Dyndns client (ddclient) for linux

Ddclient is a small piece of software that you install to your computer that updates your dyndns account with your current IP address. If your external IP address changes, this program will automatically notify dyndns.com of the change and update your account information seamlessly.

To install: # apt-get install ddclient

After you install it and provide the relevant information on setup, you will want to verify and or modify the config file (/etc/ddclient.conf)

This is what mines look like

# Configuration file for ddclient
#
# /etc/ddclient.conf

daemon=300 # check every 300 seconds
syslog=yes # log update msgs to syslog
pid=/var/run/ddclient.pid
ssl=yes
protocol=dyndns2
### Select one of these options to determine your IP address
## via hardware interface (if you don't have a router/firewall)

## For local IPs. You probly wouldn' have any use for this unless your computer was connected directly to the modem.
#use=if, if=eth0
## via our CheckIP server. This is a good choice that i use
use=web, web=checkip.dyndns.com/, web-skip='Current IP Address: '

## from the status page for a linksys router/firewall

#use=linksys, fw=linksys, fw-login=admin, fw-p

## settings for DynDNS account holders
################################################################
server=members.dyndns.org
protocol=dyndns2
login=[login]
password=[password]
yourdns.dyndns.org

## settings for OpenDNS account holders
######################################################
#server=updates.opendns.com
#protocol=dyndns2
#login=[login]
#password=[password]
#yourdns.opendns.com

You may also need to verify one setting in the /etc/defaults/ddclient file. You would want to confirm that "run_daemon=true" is set.

After you made all changes, restart the daemon: # /etc/init.d/ddclient restart The service will start on system boot and continue to run in the background.

# /etc/init.d/ddclient status

Status of Dynamic DNS service update utility: ddclient is running

Every few minutes (configurable) the service will check to see if there is a change in your external IP address and if there is, it will send that updated information to your dyndns service provider using your already provided account credentials.

You would then want to log into your dynamic DNS service provider account and verify that your external IP now is up to date.

[update]
I've ran into an issue where one of my ddclients refused to update my dyndns account. I ran it in debug mode like so:
# sudo ddclient -debug -login=username -password='pass' -noquiet -verbose

The ouput of the command was impying that my ip address hasn't changed so it was skipping the update process. However when i log into my dyndns account, my ip address was different. This is because im running the ddclient on a netbook that i take everywhere and when its connected to the internet, it updates that record. The reason that my other machine was not update my dyndns account is becasue of a cache file that was stored. By removing this cache file, it fixed my problem.

# sudo rm /var/cache/ddclient/ddclient.cache

Simple asterisk setup

Asterisk is an open source telephony system or PBX (private brach exchange). What this means is that you can setup your own telephony system at home, where you can call phones internal (like dialing extensions in a business) and also make outgoing calls to the outside world. The system can interface with almost any type of telephony hardware and can speak many communication protocols.

Below is a quick list of commands and configs that i've used to install asterisk and connect two softphones to the system.

Tested on Backtrack 4 (Will be installing on a Ubuntu 10.04 later).

Get the dependecies asterisk may require:

# apt-get -y install build-essential libncurses5-dev libcurl3-dev libvorbis-dev libspeex-dev unixodbc unixodbc-dev libiksemel-dev linux- headers-`uname -r`

Then insall asterisk:

# cd /usr/src

# wget http://downloads.digium.com/pub/asterisk/asterisk-1.4-current.tar.gz

# tar -zxvf asterisk-1.4-current.tar.gz

# cd asterisk-1.4-current

# ./configure && make && make install && make samples

Then we can configure our sip.conf, and extensions.conf as follows

##### sip.conf #####

[general]

port = 5060

bindaddr = 0.0.0.0

context = default

[100]

type=friend

context=incoming-calls

secret=100

host=dynamic

[101]

type=friend

context=my-phones

secret=101

host=dynamic

################

##### extensions.conf #####

[others]

[incoming-calls]

exten => 100,1,Dial(SIP/100,10)

exten => 101,1,Dial(SIP/100,10)

################

You will have to configure your softphones to match the settings in the sip.conf file

References / Good Reading:

http://www.the-asterisk-book.com/unstable/minimale-telefonanlage.html

Network Booting a linux machine (PXE)

What exactly is this that i speak of? Think of booting up a machine with no hard-disk or cd drive. Of course you can do this with USB but if you have 5 diskless and cd driveless machines, that would mean you would need 5 unique USB drives to boot us a live linux OS. However, with network booting you can boot such diskless machines from one central server. This means administration is reduced to one central machine that all machines can boot from. It is also possible to boot a machine over the internet as well.

What i require on the server end is a pxe server. This will comprise of some services, mainly a tftp server and dhcp server and in some cases nfs or http server. In this example i will show you the most basic method for network booting a linux OS (tftp/dhcp server combo).

