- main - earth.li

Firewall testing
by Adam Bower 05 Jun '01

05 Jun '01

Hi all, I just got around to updating my firewall to use IPtables and was wondering how could I check that I havn't left any big hole in it? I know about online port-scanners but how do I know if they are reliable? (indeed you can ssh to my machine and http from the outside world but the online ones I just tried seemed to ignore this little fact) I short does anyone know a good online portscanner or is anyone willing to run NMAP or nessus against me? Thanks Adam -- This message is Copyleft - all rights reversed Adam

3 4

Re: [Alug] A Couple of responses in one :
by MJ Ray 05 Jun '01

05 Jun '01

Neill Newman <neill(a)entora.co.uk> writes: > aarrgghhh how many times.. apply the updates and this is less likely to > happen..(not impossible mind you) That's all well and good, but what do you do when the vendor's updates break core functionality required by your users? One thing Debian *still* has my respect for is that its "stable" really is, while still having security updates. > If you want I can do a 10 minute demo at the barbeque on how to make a > machine install updates automatically if it will encourage people to do > this... I currently have 30 or so machines doing automatic updates, and > I have to do about 5 minutes a week to make it work smoothly, all it > took was a little time upfront... This would be good, although "apt-get update ; apt-get upgrade" variations are 5 minutes up front and then just looking over the output of the cron job... Seeing as this is pretty much a "misc" thread: I have discovered a RedHat 6.1 machine under my control. How do I upgrade it to 7.1? If it's a nuke and start again, I'll use Debian instead, as time is short, but as time is short, I'm quite happy to leave it as RedHat if there's an upgrade path. -- MJR

4 4

RE: [Alug] A Couple of responses in one :
by Earl Brannigan 05 Jun '01

05 Jun '01

On 05 June 2001 15:37, MJ Ray [SMTP:markj@cloaked.freeserve.co.uk] wrote: > > [...] (SNMP walk Anyone ?). > > Yep, that one scared me when I saw how talkative our machines were. > Silly Compaq Unix enables no end of crap services by default. > Last year I spent 6 months writing an extensible SNMP agent for a call centre software suite. Wasn't fun and certainly wasn't easy. However about 4 weeks after it went live some bright spark noticed it was now possible to get a full picture of the network and its nodes, names and all sorts of other stuff (because of the newly functioning MS SNMP services) across the internet by issuing an SNMP Walk against the public MIB on the firewall's IP (which had been configured for SNMP traffic due to this new agent reporting to the sysadmin remotely!) NB Anyone who hasn't a clue what I'm talking about try the following : 1) if you can, get the MS platform SDK and install the snmptool component. (there are tons of free SNMP tools about on the net if you can't get this... a quick lycos search should get you some) 2) Ensure you have the SNMP Service active (WIN NT... dunno about other flavours though I know you can have SNMP installed) 3) try the following command (other tools should be very similar in usage) snmptool walk 127.0.0.1 public 1 Here is the output from my work machine : -----SNIP----- SnmpTool - Simple Network Management Protocol Tool for Win32 Performing branch walk starting at OID 1.3.6.1.2.1.1 Name: system.sysDescr.0 OID: 1.3.6.1.2.1.1.1.0 Type: OCTET STRING Length: 135 Value: Hardware: x86 Family 6 Model 5 Stepping 2 AT/AT COMPATIBLE - Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free ) Name: system.sysObjectID.0 OID: 1.3.6.1.2.1.1.2.0 Type: OBJECT IDENTIFIER Length: 12 Value: 1.3.6.1.4.1.311.1.1.3.1.1 Name: system.sysUpTime.0 OID: 1.3.6.1.2.1.1.3.0 Type: TimeTicks Value: 6914 Name: system.sysContact.0 OID: 1.3.6.1.2.1.1.4.0 Type: OCTET STRING Length: 14 Value: Earl Brannigan Name: system.sysName.0 OID: 1.3.6.1.2.1.1.5.0 Type: OCTET STRING Length: 6 Value: APOLLO Name: system.sysLocation.0 OID: 1.3.6.1.2.1.1.6.0 Type: OCTET STRING Length: 13 Value: In the Window Name: system.sysServices.0 OID: 1.3.6.1.2.1.1.7.0 Type: INTEGER Value: 79 End of MIB branch -----SNIP----- Try the following command ... very interesting if you are connected to a network .... snmptool walk 127.0.0.1 public .1.3 (note the point in front of the 1 - important) For my machine I can see the shared drives, mapped network drives, ethernet adapters, the names/ip addresses of every other machine on my subnet......and all with little effort. It doesn't take einstein to figure out how useful some of this info is to the potential hacker.... BTW, try this against a few web servers when connected to the net....you could be intrigued. > > I will also bring along some good info in pdf/html/text format for further > > reading for anyone who is interested. > > We could upload this to the web site on the day, too? Ha! what a fabulous idea... I'll get it all onto one disk and its all yours .....;o) Good excuse to organise it all anyway. > > -- > MJR

