Self-Installing Xplico in Ubuntu - Virtual Edition

Above Image…the Xplico baby is delivered and working perfectly!

In my previous Xplico post, I mentioned how I had been using the VirtualBox images of Xplico.  And how suddenly they had stopped working.

Having been using this tool for a while, the sudden loss of this resource was frustrating.

In the end I sought to create my own self-built version so I could have a running version in my own VirtualBox session/image.

Plan A - Good Theory, Difficult Implementation

My original plan was quite simple.  (Warning: Linux-noobie stumblings ahead!)

1. Create a  8 GB dynamic VirtualBox vmdk file.
2. Find a Debian-based LiveCD that included a local installer.
3. Load the vmdk file using the LiveCD to boot it.
4. Install the Debian OS.
5. Install Xplico
6. Celebrate.

In theory this should have worked fine.

I had no challenges making the vmdk file.

I picked out PureOS and Linux Mint Debian LiveCD’s as my platform sources. Downloaded both and went with Mint.

I booted the vmdk file and installed Mint. No issues besides having to do some gparted work on the volume and some formatting of the partition. No biggie.

Then I set about doing the Xplico installation.  The Xplico developers have done a great job with providing the documentation on their Xplico-Wiki:

Install Xplico

• Building: Building and Installing Xplico

• Interface: Installing Xplico Interface (XI)

• Tutorial: Step by step installation

• doing a DEB package: Instructions to generate a DEB package from source code.

So it should have been a piece of cake. Right?

Unfortunately, despite all my Step by Step attempts, I couldn’t apt-get a version of libmysqlclient16-dev.  And even though I continued on bravely anyway, stuff just started falling apart.

So after a few hours of work last night struggling through--and at least another hour of research--I found an alternative Xplico-installation method offered and decided to get some zzz’s and start fresh in the morning.

Plan B - Can it be this easy?

My new plan was realistically simple.

1. Create a  8 GB dynamic VirtualBox vmdk file.
2. Download Ubuntu Desktop Version 10.10 (it has a local installer).
3. Load the vmdk file using the LiveCD to boot it.
4. Install Ubuntu.
5. Install Xplico via a pre-crafted script I had discovered in a forum.
6. Celebrate.

And it worked!

The GSD Xplico Recipe

Here’s the Haps!

After much research from the night before, and realizing that the “official” Xplico VirtualBox images were based on Ubuntu, that seemed the way to go rather than my first choices.

Note this assumes some moderate familiarity with VirtualBox and Linux.  I’m leaving some of the details out that seem straight-forward (to me)…YMMV.

1. Download VirtualBox if you haven’t already done so.  At the time of this post I used 4.0.4. Install accordingly.
2. Launch and create a new virtual machine using the wizard.  Give it a  name, for the OS type pick “Linux” and for version pick “Ubuntu”. Pick your base memory size.  For my host system I’ve got lots of RAM so I went with 1024MB but you could use the default 512MB.  I kept the Boot Hard Disk option checked and allowed it to create a new hard disk at 8 GB. Since space is still a premium, even with a 500GB local hard drive, I went with the Dynamically expanding storage disk option. I took the default location, confirmed the size and hit “Finish”.  Done.
3. Next I downloaded Download Ubuntu Desktop Edition 10.10 x32 bit version of the LiveCD.
4. Once done I modified by virtual machine storage settings for the CD to point to the ISO I just downloaded and then launched the virtual machine.
5. Once Ubuntu booted I just clicked the large “Install Ubuntu” button offered.
6. I decided to go with all the defaults, including downloading of updates while installing as well as installing all third-party software packages offered. I took the default to let the installer erase and use the entire disk automatically (look ma! No manual gparted work!).
7. While the installation went on in the background I continued with the localization setup and profile setup.  I decided to name my build GSD-Xplico and use “xplico” for both the name and password (to mirror the default account in the Xplico app) for simplicity.
8. Hang out and chill for a while (or get started make an Old Bay Gulf-Coast pot-boil for dinner) as the installation/updating process completes. Yummers.
9. When done, reboot as requested by the installer (don’t forget to disassociate the attached ISO LiveCD/Installer first!).
10. Log in using the credentials you created in step 7.
11. Optional but recommended.  Go ahead and install the VirtualBox Guest Additions.  I’m assuming most folks still here should be able to handle knowing how to do that. This will help a number of things but most of all will allow you a few more screen resolution size options.
12. Optional but recommended. When prompted by the Update Manager, go ahead and install all available updates offered. At the time of this post, I found 275 updates offered.
13. When done, reboot.
14. Log in again and open up Firefox.
15. Now for the secret sauce.
16. Browse to http://5ff1cwepqm.tal.ki/20101216/wicd-xplico-261923/
17. In that GnackTrack forum, commenter blaksark posted the following Xplico Script installation by Nsark.  All honor and credit ascribed accordingly.
    
    sudo apt-get update && sudo apt-get install -y gdebi sed && wget http://sourceforge.net/projects/xplico/files/Xplico%20versions/version%200.6.1/xplico_0.6.1_i386.deb && sudo gdebi -n xplico* && sudo find /etc/php5/apache2/php.ini -exec sed -i.bak 's/post_max_size = 8M/post_max_size = 800M/g; s/upload_max_filesize = 2M/upload_max_filesize = 400M/g' {} \; && sudo service apache2 restart && sudo service xplico restart && firefox localhost:9876
    
18. Copy that script to the clipboard.
19. Open “Applications” --> “Terminal” from the top menu bar.
20. Paste the copied script.
21. Press “Enter”
22. Provide the prompt your password.
23. Watch Nsark’s magic run for a bit. Basically it is getting all the dependencies, all the packages, installing them, then adjusting the apache settings to allow for larger PCAP file size uploads, restarting apache and the xplico service, and finally launching Firefox to the Xplico web-page.  Brilliant!
24. When completed, close the terminal window.
25. Behold, a wonderfully installed version of Xplico!
26. You may want to set the Xplico Web Interface page as your Firefox homepage.  http://localhost:9876/users/login
27. Default Username = xplico
28. Default Password = xplico
29. Admin Username = admin
30. Admin Password = xplico
31. Tips…you will want to use the default sets above for general PCAP work and Analysis. Use the Admin account to change some variables, user accounts, and configuration settings.  Most mere mortals probably won’t need to fiddle with these at all. 
32. Adjust Ubuntu theme/wallpaper accordingly for attitude and coolness factor as needed.  I personally kept the default “Ambiance” theme but changed the wallpaper to the included orange feather on the grey background.  Seemed to match the Xplico Web-page interface colors nicely.  If you have already resized the virtual screen size to as large as you can but still feel a bit jammed up in the Xplico web-interface, you can also adjust the zoom size in Firefox to be a bit smaller to get more on without having to fiddle with the scroll bars.

