partimage:
# partimage
This launches an n-curses based user interface which is far from complicated and the options doesn't really need much explanation
For more info on its usage, see www.psychocats.net/ubuntu/partimage or www.partimage.org
Monday, April 12, 2010
Sunday, April 11, 2010
Hexedit a hard disk
I'm gonna be simply changing a flag within the boot sector that identifies the system (or boot) partition. This will serve as the basic principles behind doing low level hard disk analysis and editing, typically common withing digital forensics.
The boot sector is the first 512 bytes on a hard disk (446 bytes for bootloader code, 64 bytes for partition table, and the last two bytes in the sector are a signature word for the sector and are always hex 55 AA). The partition table contains the entries for the primary and extended partitions and each entry is 16 bytes long, giving a maximum of 4 entries available.
First we identify the partition table.
# xxd -l 64 -s +446 /dev/sdb // jumps to the offset at byte position 446 and displays the next 64 bytes which will be the partition table
Now according to the partition table field the first byte( of the 16 byte per entry) represents the boot indicator field. When the BIOS passes control to the boot sector, the code withing the fist 446 bytes looks at the partition table and identifies the boot/system partition (Legal values are hex value 80 or 00: 00 = Do not use for booting, 80 = System partition). We are gonna change this system partiton flag to 00. This will see the partition as unbootable.
So the MBR is 446 bytes in length(offset 0-445). The next 64 bytes represents the partition table consisting of a possible 4 entries (16 bytes x 4). The first byte of each entry indicates whether its the system partition or not. If their was only one partiton then the bytes 446 - 462 would contain values, whilst the rest of the entries would be all zero's.
To change the first partition entry system id field, we want to put the value of hexadecimal 00 at offset 446 bytes. First we create a simple text file with only the value of 00 in it. Then we use the 'xxd' program to convert this simple text file into a binay file containing only the hex value of 00.
# echo "00" | xxd -ps -r > byte.bin
Now to get that byte written into offset 446 you use the 'dd' program.
# dd if=byte.bin of=/dev/sdb seek=446 bs=1 count=1// reads and writes 1byte , 1 time, from byte.bin file at offest 446 into the block device /dev/sdb
To do this all in one command, we can make use of pipes:
# echo "00" | xxd -ps -r | dd of=/dev/sdb seek=446 bs=1 count=1
References/Good reading:
http://www.ntfs.com/partition-table.htm
http://www.linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/
The boot sector is the first 512 bytes on a hard disk (446 bytes for bootloader code, 64 bytes for partition table, and the last two bytes in the sector are a signature word for the sector and are always hex 55 AA). The partition table contains the entries for the primary and extended partitions and each entry is 16 bytes long, giving a maximum of 4 entries available.
The following table describes each entry in the Partition Table. The sample values correspond to the information for partition 1.(taken from http://www.ntfs.com/partition-table.htm)
Partition Table Fields
Byte Offset | Field Length | Sample Value | Meaning |
|---|---|---|---|
00 | BYTE | 0x80 | Boot Indicator. Indicates whether the partition is the system partition. Legal values are: |
01 | BYTE | 0x01 | |
02 | 6 bits | 0x01 | Starting Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the Starting Cylinder field. |
03 | 10 bits | 0x00 | Starting Cylinder. This field contains the lower 8 bits of the cylinder value. Starting cylinder is thus a 10-bit number, with a maximum value of 1023. |
04 | BYTE | 0x06 | System ID. This byte defines the volume type. In Windows NT, it also indicates that a partition is part of a volume that requires the use of the HKEY_LOCAL_MACHINE\SYSTEM\DISK Registry subkey. |
05 | BYTE | 0x0F | |
06 | 6 bits | 0x3F | Ending Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the Ending Cylinder field. |
07 | 10 bits | 0x196 | Ending Cylinder. This field contains the lower 8 bits of the cylinder value. Ending cylinder is thus a 10-bit number, with a maximum value of 1023. |
08 | DWORD | 3F 00 00 00 | |
12 | DWORD | 51 42 06 00 |
First we identify the partition table.
# xxd -l 64 -s +446 /dev/sdb // jumps to the offset at byte position 446 and displays the next 64 bytes which will be the partition table
Now according to the partition table field the first byte( of the 16 byte per entry) represents the boot indicator field. When the BIOS passes control to the boot sector, the code withing the fist 446 bytes looks at the partition table and identifies the boot/system partition (Legal values are hex value 80 or 00: 00 = Do not use for booting, 80 = System partition). We are gonna change this system partiton flag to 00. This will see the partition as unbootable.