Note: I recomment using tftpd-hpa server over atftpd that comes with backtrack 4. Atftpd has a file size limitation in which it can download. Not sure exatcly what it is but i ran into a problem in downloading the initial ramdisk for ubuntu with syslog complaining about atftpd's inability to download certain sized blocks.

Will be using a simple linux OS called Tinycore

dhcpd.conf :

allow booting;
allow bootp;
default-lease-time 360;
max-lease-time 720;

subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.2 10.0.0.5;
option subnet-mask 255.255.255.0;
option routers 10.0.0.1;
option broadcast-address 10.0.0.255;
option domain-name-servers 10.0.0.1;
filename pxelinux.0;
nexe-server 10.0.0.1;
}

The filename portion is very important and is the bootloader that should be loaded over the network
The next-server specifies the tftp server that houses the bootloader.

Start up the dhcp server.

Set up the tftpd server. I usually do this from the commandline
# in.tftpd -l -v -s /root/tftpboot/

Copy the initrd and kernel files to the /root/tftpboot folder specified in your tftp service.
You would need to get the bootloader, gpxelinux.0, from syslinux packages. Just download syslinux and copy this file to your /root/tftpboot/ directory. Create a directory "pxelinux.cfg" and create a default text file with the following.

Prompt 0
Timeout 0
LABEL tinycore
KERNEL vmlinuz
APPEND initrd=initrd.gz

Now if your client's machines motherboard supports booting from lan, select this option in the boot menu and all should go well.
For PC's that do not support booting from lan, you can burn a gpxe image onto your usb key so your usb key would act like the pxe client. Head over to http://www.rom-o-matic.net/ and get a copy of the usb compatible gpxe image. Copy onto thumbdrive using dd:
# dd if=gpxe.img of=/dev/___.

Resouces/Good Reading: http://etherboot.orghttp://syslinuxzytor.com/wiki/index.php/PXELINUX

Using Netcat and a symmetric algo (AES or 3DES) for secure commnuications

I was messing with netcat (again) transfering files back and forth from computer A to B. I know that the file transfer are indeed not secure and are transfered in plaintext and wanted to have netcat remedy this. Although there are secure alternatives to netcat (cryptcat and sbd), i love netcat, after all, netcat fathered most of these other tools. Plus i wanted a challenge. I wanted to use openssl's symmetric cyphers to encrypt data transfered through netcats client/server nodes.

Simple enough, it didn't take me long to put things together

Client:

# openssl enc -aes128 -nosalt -pass pass:mypass -in file.txt| nc -q 1 10.0.0.1 80

Server:

# nc -lvp 80 | openssl enc -aes128 -d -nosalt -pass pass:mypass -out file.txt

Ntfsclone, Backup/Restore ntfs partitions

So i did a fresh install of xp and installed a couple apps and wanted to make an appropriate backup image using linux. Being the Backtrack user that i am, the popular choice of backup/imaging known to me at the time were the programs dd or partimage. For my purposes, dd would'nt be a valid choice as it will back up used space as well as unused space, so i was left with partimage.

Partimage is a great program, but support for ntfs file systems were experimental. However, i proceeded to try it out and all went fine, the backup was succesful. However, i didn't want to risk trying a restore and lose everything on that partition (as docs said the support for ntfs was experimental). I then turned to google to find a reasonable alterative.

A few minutes after, i learned of ntfsclone (and its already installed on backtrack 4 as well). Ntfsclone will do as the name says, clone ntfs drives. You can clone to an image file, disk or stdout (useful for piping to programs like split, gzip, bzip etc) . It had the major feature i was looking for that was also present in partimage; the ability to backup only the used blocks of data on the partition and not the entire partition itself. Actually, it backs up the used space on the partition and fills the rest of the image with zero's which makes for easy compression.

Usage is quite simple

To make clone of partition 1 on device sda
# ntfsclone --save-image -o /mnt/usb/disk.img /dev/sda1

To restore image
# ntfsclone --restore-image -O /dev/sda1 /mnt/usb/disk.img //note we are using the capital O in the options to overite the destination /dev/sda1 if existing

Because of the file size limit (4G) on fat32 formatted disks, if you are cloning any drive bigger than four gigs and wanted to copy the saved image to a fat 32 disk, you will therefore run into issues. To overcome this, the following commands can be utilized.

# ntfsclone --save-image -o - /dev/sda1 | split -d -b 1000m - XPSP2.img_ // the '-' will cause ntfsclone to output to standard out. The split utility will split the data every 1000 megabytes (1 gig) from its standard in '-' and output to files with the prefix XPSP2.img_ and because of the '-d' option, numbers will be appended to the individual files. Example: XPSP2.img_01, XPSP2.img_02, XPSP2.img_03.