That’s pretty much it!  You’ve just built your own lab for processing PCAP files.  Sure it doesn’t have all the extra cool pen/sec/for tools and apps that DEFT LiveCD comes with, but hey! it works and you built it yourself! And with some more work, you can download additional network/security packages as needed.

If you can’t wait, download, unpack, and upload Sample captures from the Xplico Wiki site.

I’ll go into more detail on those and the wonders of Xplico PCAP session reassembly in the next post.

Please also note…if you shut down Xplico and the Ubuntu system, then before you re-launch Xplico the next time you need to run the following command in a terminal session before launching Firefox and logging into the Xplico web interface:

sudo /etc/init.d/xplico start

I suspect in the DEFT 6 LiveCD, that when you run the Xplico icon and the terminal window opens but doesn’t close out it is trying to do the following but failing for some reason.

sudo /etc/init.d/xplico start http://localhost:9876/users/login

I haven’t had time to see if a manual-launch of Xplico in the DEFT 6 Live CD will work better that way.  Xplico appears to work but fails on uploading of PCAP files in my experience.

Post Script #1 - Useful Xplico-building Resources

Before I eventually dug up blaksark’s Nsark script, I did uncover a few more installation recipes from other Xplico tinkerers.

I'm listing them below as together they provide a great overview of other installation techniques on a few other platforms.  They might be found helpful by others all assembled in one place:

• Step by Step Xplico 0.6.1, 0.6.0, 0.5.8, 0.5.7 and 0.5.6 Installation - [Xplico Wiki]
• xplico - [Xplico Wiki] - All kinds of official documentation!
• Securityfu - Installing Xplico on Ubuntu 9.10 64bit style
• Xplico : Quick Setup Debian - YauB shares some Wi-Fi tips for Xplico.
• Xplico: An intro - SOLDIERX.COM. EverestX shares some guides on getting it going on Backtrack4 and then has a very basic overview if you can’t wait to start playing.
• [How-To] Xplico:Network Forensic Analysis Tool - by ClsHack.
• Compiling xplico - backtrack-linux forums - Another “all-in-one” auto-script by vvpalin for Backtrack distros.

Post Script #2 - Pre-Loaded Xplico Distros (Installable)

For whatever reason, to the best of my knowledge, the DEFT builders haven’t included an installer for the LiveCD to allow installation directly onto a local drive (real or virtual).

Only after all this exercise, and some leads in the resources mentioned above I’ve found (so far) two LiveCD distros that do include “pre-built” versions of Xplico in them, and can be fully installed in a real/virtual system.  This may be another option for folks who don’t want to cook your own version as I’ve shown earlier.

• GnackTrack - Gnome Based Penetration Distro - This is a really cool pen/sec/for distro I’ve not seen before.  It is quite mature and very polished and includes Xplico.
• BackTrack Linux – Penetration Testing Distribution - Probably one of the Godfathers of all pen/sec/for LiveCD distros.  Now including Xplico. Install BackTrack to Disk - BackTrack Linux.
• Security Onion - LiveDVD - For “…installing, configuring, and testing Intrusion Detection Systems. It is based on Xubuntu 10.04 and contains Snort, Suricata, Sguil, Squert, Xplico, nmap, metasploit, Armitage, scapy, hping, netcat, tcpreplay, and many other security tools.”

If you are aware of any other LiveCD’s (with installer support) that include pre-added builds of Xplico, please drop the information in the comments and I’ll keep this post updated.

updated 03/06/2011 to include Security Onion LiveDVD suggested by Doug Berks.

Hope someone finds this useful.

Next stop…putting Xplico through the paces on PCAP processing and traffic reassembly.

Cheers!

Claus V.

Read More

New and Improved Material

Just a pause to empty out the handy-dandy “to-be-blogged” folder.

Windows Tips and Tricks

• How To Block A Computer From Accessing To A Specific Wireless Network - Windows7hacker
• Speed Up Windows 7 Boot Time By Eliminating GUI During Start Up - Windows7hacker
• FREE: AD Info – User friendly Active Directory reporting tool - 4sysops
• Portable PowerShell - Live PowerShell with Karl Prosser
• Highlighter v1.1.2 Released - Mandiant
• Memory forensics on Windows 7 (x86 and x64) and Windows 2008 x64 - Mandiant Blog

Firefox Bits

I’ve been running the Nightly x64 builds of Firefox 4.0b13pre for some time now and it has been very stable.  The fact that there is a developer release version of FlashPlayer for x64 bits helps a lot in the usability factor.  Right now I am still split between using Chromium nightlies for “fun” surfing and Firefox 4.x for my daily web-work commuting.

One of the major challenges with both platforms is finding compatible extensions/add-ons for the new versions.  I’ve had to walk away from some old favorites as they just don’t work at all in the new Firefox 4 world.

That said, I’ve been successful enough to keep productivity and security intact and will post updated extension/add-on lists for both browsers in the near future.

• Firefox 4: recent changes in Firefox - Mozilla Hacks
• ProfileManager - Firefox Extension Guru’s Blog. Hot tip on an alternative tool now that built-in profile manager tool is disappearing in future Firefox builds.  From that post: ProfileManager 1.0_beta1
• mozdev.org - newsfox: installation - new release of NewsFox RSS reader Add-on.
• Firefox 4 Ditches the RSS Button, Here’s how to get it Back - Webmonkey  I can’t begin to share how frustrating it was in FF4 trying to figure out how to get that RSS feed button in FF3 back.  This brought peace to the Valca home and Firefox 4 browsing/feeding.