So the MBR is 446 bytes in length(offset 0-445). The next 64 bytes represents the partition table consisting of a possible 4 entries (16 bytes x 4). The first byte of each entry indicates whether its the system partition or not. If their was only one partiton then the bytes 446 - 462 would contain values, whilst the rest of the entries would be all zero's.
To change the first partition entry system id field, we want to put the value of hexadecimal 00 at offset 446 bytes. First we create a simple text file with only the value of 00 in it. Then we use the 'xxd' program to convert this simple text file into a binay file containing only the hex value of 00.
# echo "00" | xxd -ps -r > byte.bin
Now to get that byte written into offset 446 you use the 'dd' program.
# dd if=byte.bin of=/dev/sdb seek=446 bs=1 count=1// reads and writes 1byte , 1 time, from byte.bin file at offest 446 into the block device /dev/sdb
To do this all in one command, we can make use of pipes:
# echo "00" | xxd -ps -r | dd of=/dev/sdb seek=446 bs=1 count=1
References/Good reading:
http://www.ntfs.com/partition-table.htm
http://www.linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/
Thursday, April 8, 2010
Using 'dd' or 'dcfldd'for disk imaging and backup
DD is a very ancient unix utility that still has its superiority in the disk imaging and cloning categories of tools. Being command lined based, it reads from standard input and write to its standard output which allows you to use 'pipes' for advanced processing and remote networking capabilities.
DCFLDD is an enhanced version of dd and follows the same structure when passing arguments, i.e, keyword=value format. The commands are almost identical so you can pretty much use the same commands that you use in dd with dcfldd but not necessarily the other way around as the later has some enhancements that dd does not have. Some of dcfldd enhancements include
Using dd you can create backups of an entire harddisks or just parts of it.
Hard disk copy/Back up::
# dd if=/dev/sda of=/dev/sdb
# dd if=/dev/sda of=/path/to/image
# dd if=/dev/sda | gzip > /path/to/image.gz //makes image of sda disk and pipes it to the gzip program for compression of the backup image file image.gz
Restore Backup
# dd if=/path/to/image of=/dev/sda
# gzip -dc /path/to/image.gz | dd of=/dev/sda
MBR Backup
# dd if=/dev/sda of=/path/to/mbr/image count=1 bs=512
MBR Restore
# dd if=/path/to/mbr/image of=/dev/sda
add "count=1 bs=446" to exclude the partiton table
More Advance commands
# dcfldd if=/dev/sda of=/path/to/image bs=4096 conv=notrunc,noerror //
make an iso image of CD
# dcfldd if=/dev/cd of=/home/mycd.iso bs=2048 conv=notrunc // CD sectors are 2048 bytes so this copies sector to sector. The result will be a hard disk image file of the CD. You can use "chmod a+rwx mycd.iso" to make the image writable.
make an iso image of Hard disk
# dcfldd if=/dev/hda of=/home/disk.iso bs=4096 conv=notrunc,noerror
To mount the image: # mount -o loop /path/to/image /mnt/mountpoint
In some cases, you would not be able to mount the image file. What you need to do is determine the offset of the sector (not the cyclinder). You can get the cylinder offests using fdisk.
First, associate one of the loop interfaces with the image file # losetup /dev/loop0 /path/to/image
Then
# fdisk -l /dev/loop0
What we really want is the offset of the sector so we add the '-u' flag to fdisk
# fdisk -ul /dev/loop0
We then take the start of the partition that you want to edit 44 in this case and multiply it by 512 ie 512*44=22528
then mount like this: # mount -o loop,offset=22528 /dev/loop0 /mnt/mountpoint
DCFLDD is an enhanced version of dd and follows the same structure when passing arguments, i.e, keyword=value format. The commands are almost identical so you can pretty much use the same commands that you use in dd with dcfldd but not necessarily the other way around as the later has some enhancements that dd does not have. Some of dcfldd enhancements include
- Hashing on-the-fly - dcfldd can hash the input data as it is being transferred, helping to ensure data integrity.
- Status output - dcfldd can update the user of its progress in terms of the amount of data transferred and how much longer operation will take.
- Flexible disk wipes - dcfldd can be used to wipe disks quickly and with a known pattern if desired.