1 0

AUI v BNC ports
by Jenny_Hopkins＠toby-churchill.com 05 Jun '01

05 Jun '01

'Lo all. Does anyone know how to persuade eth0 to use BNC rather than AUI? (I hope I have the correct terminology here). System is debian, card is this bugger of a thing, the 3c509. Jenny.

3 2

Re: [Alug] ALUG meeting 17 June
by MJ Ray 05 Jun '01

05 Jun '01

David Freeman <david_freeman(a)rocketmail.com> writes: > I will be bringing my new printer so we can try to configure it? lpr, lprng, pdq, CUPS, ... ? What is it, by the way? -- MJR

2 1

RE: [Alug] A Couple of responses in one :
by Earl Brannigan 05 Jun '01

05 Jun '01

MJR Wrote : > I'd certainly still be interested. It would also be nice to be on the > sending end of one of these attacks for a change...! For a change!?!?!......been on the receiving end then? I have. Recently had to completely rebuild a webserver because it had been rooted, trojaned, backdoored etc. There was no way to undo the mess that had been caused. I beleieve it was hacked via a bind overflow. > I've played with toy exploits (sending bad data to web servers to make them die, etc), > but not buffer overflows. some of the 'toy' exploits can be very useful. Sending 'apparent' junk in the post data for a .jsp for example can yield excellent results on some badly patched setups. But I have to say, buffer overflows are the most phun! (instant gratification....) > > -- > MJR OK, here's the idea, I have some bad builds of programs (anyone remember wu_ftp's vulnerability, I think I've also got some others - DNS Bind for example) so I'm happy to set my machine up as a dodgy ftp / DNS / telnet server and then gain root on it from someone else's machine. I will also install a backdoor or 2 to show how I would be able to get back in later. Also a quick overview of the ways you can gain system info to enable you to plan an attack. People are often suprised when they see how much system info they give away for free to anyone who knows where to look (SNMP walk Anyone ?). Basically I'll set my machine up as a pretty badly secured/patched box with useless services and stuff then show you how to crack it. I will also bring along some good info in pdf/html/text format for further reading for anyone who is interested. This will probably be the starting point for anyone wanting to get their own box from such condition to a hardened setup. Finally (if I have time) a little bit of a Snort overview (thats Intrusion Detection not illegal pastimes). I'm not going to touch DOS attacks or that sort of thing because most home users would never be the victim of one (although if your machine get's hacked you could well end up as an unwitting accomplice / launch pad for a future DDOS......) Cheers all See you soon. PS (Aside) some of you may remember my post from ages ago asking about development IDEs for Linux. Thanks for the responses. Since then I have used RHIDE extensively (I love it. It's a marvellous trip down memory lane as anyone who knew and loved the Borland Turbo C++ 3.x series will attest) For the past 12 weeks though I've been using Anjuta which can be found on this month's Linux Format CD, although the source download from sourceforge is small enough.( http://anjuta.sourceforge.net interestingly enough) I recommend it wholeheartedly to anyone wanting a nice IDE for C/C++ development on Linux - give it a shot......only at version 0.1.5 but it is excellent. Support it! Still buggy...that's where we come in, find them bugs and report em. (oh! ... use it as well....it does work very well afterall) You could be compiling your own buffer overflows within hours! (Just keep em away from my webservers!!)