Just something important to note, taking from the article here:

If you want to copy, move or restore a system or boot
partition to another computer, or to a different disk or partition (e.g.
hda1→hda2, hda1→hdb1 or to different disk sector offset) then you will need to
take extra care.

Usually, Windows will not be able to boot, unless you
copy, move or restore NTFS to the same partition which starts at the same sector
on the same type of disk having the same BIOS legacy cylinder setting as the
original partition and disk had.

The ntfsclone utility guarantees to
make an exact copy of NTFS but it will never deal with booting issues. This is
by design: ntfsclone is a filesystem, not system utility. Its aim is only to
clone NTFS, not to clone Windows. Therefore ntfsclone can be used as a very fast
and absolutely reliable building block for Windows cloning, but itself it's not
enough.

Resources/Good Reading:
http://www.linux-ntfs.org/doku.php?id=ntfsclone

Advanced tcpdump Kung-Fu

So i was messing with tcpdump again and needed a quick refresher on filters. I went back to one of my blog posts and some other resources i found on google and quickly got up to speed. I wanted to take things a little it further however and looked to get creative.

I started out by filtering icmp packets. I wanted to only see ping request packets coming to me. So i created the filter as follows:

# tcpdump -ni eth0 'icmp and (icmp[0] = 0x08)'

I then only wanted to extract the ip address of the host sending those icmp requests

# tcpdump -lni eth0 'icmp and (icmp[0] = 0x08)' cut -d " " -f 3 //Note that the '-l' option must be included to make stdout line buffered

With this information, i imagined taking things a lil further. What i then wanted to do was to block any machine that was sending icmp echo requests. I then remembered that honeyport script that was in a recent pauldotcom segment (I also blogged about it recently as well. Its really kool).


So the script went like this:

while [ 1 ];
do IP=`tcpdump -c 1 -lni eth0 'icmp and (icmp[0] = 0x08)' cut -d " " -f 3`;
echo -e "\n${IP} is pinging you.";
echo -e "Blocking IP: ${IP}";
iptables -A INPUT -p tcp -s${IP} -j DROP;
iptables -A INPUT -p icmp --icmp-type 8 -s ${IP} -j DROP && echo -e "Blocked...\n";
done

Then give the script file executable rights then let her rip.

The next small project i did was filtering out traffic coming from the server, but only the data that has the tcp flags PUSH or ACK set. I was using the edna music server for demonstration purposes and it defaults to port 8080.

So in one terminal i had my tcpdump sniffer set up like this:

# tcpdump -w dump.pcap -s0 -ni eth0 'tcp adn src port 8080 and ((tcp[13] = 0x18) or (tcp[13] = 0x10))'

So the idea behind this is that when a client connects, request a song and streams it, i can be the man in the middle just pulling the data that is sent back to the client in a stealthy manner. When you're finished with your sniffing session you can combine some command line tools to retrieve your data

# tcpflow -C -r dump.pcap strings grep "Content-Type" cut -d " " -f 2 sort //this gives you a list of the content types that were sent to the client. Note that -C prevents tcpflow from outputting the different streams into files, instead just displays the data on standard out.

# tcpflow -C -r dump.pcap more -d // after you issue this command you can hit the h key to get helpfull commands. The "/" is a common option used when you want to do regex searches through the data


Just another kool thing you can do on the fly to see the URLs that are being requested

# tcpdump -lni eth0 'dst port 53'cut -d " " -f 8

If you wanted the ip addresses of the clients as well, you can have another tcpdump window running simultaniously along with the above (Have then running side by side, line by line so interpretation is more efficient)

# tcpdump -lni eth0 'dst port 53' cut -d " " -f 3

WPA rainbow tables with cowpatty and aircrack-ng suite

No introduction necessary. If you do not know what a rainbow table is then you will just have to use google or read some of my previous posts.

[using cowpatty suite]

# ./ genpmk -f wordlist.lst -d hash_tables.lst -s "linksys" //Generates a salted rainbow table using the wordlist file and the ssid name "linksys"

# ./cowpatty -d hash_tables.lst -s "linksys" -r wpa.pcap //command to crack the WPA key using the rainbowtable and the pcap file

[using aircrack-ng suite]

# airolib-ng table.db --import essid ssids.lst // creates a new database and imports the ssids to be used as salts

# airolib-ng table.db --import passwd wordlist.lst //imports the wordlist/passwords into the database

# airolib-ng table.db --batch //performs all the necessary processing of the essid and password combination

# airolib-ng table.db --verify //verifies the integrity of the ssid/password pairs

# aircrack-ng -r table.db wpa.pcap //command to crack the WPA key using the rainbowtable and the pcap file