New Utilities

• CubicExplorer - version 0.90 release- You may recall back from this GSD post why CubicExplorer is still on my watch list.  New version is a bit more refined.  Related build CubicExplorer Portable.
• Windows AIK for Windows 7 SP1 Released - Michael Niehaus’s Windows and Office deployment ramblings blog has a roundup of new inclusions. Download details: The Windows® Automated Installation Kit (AIK) for Windows® 7 SP1 - Microsoft source link.
• Updates: ProcDump v3.02, Contig v1.6, TCPView v3.03 and a New Mark’s Blog Post - Sysinternals Site Discussion.
• OutlookAttachView now allows you to search Outlook attachments only in the selected folders - Nir’s Blog.
• New console versions for WirelessKeyView and AlternateStreamView utilities  - Nir’s Blog.  Get the new bits: AltStreamDump and WirelessKeyDump at NirSoft.
• New utility to view/change/delete drive letter assignments - Nir’s Blog. DriveLetterView
• New utility that shows the details of Firefox downloads - Nir’s Blog. FirefoxDownloadsView
• Also updated at NirSoft: ChromeCookiesView and WebBrowserPassView
• CamStudio - Free Screen Recording Software.  Really easy to use and worked great on my Win7 build.  Previously I have fiddled with Jing and also found it clever.
• tintii photo filter - It’s been a long time since I last went looking at this graphic image editing tool.  I was pleasantly surprised to see it updated. If you want to use it with Photoshop, it will cost a bit. However the “standalone” trial version requires no Photoshop installation and is free.  It works great and I find the new interface a great improvement.  Use to fiddle with color tinting of image files.

Piriform is one of a handful of software providers who I want “one-of-everything” when I visit.  Counted up there with Sysinternals and NirSoft as my go-to source for awesome software.  They haven’t been resting and have been hard at work on updates to what should be Windows-required utilities for all sysadmins.

• Piriform Blog - Defraggler v2.02
• Piriform Blog - CCleaner v3.04
• Piriform Blog - Recuva v1.39
• Piriform Blog - Speccy v1.09

Tip: In case you haven’t figured it out yet, once you go to the product download page, just scroll to the very bottom of the page at the Builds header and find the tiny “builds page” link to find the jump to the portable (zip) versions.

Cheers!

Claus V.

Read More

Xplico & VirtualBox Headaches - Part II

Yes.  I know.  I really know.

I’ve promised a post on the wondermous Network Forensic Analysis Tool (NFAT) Xplico.

When it’s working, it is an outstanding tool, particularly when you have to take some of your PCAP files from the analysis bench into the boardroom and present findings in a way decision makers can relate to after an incident or network analysis review.

I started out cutting my teeth by using the 0.5.x builds directly in the DEFT Linux LiveCD builds.  Then I started playing around with the Xplico-provided VirtualBox Image builds including the new 0.6.x versions.

I was all set to start writing a post…when I was surprised at work to suddenly be getting no-boot errors on the VirtualBox vmdk drives I had some cases going on on my XP system.  Attempts to reload VirtualBox (from the 3.2.x version to the latest 4.0 versions) and/or redownload and deploy the various Xplico-provided vmdk images were unsuccessful…despite all the MD5 download hashes matching…even on different XP systems.

Fortunately, I was still going strong on my home system’s VirtualBox vmdk images for Xplico where I had some community-provided PCAP files to use for the post.

Only last weekend, when I launched them, they too experienced the same error.

Above: The killer-diller error.  Brand new, first-launch of Xplico’s latest VirtualBox 0.6.1 image/appliance.  Note that right after setting the system clock and activating the swap file fsck does a forced check saying the drive hasn’t been checked in over 249 days… Same thing in both VirtualBox 3.2.x builds as well as the latest 4.0.x releases; XP/Win7..doesn’t matter.

Above: After the original error, the damage has been done and now I get this every Xplico VirtualBox Image boot.

So now I was left with trying to use Xplico directly off the DEFT LiveCD builds.  Only the previous version of Xplico in the DEFT 5 was an older version and didn’t seem to render the images in the rebuilt web-page sessions, nor Xplico in DEFT 6 which seems to run, but for some reason all attempts to upload PCAPS failed (I think it is an apache issue as the terminal window never closes like it does on the DEFT 5 LiveCD build).

Double Bummer!  Particularly after feeling a bit better having overcome this DEFT 6 and VirtualBox: Maybe it’s just me? issue a few months ago.

Now, while I got started in the early days of LiveCD building by hand-building custom Knoppix (Damn Small Linux) boot CD’s, I’m just a few levels above “noobie” when it comes to Linux building, working, and troubleshooting.

As the images presented earlier capture, the whole issue seems to be that when I ran any of the VirtualBox vdmk images, during the boot process a diskcheck (fsck) was/is triggered due to some kind of date/clock-time stamp.  It claims I haven’t used these in over 258 days…thus triggering the fsck.  Only if I do run a manual fsck as suggested, it claims to find a bunch of stuff “bad” and “fixes” it all.  Only upon reboot the system is hosed.

I know there are ways to Skip or Bypass a Fsck but despite my best attempts, I couldn’t get grub to cooperate with me.

So now I was really frustrated.  I was/am still unable to get the (really nice when running) VirtualBox images directly from Xplico working.  And the versions in the LiveCd’s from DEFT, while nice, aren’t really a convenient environment for real and persistent NFA case work.  Based on previous work with Xplico I know that it can deliver and deliver very well…only I felt like I was running lame with any of these current solutions.

So that meant I had one last possibility (at least as far as I knew at the time)…roll my own “installed” Linux build on a fresh vmdk file in VirtualBox, and then manually install Xplico into it.

I’m cool with that, I needed a fully working Xplico build, and maybe it would be a good exercise before going into Xplico proper.  How hard could it be?

The answer?

Really, really frustrating…then stupidly simple.  Seriously simple.  Even Alvis could do it.

Above Image…the Xplico baby is delivered and working perfectly!

It can be done, and now I have a fully functional Xplico application running in an installed/hdd based configuration (still virtualized in a VirtualBox vmdk file) so I can save and revisit all my PCAP uploads.  Sweet Success!

So that post is coming up next…maybe even later today.  I now need to reproduce/test it on my work XP system…just to be 100% certain the process works.