2 1

Re: [Alug] A Couple of responses in one :
by MJ Ray 05 Jun '01

05 Jun '01

Earl Brannigan <earl.brannigan(a)lindenhouse.co.uk> writes: > For a change!?!?!......been on the receiving end then? [...] Oh yeah. Universities are not nice places to be: no network-level security and fairly fast connections which are attractive launch pads for DDoS attacks. > But I have to say, buffer overflows are the most phun! (instant > gratification....) That reminds me why I program in lisp so much ;-) > [...] (SNMP walk Anyone ?). Yep, that one scared me when I saw how talkative our machines were. Silly Compaq Unix enables no end of crap services by default. > I will also bring along some good info in pdf/html/text format for further > reading for anyone who is interested. We could upload this to the web site on the day, too? -- MJR

1 0

Re: [Alug] AUI v BNC ports
by Andrew.Chandler＠ft.com 05 Jun '01

05 Jun '01

some *very* old cards have a jumper on the board to select the right interface, but as Mister Newman says there will be a utility to change the setting. Try popping over to www.3com.co.uk Andi Neill Newman <neill(a)entora.co.uk> on 05/06/2001 14:38:22 To: Jenny_Hopkins(a)toby-churchill.com cc: alug(a)stu.uea.ac.uk (bcc: Andrew Chandler/PSD/LONDON/FTI) Subject: Re: [Alug] AUI v BNC ports Jenny_Hopkins(a)toby-churchill.com wrote: > > 'Lo all. > Does anyone know how to persuade eth0 to use BNC rather than AUI? (I hope I > have the correct terminology here). > System is debian, card is this bugger of a thing, the 3c509. older cards had a dos utility program to 'switch' which interface they used, nowadays they do it automatically.. I could be wrong here, but there is a rpm on rufus (rpm archive, rufus.w3.org cool place check it out!) called 3c50x which /might/ do what you want... I've never used it myself so I don't claim anything ;).. hth Neill -- Open Source Specialists http://www.entora.co.uk/ Tel: +44 (0)701 0723686 Fax: +44 (0)870 3214368 _______________________________________________ alug, the Anglian Linux User Group list Send list replies to alug(a)stu.uea.ac.uk http://www.anglian.lug.org.uk/ http://rabbit.stu.uea.ac.uk/cgi-bin/listinfo/alug See the website for instructions on digest or unsub! ********************************************************************* * Please visit the web site of the Financial Times at: * * http://www.ft.com * * * * For UK personal finance, please visit http://www.ftyourmoney.com * * * * This E-Mail is intended for the use of the addressee only and may * * contain confidential information. If you are not the intended * * recipient, you are hereby notified that any use or dissemination * * of this communication is strictly prohibited. * * If you receive this transmission in error, please notify us * * immediately then delete this E-Mail. * * * * * postmaster(a)ft.com * *********************************************************************

1 0

Mr simms doesn't like us Re: Cow: was Sheep: was something else
by David Freeman 05 Jun '01

05 Jun '01

As you didn't send this to the list I have cc'd it there. --- Jenny_Hopkins(a)toby-churchill.com wrote: > > BBQ sounds good to me. vote number 4 > I'm a september virgo though. Yes but I think we have a couple of members who will be leaving in septemeber. So August is a better bet. > Any talks sound good to me; ooze knowledge in through my pores by > osmosis > if i bombard it enough ;) Contradicts most of what I have learnt on the learning process :o) Security is an advanced topic but well worth learning. Get the Book "Hacking Exposed" and also read "the cuckoos Egg" which I beleive you now have. > David: Pink Floyd? Yes. > Re.17th June - if I bring a computer is it possible to network using > co-ax? Please, can some one tell me what this coax stuff is? I think it could be possible for me to bring a coaz enabled hub. Remeind me nearer the time tho. Thanks D > Jen. > > __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail - only $35 a year! http://personal.mail.yahoo.com/

6 6

Re: [Alug] Mr simms doesn't like us Re: Cow: was Sheep: was something else
by MJ Ray 05 Jun '01

05 Jun '01

David Freeman <david_freeman(a)rocketmail.com> writes: > As you didn't send this to the list I have cc'd it there. As a general point, ask permission *before* you do this unless you're *very* sure it was an error. Quoting private correspondence in public is rather rude. (I'll certainly be after you with the chainsaw if you do it to me.) Reply to all if you want the list included, remember. > vote number 4 5. > Security is an advanced topic but well worth learning. Get the Book > "Hacking Exposed" and also read "the cuckoos Egg" which I beleive you > now have. The sequel, "Silicon Snake Oil", is also worth reading, although it's not security-related. If anyone wants a copy, I think I have a surplus one, so make me a reasonable offer off-list ;-) > Please, can some one tell me what this coax stuff is? Not UTP, the other stuff. It's what is usually used at UEA, sadly. -- MJR

1 0