- Image/wipe Verify - dcfldd can verify that a target drive is a bit-for-bit match of the specified input file or pattern.
- Multiple outputs - dcfldd can output to multiple files or disks at the same time.
- Split output - dcfldd can split output to multiple files with more configurability than the split command.
- Piped output and logs - dcfldd can send all its log data and output to commands as well as files natively.
Using dd you can create backups of an entire harddisks or just parts of it.
Hard disk copy/Back up::
# dd if=/dev/sda of=/dev/sdb
# dd if=/dev/sda of=/path/to/image
# dd if=/dev/sda | gzip > /path/to/image.gz //makes image of sda disk and pipes it to the gzip program for compression of the backup image file image.gz
Restore Backup
# dd if=/path/to/image of=/dev/sda
# gzip -dc /path/to/image.gz | dd of=/dev/sda
MBR Backup
# dd if=/dev/sda of=/path/to/mbr/image count=1 bs=512
MBR Restore
# dd if=/path/to/mbr/image of=/dev/sda
add "count=1 bs=446" to exclude the partiton table
More Advance commands
# dcfldd if=/dev/sda of=/path/to/image bs=4096 conv=notrunc,noerror //
make an iso image of CD
# dcfldd if=/dev/cd of=/home/mycd.iso bs=2048 conv=notrunc // CD sectors are 2048 bytes so this copies sector to sector. The result will be a hard disk image file of the CD. You can use "chmod a+rwx mycd.iso" to make the image writable.
make an iso image of Hard disk
# dcfldd if=/dev/hda of=/home/disk.iso bs=4096 conv=notrunc,noerror
To mount the image: # mount -o loop /path/to/image /mnt/mountpoint
In some cases, you would not be able to mount the image file. What you need to do is determine the offset of the sector (not the cyclinder). You can get the cylinder offests using fdisk.
First, associate one of the loop interfaces with the image file # losetup /dev/loop0 /path/to/image
Then
# fdisk -l /dev/loop0
Disk /dev/sdb: 8036 MB, 8036285952 bytes
255 heads, 63 sectors/track, 977 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sdb1 * 1 976 7839698 b W95 FAT32
What we really want is the offset of the sector so we add the '-u' flag to fdisk
# fdisk -ul /dev/loop0
Disk /dev/sdb: 8036 MB, 8036285952 bytes
255 heads, 63 sectors/track, 977 cylinders, total 15695871 sectors
Units = sectors of 1 * 512 = 512 bytes
Disk identifier: 0x00000000
Device Boot Start End Blocks Id System
/dev/sdb1 * 44 15679439 7839698 b W95 FAT32
We then take the start of the partition that you want to edit 44 in this case and multiply it by 512 ie 512*44=22528
then mount like this: # mount -o loop,offset=22528 /dev/loop0 /mnt/mountpoint
Thursday, March 25, 2010
Getting started with openssl
According to its manpage, it is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security network protocols and related cryptography standards required by them. It is indeed a command line tool and allows you to create RSA and DSA keys, x.509 certificates, calculation of message digests, encryption and decryption of files with optional ciphers, etc. As there are so many ways to use this tool, i will show some of its basic usages that one may find useful.
# openssl -h // for command switches
# man openssl //Documentation of the tool
# openssl list-standard-commands // list standard commands. Doesn't say what they do so you are better off using "man openssl"
# openssl list-cipher-commands //list different symmetric ciphers you can use for encrytpion
# openssl list-message-digest-commands //lists different hashing algorithms you can use for data integrity checking
# echo "password" | openssl md5 //creates the md5 hash for the string password
# echo "password" | openssl enc -md5 //does the same thing as previous example
# openssl bf -in myfile.txt -out myfile.txt.enc //encrypts the file "myfile.txt" using the blowfish cipher 'bf' to a new file 'myfile.txt.enc'. You can now delete the old file
# openssl enc -bf -in myfile.txt -out myfile.txt.enc //encrypts the file "myfile.txt" using the blowfish cipher 'bf' to a new file 'myfile.txt.enc'. Equivallent to the above command.
# openssl enc -bf -d -in myfile.txt.enc -out myfile.txt //decrypts the file "myfile.txt.enc" using the blowfish cipher 'bf' and outputs the decrypted file to a new filename 'myfile.txt'.