In the meantime, this humble Linux padawan would deeply value any feedback from the Linux/VirtualBox Jedi Masters on why out of the blue the fsck started complaining about the time since last boot right after setting the system clock (certainly not 249 days!) on these vmdk images…and any solutions for fixing this issue. Now that I can roll my own I’m not really going back, however other users/testers might be curious and run into the same thing. 

From the Google work I was able to do, there may be an issue with the way the VirtualBox BIOS is reporting the actual time/date (or that it can’t get it from the hardware system) to pass on correctly to the virtual system.  Am I the only person running into this issue with the Xplico VirtualBox images?  Surely not as it replicated on different XP hardware systems as well as (finally) my Windows 7 system as well…and despite many installs/uninstalls/reinstalls/fresh-system installs, I have since been unable to get one running again.

I believe that by default, fsck is set to run automatically after x/days or y/boots.  However, I’m curious why that now always appears, even after a fresh reimport of either Xplico VB appliance.

Cheers!

Claus V.

Read More

Let’s Get For/Sec-Motivated!

While the NYT has been waxing prosaic that Blogs Wane as the Young Drift to Sites Like Twitter I take heart that I tend to be both old(er) and require a verbosity in communication that sites like Twitter and Facebook just cannot satisfy.  Mitch Joel has a great response to the NYT article in his Blogging Is Dead (Again) | Six Pixels of Separation Blog. And I am encouraged by two points he offers; “Blogging isn’t dead. Blogging is publishing.” and “Blogging is hard.”  From Mitch’s post:

Blogging is hard.

Blogging is hard because writing is hard. Writing is hard because finding the time to do real critical thinking and then to put those thoughts down in writing is even more complex. Reading, research, critical thinking, writing, editing and publishing isn't like posting a picture to tumblr or texting off a tweet. They're different beasts and they deserve different forms of metrics and comparison.

So despite the visible slowdown in GSD posting here, I assure my gentle readers that it’s because my boots have been on the ground, in the trenches, getting very dirty with real-world experiences.  I’ve been studying books, taking notes, putting into practice, crafting and refining.  And along the way taking names, linkage, and notes.

So please enjoy this labor-of-love blogging post today.  And special credit to two extra-special things I noted this week that helped me get focused:

1. My “new post ranking” on the sidebar of the Windows Incident Response blog hadn’t sunk to dead-bottom yet, but was slowly getting closer and needed to be “bumped up”, and
2. For some really bizarre reason bound to be the result of an interdimensional rift, E-Evidence Information Center - Blogs & Wikis made a grave error with the consequence of having Harlan Carvey’s Windows Incident Response blog listed at the top of the left-column and this humble blog listed alongside at the top of the right-hand column.  I’m not worthy…I’m not worthy!  Hopefully that will resolve itself dropping GSD a bit lower into the link-pile.  In the meantime I better represent!

Collections

Since it’s already come e up, it seems natural to start this LinkFest off with this WindowsIR blog post Links, Tools and Stuff.  At the end of the post, Harlan has a list of forensic/security related tool sites.  I’ve listed his finds below with a few others as well:

• Forensic Control - Free Computer Forensic Software
• Windows | Open Source Digital Forensics
• Category:RCE Tools - Collaborative RCE Tool Library 
• My SecTools (bbueno) including the following categories:
• Online Tools 
• Forensics /Network Forensics Tools 
• Malware Analysis Tools, and
• Malicious Document Analysis Tools
• Foundstone - A division of McAfee has their own Free Tools selection as well. I usually forget about these for a while, then come back to them.  I find it ironic that often many of these McAfee tools are nailed by Symantec as “hack-tools” and quarantined.  These are mostly oldies but goodies.

Wi-Fi Mapping/Monitoring Resources

A while back in the GSD post Security and Forensics Watch-List: GSD Linkfest Style I touched on some great (and free) Wi-Fi signal discovery tools; the inSSIDer 2.0 Wi-Fi Scanner or NirSoft’s WirelessNetView or the eye-candy rich Xirrus Wi-Fi Inspector.

Corey Harrell of Journey into Incident Response blog kindly left a comment on that post bringing my attention to Ekahau HeatMapper - The Free Wi-Fi Coverage Mapping Site Survey Tool.  While I was able to use inSSIDer on a recent incident response event to pinpoint a rouge Wi-Fi device and neutralize it, I truly believe the Ekahau product may have been able to help me better had I known about it at the time.

Since then, other similar tools such as Vistumbler and PassMark WirelessMon have come to my attention as well that not only provide Wi-Fi signal monitoring but also “heat-mapping” features.

New Stuff

There seems to have been a slight slowdown in the number of new “sparkly things” in terms of security/forensic software/freeware tools that usually makes me react like a Bowerbird to a shiny new object.

Fresh on the heels of DEFT Linux 6 getting released, Brett Shavers over at the Windows Forensic Environment (WinFE) blog announced It’s time to build your WinFE! having put together a very slick WinFE WinBuilder package.  It’s no secret I’m a mad WinPE builder and this WinFE builder is top-notch and will provide a very slick WinFE build with minimal fuss.  Check out Brett’s hard efforts for yourself.

JADsoftware has both installable and portable versions of Internet Evidence Finder v4 available: Internet Evidence Finder v4 – Standard Edition and Internet Evidence Finder v4 – Portable Edition.  Although not free, there are free-trial versions available for immediate download.  What’s more according to Brett Shavers’ post Portable Internet Evidence Finder and WinFE, it works just fine in a WinFE build!

Now out via SecurityOrb.com » Feb Edition of Hackin9

Lightbox Technologies is readying a release of Lightgrep.  First spotted via JL’s stuff: NYC4SEC Meeting 1/19/2011 blog post, this looks to be an interesting tool.

In the meantime, there is still the free Windows Grep tool AstroGrep. Other handy utilities are File Hound 3.2, Windows Grep, PRGrep, GREP for Windows, and my favorite, BareGrep.

Port Monitoring / SPAN port / Misc Network Traffic Monitoring Resources

Instead of using a network tap connection to monitor traffic, I rely upon a dedicated capture system hooked into a switch port configured with the port set to a particular SPAN configuration.  So far this configuration has worked golden.

I’ve posted these resources before on GSD, but I keep finding them so valuable I can’t help but repost them again, just in case someone stumbles across this post.

TaoSecurity post on SPANs versus Taps: TaoSecurity: Expert Commentary on SPAN and RSPAN Weaknesses

It links to two MOST Excellent articles on the issues of using spanned switch ports for collecting your network capture data, both form Tim O’Neill:

• SPAN Port or TAP? CSO Beware (by Tim O’Neill)
• RSPAN … Friend or Foe? (by Tim O’Neill)

OK, now the linkage on SPAN’ing

• Catalyst Switched Port Analyzer (SPAN) Configuration Example - Cisco Systems. A definitive resource.
• Port Mirroring on a Cisco 3550 Switch -danielmiessler.com
• Security Wizardry - Switch Port Mirroring
• How to Configure Local SPAN Port on Cisco Catalyst Switch - ItsyourIP.com

And my oldies but goodies favorites:

CDP - What Switch Am I Connected To? and Monitoring Traffic with Span Ports – SynJunkie.  Two really great posts out of series of ones touching on network monitoring, and Cisco switch/router configuration techniques.  I’m singling these out in particular as they are of interest to sysadmin troubleshooting on the network as well as traffic captures.

And recently found this Wireshark Wiki article as well -- CaptureSetup/Ethernet.

So during a recent troubleshooting exercise regarding network traffic capture analysis, I kept pounding my head on the desk because the data I was collecting just was turning up to be frustratingly non-helpful.  My data from source A wasn’t matching my observed data from source B.  After a week of forehead soreness I finally realized I wasn’t capturing any TCP/UDP traffic at all!  Turns out this model of Cisco switch required a different port mirroring configuration than the standard one used. With the help of a cubicle buddy, we figured out the correct configuration settings, applied them, captured the network traffic data again, and within an hour I had the problem identified and resolved. Easy-Peasy.

That said, it drove home that while my Wireshark/Network Monitor skills may be getting much better, if I can’t self-evaluate the correctness of switch configurations, I may waste a bunch of time working off someone else’s assumptions.

So I ended up collecting the following additional links that were helpful in this regard:

• Cisco Network Assistant - Products & Services - Cisco Systems. Great GUI tool to discover and manage Cisco network products.  For some reason the internal update feature didn’t find a new 5.6.1 version despite the version being newly issued. So I keep the link handy to directly check. Download Software - Cisco Systems
• CiscoZine - great and fresh Cisco-centric blog, particularly loaded with tutorial, security, and exploit content focuses.
• How to analyze traffic with SPAN feature - CiscoZine
• Decrypt type-7 password with Cisco IOS - CiscoZine
• Catalyst 2950 Desktop Switch Software Configuration Guide, 12.1(9)EA1 - Configuring SPAN  [Cisco Catalyst 2950 Series Switches] - Cisco Systems
• Catalyst 2960 Switch Software Configuration Guide, 12.2(25)SEE - Configuring SPAN and RSPAN   [Cisco Catalyst 2960 Series Switches] - Cisco Systems

Network Assessment and Analysis

There are some great updates in the realm of network assessment tools. 

My foundational tool are

• Wireshark,
• Microsoft Network Monitor 3.4  & Microsoft Network Monitor Parsers 3.4.2455,
• NetworkMiner,
• NetWitness Investigator, and
• SoftPerfect Network Scanner

These tools along with information of networks from Cisco Network Assistant generally can provide me a pretty good view of what is going on when I am analyzing network traffic captures.

However, lately I’ve been trying to add depth to my bench.

Nmap - Free Security Scanner For Network Exploration & Security Audits has been recently released at version 5.50.  I snagged a GUI-supported build Nmap 5.51 at FileHippo.com.  I’m still getting my feet wet on it with my home network before I expand usage onto our production environment but I am very impressed.

Erik Hjelmvik has recently kicked off his NETRESEC NetworkMiner website that offers both the free version of NetworkMiner we have all come to love and adore as well as a Professional version that offers result exporting, Host coloring support, and CLI scripting.  Erik’s site also includes a Blog so you can follow current events.  If you didn’t hear (who hasn’t) NetworkMiner has been released at version 1.0.  PCAP loading speeds are very much improved, no bomb-outs on pcaps that have particular packet errors in the capture, and a few new bells and whistles.

Despite Lavie’s teasing's, I am certain I’ve not yet fallen asleep with my copy of Laura Chappell’s Wireshark Network Analysis book on my chest…though truth be told it is rarely beyond fingertip reach lately.  I’ve learned a ton of great techniques and filters already and I’m only 1/4 of the way though!

I keep three installed version levels of Wireshark on my system.  I use the “Old Stable” version 1.2.x set as my work-horse doing most of my .CAP--> .PCAP conversions via the included version of EDITCAP.  I use the “Stable” version 1.4.3 for my daily capture and focused analysis work. Then I have been excited to find that the “Development” version 1.5.0 is super-fast and doesn’t seem to experience the constant memory-crash problem opening large PCAP trace files that the other versions to. So it is often the first one I use to open then post-capture filter the trace file into smaller more focused PCAP files.  If you haven’t tried it yet, give Wireshark 1.5.0 Development Release a whirl.

GSD Related posts: Network Linkfest & Network Monitoring Madness: Poor Man’s Resource Linkfest

Scanning for MAC and and finding some-FING special

Once you spend any time at all in the network world you quickly realize that addressing physical network security is a foundational element.  If you haven’t found it yet, give this /dev/random post Why Physical (Network) Security is Important? a look.  It is a concise primer and I can vouch that it is unnerving when doing a network trace analysis to suddenly be staring face-to-face with a rouge network device secretly added to your network.

Nmap can be a good place to start. Also, having a list of IP/MAC addresses as well as Host data for them can be a great reference while picking apart and filtering capture traces.

Here are some other free tools I’ve had good success with in performing local network inventory sessions to get that IP/MAC information.

Note: most (but not all) generally do not provide accurate (if any) MAC address discovery across networks.  By that I mean you generally need to be running the tool on a device that is already inside that network..rather than from a remote system outside the network/subnet.  That’s not a problem for me with our embedded network capture systems we remote in to.  But be aware of that issue in case you try one and results are not displayed as intended.