Using Public Key Cryptography
# openssl genrsa -out private.key //Generates private key
# openssl rsa -pubout -in private.key -out public.key //generates public key from the private key
# openssl rsautl -encrypt -inkey public.key -pubin -in test.txt -out test.txt.pub //encrypt a file with public key. Note that you are limited to small file sizes
# openssl rsautl -decrypt -inkey private.key -in test.txt.pub -out test.txt //decrypts the file with the private key
# openssl -h // for command switches
# man openssl //Documentation of the tool
# openssl list-standard-commands // list standard commands. Doesn't say what they do so you are better off using "man openssl"
# openssl list-cipher-commands //list different symmetric ciphers you can use for encrytpion
# openssl list-message-digest-commands //lists different hashing algorithms you can use for data integrity checking
# echo "password" | openssl md5 //creates the md5 hash for the string password
# echo "password" | openssl enc -md5 //does the same thing as previous example
# openssl bf -in myfile.txt -out myfile.txt.enc //encrypts the file "myfile.txt" using the blowfish cipher 'bf' to a new file 'myfile.txt.enc'. You can now delete the old file
# openssl enc -bf -in myfile.txt -out myfile.txt.enc //encrypts the file "myfile.txt" using the blowfish cipher 'bf' to a new file 'myfile.txt.enc'. Equivallent to the above command.
# openssl enc -bf -d -in myfile.txt.enc -out myfile.txt //decrypts the file "myfile.txt.enc" using the blowfish cipher 'bf' and outputs the decrypted file to a new filename 'myfile.txt'.
Using Public Key Cryptography
# openssl genrsa -out private.key //Generates private key
# openssl rsa -pubout -in private.key -out public.key //generates public key from the private key
# openssl rsautl -encrypt -inkey public.key -pubin -in test.txt -out test.txt.pub //encrypt a file with public key. Note that you are limited to small file sizes
# openssl rsautl -decrypt -inkey private.key -in test.txt.pub -out test.txt //decrypts the file with the private key
Monday, March 22, 2010
Using Metasploit for OS fingerprinting
Metasploit is primarilly a framework for developing and testing exploits. It comes with a suite of supporting tools that aid in exploit development, including port scanners. We can use one of these scanners to scan for open ports and fingerprint Windows services as well as the OS type. Using the following commands we can quickly fingerprint the SMB port of 445 to determine the OS version.
# ./msfconsole //launches the framework
msf> use auxiliary/scanner/portscan/syn
msf auxiliary(syn)>show options
set the necessary options, using port 445 as the port
msf auxiliary(smb version)>run
[*] TCP OPEN 192.168.1.61:445
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Then based on your results, if port 445 is open on the host, use
msf> use auxiliary/scanner/smb/smb_version
msf auxiliary(smb version)>show options
set the rhosts option then run the auxiliary module:
msf auxiliary(smb version)>run
[*] 192.168.1.61 is runnnin Windows XP Service Pack 3(Language: English) (name:PC1) (domain:PC1)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
As you can see, withing a few simple metasploit commands you can determine the OS type of a remote system. This however uses the SMB port of 445 and is a requirement for this experiment. Then are other ways to determine this information but this is one of the most reliable methods.
# ./msfconsole //launches the framework
msf> use auxiliary/scanner/portscan/syn
msf auxiliary(syn)>show options
set the necessary options, using port 445 as the port
msf auxiliary(smb version)>run
[*] TCP OPEN 192.168.1.61:445
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
Then based on your results, if port 445 is open on the host, use
msf> use auxiliary/scanner/smb/smb_version
msf auxiliary(smb version)>show options
set the rhosts option then run the auxiliary module:
msf auxiliary(smb version)>run
[*] 192.168.1.61 is runnnin Windows XP Service Pack 3(Language: English) (name:PC1) (domain:PC1)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
As you can see, withing a few simple metasploit commands you can determine the OS type of a remote system. This however uses the SMB port of 445 and is a requirement for this experiment. Then are other ways to determine this information but this is one of the most reliable methods.