• SoftPerfect Network Scanner - fast and free network scanner
• FastResolver - Host Names/IP Addresses/MAC Address Scanner. Be sure to get and add this oui.txt file to the program folder to display MAC address maker information.
• Colasoft MAC Scanner - Scan MAC address and IP address in seconds
• Advanced IP Scanner 2.0
• MiTeC Network Scanner
• SuperScan v4.0 - McAfee Free Tools
• Cain & Abel has a MAC Scanner component.  Only drawback is many personal and enterprise AV scanners love to tear apart Cain & Abel as a hack-tool so getting it loaded on a system can sometimes be a pain.  If you do install it locally, be ready for warning bells to go off and make sure you have your sysadmin’s approval!
• The Dude for Windows - Provided by MikroTik in both stable and a v4.0 beta2 version.
•  Free IP Address Tracker from SolarWinds pretty handy tool from the awesome SolarWinds group.  See also many of their other Free Network Monitoring Tools
• NetBoar - very interesting tool for fast-traffic conversation monitoring.  Not nearly as powerful as the big-boys but could be good for rapid-response quick recon-checks to then let you bring in the heavy air-cover of Wireshark/NetMon in a precise manner.

An exciting and new find (to me) was Fing 1.4 from overlook.

What I really, really, really liked about Fing was that is is a CLI-based network discovery tool that is multi-platform (Linux, Mac, Windows, even, yes…Android), supports MAC address gathering, service info gathering, and can run as a service and scan/report changes when occur.

The Fing manual contains a lot of information as to the capabilities as well as examples of report output in csv, text, html, and sml formats.  It is really cool.

Enjoy the view of a demo report. Fing is freeware, and may be downloaded here.

Don’t let the CLI environment worry you, once installed, it creates a program shortcut for launching a terminal window in “interactive” mode which will guide you through the process.  Once you get comfortable, you can run your own targeted ping commands much more efficiently on your own.

And if you can wait, alpha/beta testing has concluded on a GUI-based FING edition. No word on release date. I missed out on the testing (DRAT!) so I haven’t had an opportunity to see this GUI-version but the forum feedback seemed positive.

Check Fing out!

RE: MAC’s & Spoofing

Yes…I felt obligated to add this.

I know that MAC addresses can be spoofed. Easily. So a MAC address alone is definitely no smoking gun.  That said, if the MAC address you are working with is captured “in-context” in a traffic capture or with other tools, and especially if it persistently consistent in presence, you still stand a good chance of being able to track down the physical device associated with it. If it shows up in a traffic capture you should have the traffic, the packets, the IP address associated, and the MAC address being offered.

Couple that with a MAC/IP/Network scanning tool, some l33t work inside your switching hardware, and you should be able to trace it to a physical switch port (well, it it isn’t Wi-Fi I suppose).  Then it’s just a matter of following the wire.  Then finding the answer to why someone would want to spoof an MAC address on your network would be my next step.

Anyway…that said, here are some related resources.

• MAC spoofing - Wikipedia
• How to spoof a MAC address - TechRepublic
• How to Change or Spoof MAC Address in Windows XP, Vista, Server 2003/2008, Mac OS X, Unix and Linux - My Digital Life
• How to change a MAC address on Windows 7 - Microsoft TechNet forums
• Technitium MAC Address Changer v5 Release 3 - freeware
• MacMakeup - gorlani.com
• Change MAC Address (Spoofing) for Windows 7, 2000, 2003, XP, VISTA, 2008

Blogging is dead?  Seriously?  I think not.

Tweet that.

--Claus V.

Read More

DEFT 6 and VirtualBox: Maybe it’s just me?

 

Just a quick-post.

Recently, the DEFT gang released DEFT Linux 6.  This is the next iteration of the DEFT LiveCD for forensics work.

(I’m continuing to make notes for my promised write-up of Xplico and was hoping to work with the latest LiveCD which includes the updated version of Xplico as well for my post, anyway…)

For some reason, when I downloaded the ISO file and attempted to boot it in the latest 4.0 version releases of VirtualBox on my Windows 7, x64 (Home Premium) system, I only got a black screen.

I checked the MD5 for the ISO and it matched perfectly.  The “burned” CD of the same ISO file would work just fine to boot a physical system…so I was at a loss as to why it wouldn’t work in VirtualBox.

I had allocated 1024MB for the virtual machine, and bumped the video RAM allocated up to 16 MB.

Nothing.

My host system is a Dell Studio 15 (1558) with 4GB RAM and an i7 processor.  Should be able to handle things.

For kicks I tried booting my DEFT 5.1 ISO in the same “ISO Loader” VirutalBox machine and had no issues.  It loaded and ran just fine.  Back to using the DEFT 6 ISO file and nothing.

After a couple of days pondering things, I decided to try disabling “VT-x/AMD-V” & “Nested Paging” under the “Acceleration” tab just for kicks n grins.

Guess what?

The DEFT 6 ISO now loaded and was executed just fine by VirtualBox.

Probably just an issue with my particular host system but just in case anyone else is scratching their head getting a non-boot of the DEFT 6 ISO in VirtualBox, it might not hurt to try.

I can enable those settings on other virtual machines in VirtualBox and don’t have any issues so maybe it’s just DEFT 6 specific…

Cheers…

Claus V.

Read More

Security and Forensics Watch-List: GSD Linkfest Style

It’s a sign of my busy-ness that most all the links for this first-of-the-year security and forensics linkfest post come from the tail-end of 2010.

I’m emptying all these out to clear the decks.  I’ve promised and need to deliver on the Xplico post that was mentioned some time ago.  These are the last bits that should empty out the “to-blog” hopper so I can turn all focus on that one.

Forensics and PenTest LiveCD News

Land Ahoy! DEFT 6 RC is OUT! - Stefano Fratepietro recently announced the “RC” release of the next DEFT iteration.  I’ve been playing with it and am very impressed with the polish and inclusions.  See his inclusions page to see what is loaded in, and check out the sexy-cool screenshot page for all the glamor and glitz.

CAINE 2.0 Live CD - “NewLight” Edition - Not to be outdone, the other highly-active LiveCD forensics distro CAINE had a final version release a while back.  Also highly updated with a “wax-on, wax-off” super-shine polish.  Check out this PDF version of Caine highlights as seen in Linux Magazine Online.

Katana 2.0 - A multi-boot “LiveUSB” distro from Hack from A Cave also got a November 2010 update. CAINE and Kon-Boot got added alone with some new Windows tools.  Maybe unknown to some, it also packs the Katana Tool Kit, based on a PortableApps launcher.  Like other distros, it provides a convenient manner to launch Windows-based tools from a nicely organized menu if using the tool in a Windows environment; rather than using one of the included distros to boot a system.