Thursday, March 18, 2010
Physical access == priveledge escalation pt 2
Quick notes:
- Load up any linix OS
- Mount the windows drive in a rw state: "mount -t ntfs-3g /dev/sda1 /mnt/sda1"
- Navigate to the Windows/System32 folder: "cd /mnt/sda1/Windows/System32"
- Rename sethc.exe : "mv sethc.exe sethc.bak"
- Copy cmd.exe to the name of sethc.exe: "cp cmd.exe sethc.exe"
- Sync the changes and flush buffers, Optional but safe: "Sync"
- Reboot Comp: "reboot"
- When on the logon screen hit the shift key 5 times and you should be presented with a command prompt with system priviledges. From here on you might wanna create a new user and add him to the administrators group
References/Good Reading:
Pentestit
Tuesday, March 9, 2010
Turning your laptop into a wireless AP
I'm just gonna go over some simple code and tools that you can use to transform your laptop running linux into a wireless access point where wireless clients can connect to. The programs that i will be using are airmon-ng, airbase-ng, dhcpd-server and dnsmasq just to name a few. Other utilities will be used in my example here but they are mostly complementary tools that may not be deemed necessary.
First we create a virual interface using airmon-ng
#airmon-ng start wlan0 //this uses the wireless card as a prototype so to speak to create a virutal interface (mon0) that can operate in what is known as monitor mode
We then will put our new virtual interface down so we can change our mac address to something other than the original address.
# ifconfig mon0 down //pull interface down
# macchanger -m 00:00:F0:0D:00:00 mon0 //changes the mac address originally at mon0
# ifconfig mon0 up //brings the interface back up
We then will use the airbase-ng program to create yet another virtual interface that would have the ability to act as an AP. This interface operates in what is known as Master mode, where it has the ability to act as a synchronisation master for clients. I usually would use the xterm command to create a new window to execute the airbase-ng program as its output can be very useful as it will show the current clients attempting to authenticate and associate with your machine.
# xterm -bg red -bd blue -fg white -hold -geometry 96x25+0+0 -e airbase-ng -e "GoodAP" -c 6 -v mon0 & //uses mon0 interface to create a new virutual interface (at0 by default). Xterm allows the output of the airebase-ng command to be displayed in a new x-based window. Airbase-ng '-e' gives the ssid name, '-c' gives the channel number to broadcast on and -v is for more verbose output.
A new virtual interface is now available, at0. This is the interface thats gonna respond to wireless client probe requests. At this stage it needs to be configured and given and ip address.
# ifconfig at0 10.0.0.1 netmask 255.255.255.0 up
# ifconfig at0 mtu 1400
Our access point with the name "GoodAP" should now be broadcasting and clients would be able see it. However we are not complete in setting up our AP. Our clients need to be able to get a IP address via dhcp server and be able to resolve dns requests via a dnsserver. You would need a dhcp.conf config file. You can find many examples on the web of simple configs.
[dhcpd.conf]
authoritative;
option domain-name-servers 10.0.0.1;
default-lease-time 360;
max-lease-time 720;
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.2 10.0.0.5;
option subnet-mask 255.255.255.0;
option routers 10.0.0.1;
option broadcast-address 10.0.0.255;
option domain-name-servers 10.0.0.1;
}
touch /var/run/dhcpd.pid
First we create a virual interface using airmon-ng
#airmon-ng start wlan0 //this uses the wireless card as a prototype so to speak to create a virutal interface (mon0) that can operate in what is known as monitor mode
We then will put our new virtual interface down so we can change our mac address to something other than the original address.
# ifconfig mon0 down //pull interface down
# macchanger -m 00:00:F0:0D:00:00 mon0 //changes the mac address originally at mon0
# ifconfig mon0 up //brings the interface back up
We then will use the airbase-ng program to create yet another virtual interface that would have the ability to act as an AP. This interface operates in what is known as Master mode, where it has the ability to act as a synchronisation master for clients. I usually would use the xterm command to create a new window to execute the airbase-ng program as its output can be very useful as it will show the current clients attempting to authenticate and associate with your machine.
# xterm -bg red -bd blue -fg white -hold -geometry 96x25+0+0 -e airbase-ng -e "GoodAP" -c 6 -v mon0 & //uses mon0 interface to create a new virutual interface (at0 by default). Xterm allows the output of the airebase-ng command to be displayed in a new x-based window. Airbase-ng '-e' gives the ssid name, '-c' gives the channel number to broadcast on and -v is for more verbose output.
A new virtual interface is now available, at0. This is the interface thats gonna respond to wireless client probe requests. At this stage it needs to be configured and given and ip address.
# ifconfig at0 10.0.0.1 netmask 255.255.255.0 up
# ifconfig at0 mtu 1400
Our access point with the name "GoodAP" should now be broadcasting and clients would be able see it. However we are not complete in setting up our AP. Our clients need to be able to get a IP address via dhcp server and be able to resolve dns requests via a dnsserver. You would need a dhcp.conf config file. You can find many examples on the web of simple configs.