BackTrack Linux 4 R2 - The venerable penetration testing distribution packs a mean wallop!  You might want to look at both their Forensics page to find some features that might be useful. Also stop in on this SecurityOrb blog-post: BackTrack 4 Tutorials, Manuals and Howtos full of good resources.

Windows Forensic Environment Blog by Brett Shavers covers all things in the WinFE world.  Check out this wonderful post Updated video and other things to get a quick review on how the WinFE build it constructed.  Meanwhile we wait patiently for his magnum-opus WinBuilder based - WinFE creation tool to get released.

The Reading List

Windows Incident Response: Stuff - Great info on timeline thoughts from Harlan Carvey.

Reviewing Timelines with Excel - Journey Into Incident Response - Really great takeaway from Corey Harrell hopped to via Harlan’s post above.

Memory Analysis with Mandiant Memoryze - Digital Forensics How-To from the SANS Computer Forensics & Incident Response blog.  See also their post Persistence Registry keys.

The Digital Standard: The “Not So” Perfect Keylogger - cepogue has provided an interesting keylogger breakdown with lots of cross-response application.

JL’s stuff: Identifying Memory Images - In case you get an image with no clear information as to what system OS it was running under.

Open Source Digital Forensics - Bookmark this site to keep an eye on old and new tools in the Open Source forensic area.  Tools, paper, procedures and some test-image links available.

Derek Newton « Information Security Insights - Not really sure how I ended up exactly on Derek’s site but it is a gem.  Not only has he collected and organized some really nice Useful Links and Forensic Tools sub-pages, but his posts are always very educational.  For example, two recent posts:

• Searching the Registry using PowerShell
• Quick Tip: PowerShell Grep Equivalent

Finally, utility-building guru Nir Sofer offers all a Happy New Year To All NirSoft Users ! and then proceeds to tease us with some possible tools under development for the new year!  Awesome!

Wi-Fi Focus

A quick scan of the Wi-Fi surrounding the Valca home shows a total of 7 Wi-Fi networks with two of them wide-open and completely unsecured.  With really handy freeware tools such as the inSSIDer 2.0 Wi-Fi Scanner or NirSoft’s WirelessNetView or the eye-candy rich Xirrus Wi-Fi Inspector it is easy work finding and locating such things.

In his post How to capture data and passwords of unsecured wireless networks with SniffPass and SmartSniff, Nir Sofer shows just how easy it is to start grabbing data from unsecured networks.

I can’t recommend you test this on any network you don’t own or manage but if you are doing pentesting or an incident response involving a possible rogue Wi-Fi operation inside your network operations area, this could be a very valuable technique in some cases.

You might also find this MakeUseOf post 7 Completely Free VPN Services To Protect Your Privacy helpful.  Just saying…

“All-in-One” Forensic Tool?

At the risk of sounding like a fairly-recent Windows Phone 7 "Really?" TV Commercial (YouTube), I’m always very fascinated when I see a tool that honestly tries very hard to roll-up many “incident response” features into a single package. 

Like all such incident response tools, please understand and use the tools in a structured manner so as to not operate with a false sense of security…and potentially do more harm than good. Specifically, is use part of a larger and structured incident response plan, has the tool been seriously vetted, what key things does it NOT do that must be captured using alternative/supplemental tools?

Case in point just peruse this short-list of thoughts on the complexities of incident response from the pros:

• WinFE and Triage - Brett Shavers WinFE Blog
• Timelines - Harlan Carvey’s Windows Incident Response blog
• Looking for "Bad Stuff", part I - Windows Incident Response blog
• Summit Takeaways - Windows Incident Response blog
• Why current IR models don’t work, part deux - Windows Incident Response blog
• The need for IR training - Windows Incident Response blog

I ponder these things as I saw a new tool mentioned recently in the MakeUseOf site Investigate Or Troubleshoot Computer Systems With OSForensics [Windows]

It outlines a new (currently freeware) “many-in-one” forensic/digital-investigation tool by PassMark Software - OSForensics.

To PassMark’s credit, a look at the features shows it contains a very well rounded selection of components.  I’m not really fussing about the tool or its capabilities here.   I’m sure their target audience for the product are trained and harried professional incident-responder folks.  It is part of a number of tools offered by them, including ones to LiveCD boot a target system to capture an image as well as a tool mount the image file for processing with their OSForensics product.  So there is a unified structure to the tools.  Hopefully users will see these integrated parts and use them correctly in concert to process a system that preserves the integrity (ie, minimal/no write-back) to the target system.  PassMark has provided the toolset package.

I’m just curious how many untrained “incident responders” might jump on this tool based on its capabilities and convenience the first time someone hollers about a breach or incident and tosses this tool at the “live” target system. What will the aftermath be?

Of course, that situation probably occurs each and every day with any number of freely and publically available tools used by both “amateur” and certified professional incident responders alike.

That said, OSForensics rounds up quite a wide-range of useful tools and features into a very well organized and accessible package.  The interface is highly navigable.  I’m sure there are tools here for both the sysadmin-troubleshooter and the incident-responder alike to like and appreciate.  Of special note and appreciation is the offering of several “Hash Set” packages to add to OSForensics when scanning a system to rule-out known system files from suspect files worth closer inspection. It also include a “timeline view” function to provide understanding on system events and activity.

Did I mention that it is offered in both x32 and x64 bit versions? Nice!

PassMark is very active in releasing updates to their beta product so development and improvement of the tool is clearly serious stuff here.

My one “gripe” at this point is the decision to require a full system install first, then from there create a OSForensics - Install OSForensics to a USB Flash Drive build.  I’d rather they take a tip from Piriform and just offer both the full-install or “standalone/zip” packages outright.  It would definitely save time and effort in the updating process considering the frequent update release.  Not a major issue, but something to consider.

Definitely PassMark has brought a handy toolset package to be added to your USB stick for all system admins and incident responders.  I’ve added to to my USB drive.

PassMark also offers some other freeware Tools for OSForensics tools that you may be interested in exploring which round out the full toolset for a response and review:

OSFClone - A freeware “LiveCD” tool to create a dd-based disk-image clone for use with PassMark’s tools (or other tools that support such image files).

OSFMount - Used to mount local disk image files to a drive letter. OSFMount has been released in both x32 and x64 bit versions. (Is it just me or does the drive-mount window look very similar to Olof Lagerkvist’s ImDisk freeware tool?)

  versus  .

So if you are comfortable using ImDisk you will be at home with OSFMount as well (if you don’t want to stick with ImDisk for some reason I guess…).

Update: A close reading of the “read-me” file included in the OFSMount package nicely does credit Olof’s ImDisk as the initial base for this utility, thereby explaining the similarity!

ImageUSB - freeware tool to create or write-back images to/from USB flash drives.

Check ‘em all out!  Just deploy wisely.

While looking at Olof Lagerkvist’s ImDisk freeware tool page making sure I wasn’t going crazy with the similarity in GUI, I see he is now offering a seriously updated Beta 1.4.0 version of ImDisk that was released on Dec 7th. Super sweet New Year bonus!

Per Olof’s Update description (bottom of list) for ImDisk Beta 1.4.0, I’m quoting below:

• Beta release ImDisk Virtual Disk Driver version 1.4.0:
• Corrected a serious bug that seems to have particularily caused blue screen crashes on 64 bit Windows versions on multi-processor computers. Thanks to Bruce Cran for helping the project with debugging on 64 bit architecture.
• Graphical user interface, that is Control Panel applet and right-click menu option in Explorer now shows option to add MBR (Master Boot Record) while saving disk contents to image file.
• Algorithm for selecting default virtual disk geometry (C/H/S geometry) for virtual hard disk volumes changed. From this version, driver will auto-select 255/63/512 geometry in most cases. Only exception from this is when virtual disk is smaller than about 2 GB in which case smaller tracks per cylinder size is choosen. User defined virtual geometry can still be manually selected using command line or API directly.
• ImDisk source archive now contains a subdirectory called ImDiskNet. This is a .NET dll file which could be used from for example VB.NET or C# to create/modify/delete/save etc virtual disks. This dll also contains a class that can be used as a COM object from VB6 or VBScript etc. This dll is also available for direct download here.
• 64 bit setup now installs 32 bit imdisk.cpl and imdisk.exe in addition to the usual 64 bit versions. This means that API calls and command line calls will work from 32 bit applications even on 64 bit Windows without tweaking with installing dlls manually in correct directories etc.
• Updated "devio" tool. This version supports both reading and writing dynamic resizing .vhd files used by Microsoft Virtual PC, Virtual Server and Hyper-V. Earlier version had a serious bug that would corrupt disk image when mounted for both reading and writing.
• Changed notification that is sent to other applications when a new virtual disk is created. ImDisk does no longer wait for all applications to process the notification. It however still waits for all applications to process the notification that is sent when a virtual disk is about to be deleted.

Did you catch that? Devio got updated as well. For more information see this old GSD post: Devio: Remote drive access and acquisition.

Maybe OSForensics can incorporate Devio in their forensic solution package(s) somehow as well in the future for “agent-based” capture of a remote system from within OSForensics?  Just another suggestion.

From Sweden with Love

Erik Hjelmvik, creator of the beloved NetworkMiner Network Forensic Analysis Tool (NFAT) and Packet Sniffer as well as the SplitCap - open source pcap file splitter also offers his SPID Statistical Protocol IDentification project also for Windows systems.

Erik also recently published an article recently titled Network Neutrality and Protocol Discrimination over at CIO.com that shows the application of his SPID tool.  Neat stuff.

Utils

Two more final utilities worth looking into:

USB Write-Blocker - Document Solutions, Inc.  Freeware tool you run-first before attaching a USB drive to look at.  It promises to prevent OS system write-back to the USB device once attached.  While certainly no substitute for a good, physical Forensic in-line USB WriteBlocker, once “proofed” for effectiveness on your analysis bench-system, it might be good software-based solution in a pinch.

BinPack: 2.0.1 Release - West Coast Hackers.  This “new” package release (actually back from August 2010) updates and rounds out a really cool pentest/security/response toolset manager.  Download the core files, then select, build and download the various independent software binaries from their developers and homepages.  Pick what you want; you can always go back and add/remove more later.

Happy hunting!

--Claus V.

Read More

Quick-Tip : Blu-ray tip for Sony SDP-S360

It’s been a long while, but we’ve been thoroughly tickled pink with our BDP-S360 Blu-ray™ Disc Player from Sony.

Quality has been awesome at full HD 1080p and it was a real steal at the price we paid to join the HD/Blu-ray crowd.

Only issue is that when I purchased and played the Blu-ray edition of Leap Year quite some time ago, when it reached a climactic scene near the end of the movie in the pub, I would experience extreme pixilation, playback freeze, and then a crash.  Mashing on the FF button usually kept it alive though the process but would jump to the end of the movie.

I kept looking for reports of bad-disk manufacturing error, but hadn’t found any.  The disk was clean and had no visible scratches or blemishes that might have interfered with play-back as far as I could tell.

So while researching another (unrelated) Blu-ray thing, it struck me that maybe the device codecs/DRM information might need to be updated on the Sony appliance.

I knew from the get-go that the unit came with a Ethernet port and could have the firmware updated either “on-line” or via manual burn & play of a firmware update CD.  When checked, it was sitting on version .002 as loaded at the factory.

I don’t keep it attached to the network so I had to temporarily string my super-long Cat-6 GeekSquad patch cord down the hall to plug in.

Following the on-line information on this Sony eSupport - BDP-S360-specific page, I

• Checked the Current Firmware Version (yep was as .002 and Sony offering .008 as most current), then,
• Followed the Network Upgrade Instructions

About 5-10 minutes later the system powered off after downloading and applying the firmware update.

With Alvis carefully shadowing me and providing additional guidance and encouragement, I powered it back on and re-tested my LeapYear Blu-ray disk and popped over to that chapter section of the disk that always caused the player to bork-out.

Perfect playback.

So, lesson learned, if you have a Blu-ray player and it supports  updating of the firmware, and you are experiencing play-back issues with disks, seriously consider checking your firmware version and update if available.

It might really spare you unnecessary aggravation.

Cheers!

--Claus V.

Read More