[dhcpd.conf]
authoritative;
option domain-name-servers 10.0.0.1;
default-lease-time 360;
max-lease-time 720;
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.2 10.0.0.5;
option subnet-mask 255.255.255.0;
option routers 10.0.0.1;
option broadcast-address 10.0.0.255;
option domain-name-servers 10.0.0.1;
}
Issuing the next two commands will take care of some permission issues when running the dhcpd server. Dhcpd server is run under the dhcpd user account, which do not have write permissions for the directory /var/run. To overcome this issue, simple do the following:
touch /var/run/dhcpd.pid
chown dhcpd:dhcpd /var/run/dhcpd.pid
By issuing the above, you are now giving the server permissions to have the relevant access to its PID file that it attempts to create and write to.
Also
# chown dhcpd {dhcpd.conf,dhcpd.leases}
# chgrp dhcpd {dhcpd.conf,dhcpd.leases}
Remember, you may have to do the same for the parent folder as well from which the script or command is being ran
# chgrp dhcpd {dhcpd.conf,dhcpd.leases}
Remember, you may have to do the same for the parent folder as well from which the script or command is being ran
Start the dhcpd service:
# dhcpd3 -cf dhcpd.conf -lf dhcpd.leases -f at0
Note: You may get some errors relating to permissions and writing to the lease file. Simply change the user and group ownership of your leases file. You may also have to change the permissions of the directory as well. I made a directory specifically for my config and lease files and had to change the ownership permissions to the file and directory for everything to work fine.
# dhcpd3 -cf dhcpd.conf -lf dhcpd.leases -f at0
Note: You may get some errors relating to permissions and writing to the lease file. Simply change the user and group ownership of your leases file. You may also have to change the permissions of the directory as well. I made a directory specifically for my config and lease files and had to change the ownership permissions to the file and directory for everything to work fine.
Since the dhcpd.conf file sets the clients up to use our ip as the DNS server, we can set up a simple DNS server to handle the requests. I used dnsmasq (apt-get install dnsmasq). It works straight off a fresh install with no configuration. It uses the its local/etc/resolv.conf to forward the requests to. So basically, it listens on port 53 and forwards the request to the servers listed in /etc/resolve.conf. It may also cache these lookups as well.
Start the simple dns cacheing server.
# dnsmasq restart
You would need to set your kernel to forward mode to forward all packets not destined for it
# echo 1 > /proc/sys/net/ipv4/ip_forward
The last thing we really need to do here is to set IP masqerading. It allows the synchronization between two networks with different IP address, like a NAT router.
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
With this setup, airbase-ng will set up the AP interface for you, its your duty to start the necessary dhcp and dns servers to automate client setups. Forwarding withing the kernel is crucial so the clients wont be succeptable to denial of service by the kernel and an all important ip masquerade command for synchronization between the wireless nic and ethernet nic on the laptop.
The above is a basic overview of how this is done and may require an above average understanding of linux and servers. These are the basic commands that should get you up and going, although on your machine, there may be some things that need tweaking. Remember, everymachine is different and what might work for me may not work for you without little modifications on your system. Its very important to know what you are doing and what to expect from these tools as this knowledge would prove to be very valuable when you have to troubleshoot problems.
# dnsmasq restart
You would need to set your kernel to forward mode to forward all packets not destined for it
# echo 1 > /proc/sys/net/ipv4/ip_forward
The last thing we really need to do here is to set IP masqerading. It allows the synchronization between two networks with different IP address, like a NAT router.
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
With this setup, airbase-ng will set up the AP interface for you, its your duty to start the necessary dhcp and dns servers to automate client setups. Forwarding withing the kernel is crucial so the clients wont be succeptable to denial of service by the kernel and an all important ip masquerade command for synchronization between the wireless nic and ethernet nic on the laptop.
The above is a basic overview of how this is done and may require an above average understanding of linux and servers. These are the basic commands that should get you up and going, although on your machine, there may be some things that need tweaking. Remember, everymachine is different and what might work for me may not work for you without little modifications on your system. Its very important to know what you are doing and what to expect from these tools as this knowledge would prove to be very valuable when you have to troubleshoot problems.
Subscribe to:
Posts (Atom)