Get a chunk of PCAP from a larger PCAP

One way of extracting pcap within a time constrain.

 

#editcap -A "2013-02-19 05:19:00" -B "2013-02-19 05:21:00" Input.pcap output.pcap

http://www.thesprawl.org/research/packet-filtering/

Second method

wireshark -r input.tcpdump -w output.tcpdump -R 'frame.time >=  "Aug 15, 1990 00:00:00" && frame.time <= "Aug 15, 1990 00:01:00" 

SSH client predefine your Source Port

Hi

I was actually searching to see how I can set my source port to be of some fixed value while SSHing to a server,  I found the way in this link

http://www.linuxforums.org/forum/security/182001-how-do-i-specify-source-port-ssh-client.html

 These are all that you would be require to do.

# ncat -l 2222 --sh-exec "ncat SSH_SERVER_IP 22 -p 443"


From another terminal you can see that port 2222 is listening on my system locally

# netstat -antulp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      847/cupsd      
tcp        0      0 0.0.0.0:2222            0.0.0.0:*               LISTEN      13219/ncat    

Form another terminal I tried to ssh to my local machine port 2222.

$ ssh bala@localhost -p 2222
bala@localhost's password:
Linux SSH_SERVER_IP 2.6.32-5

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

bala@SSH_SERVER_IP:~$ exit
logout
Connection to localhost closed.
bala@bala-desktop:~$

Before I closed the connection shown above, I did this command from another terminal, which clearly shows that my source port to be 443.

bala@bala-desktop:~$ ss | grep 22
ESTAB      0      0               10.0.2.15:https        SSH_SERVER_IP:22

Bash Scripting examples

Example1:
This shows the usage of single quote and double quote.

#!/bin/bash
test="bla bla bla bla";
echo 'I read a sentence like $test inside double quotes';
echo "I read a sentence like $test inside double quotes";
apple='$test'; #Single quotes takes it as a literals
banana=\$test; #Backslash does the same thing
MYIP=`ifconfig eth0 | grep inet | cut -d: -f2 | cut -d" " -f1`;
echo "My IP address is $MYIP";


Example2:
This shows the if condition operation.

#!/bin/bash
fruit1="apple";
fruit2="banana";
if [ $fruit1 != $fruit2 ]
then
   echo "$fruit1 is not equal to $fruit2";
else
   echo "$fruit1 is equal to $fruit2";
fi
# -n is for non empty & -z is for zero length
if [ -n $fruit1 ]
then
   echo "Fruit1 is not the empty string";
else
   echo "Fruit1 is an empty string";
fi

Example3:
#!/bin/bash
# -eq equal, -ne notequal
# -gt (greater than), -ge (greater than or = 2)
# -lt (less that), -le (less than or = 2)
num1=5;
num2=10;
num3=15;
if [ $num1 -ge $num2 ]
then
   echo "$num1 is greater than or equal to $num2";
else
   echo "$num1 is less than $num2";
fi
let num4=$num1+$num2;
if [ $num4 -eq $num3 ]
then
   echo "$num4 is equal to $num3";
else
   echo "$num4 is not equal to $num3";
fi

Example4:
#!/bin/bash
# -r is read permission set, -w for write, -x for execute
# -d (is the file a directory), -f for file, -s non-empty file
dir1=/home/bala;
file1=/tmp/script.sh;
if [ -d $file1 ]
then
   echo "$file1 is a directory";
else
   echo "$file1 is not a directory";
fi
if [ -x $file1 ]
then
   echo "$file1 is executable";
else
   echo "$file1 is not executable";
fi
if [ -r $dir1 -a -x $dir1 ]
then
   echo "$file1 is readable N executable";
else
   echo "$file1 is not both read & executable";
fi

Example5:
#!/bin/bash
#This script is going to loop into useraccount
passFile=/etc/passwd
userCount=0;
specialCount=0;

userIds=`cat $passFile | cut -d: -f3`;
echo $userIds;
for id in $userIds
do
    if [ $id -ge 1000 ]
        then
            echo $id
            #echo $userCount
            let userCount=userCount+1;
            #echo $userCount
        else
            #echo $specialCount
            let specialCount=specialCount+1;
    fi
done
echo "There are $userCount normal users and $specialCount special users on the system"

Recover Ubuntu from initramfs

Today I powered up my Ubuntu 10.04 on my VM and all of a sudden it complained that it cannot load my OS and gave me (initramfs) prompt and I started searching on the net regarding the same, Many said that the grub may be at fault or the Grub does not know where to look for to mount the Root of the file system from.

I attached a LiveCD to my VM and went into try Ubuntu and once that opened I opened up GParted to see if the partitions are still in there.  I tried to mount the harddisk locally by clicking on Places and the harddisk.   It got mounted normally.  Then I rebooted the system and remove the Live CD in the process.  The VM eventually came back telling that there were some orfan inodes which if needed I can press "F" to fix I did that and the system rebooted once again and my Ubuntu on VM started working :-D  I know every situation may not be as lucky as this.

Updating Flash on Ubuntu 10.04

On one of my machine I had Ubuntu 10.04 which got its Firefox upgraded to 15, so from then on when ever I opened Firefox it would connect to Mozilla's website to check if all the plugin are upto date and it kept complaining that Flash is out of date. It also gave me a small button next to it to fix the issue.  So I clicked it and downloaded the tar.gz file, extracted it.

Then move the old libflashplayer.so to old.

# mv /usr/lib/mozilla/plugins/libflashplayer.so /usr/lib/mozilla/plugins/libflashplayer.so_old

Then copy the libflashplayer.so from the extracted tar.gz file to the location.

# cp -rvf /home//Downloads/software/Adobe\ Flash/install_flash_player_11_linux.x86_64/libflashplayer.so /usr/lib/mozilla/plugins/libflashplayer.so


Restart the browser, The plugin check should not complain once again.  Then go ahead and remove the old libflashplayer.so_old file.

# rm /usr/lib/mozilla/plugins/libflashplayer.so_old

Fixed DVD Driver not opening

Wow I have never removed almost all the components of a DVD drive and put them back togather to this extent.

LG DVD tray opening problem, It stopped opening even when I take a pin and push the pin hole.

Note:  I don't take responsibility if you break you DVD by following my steps.

Step1: Remove the drive from CPU by removing all the screws.
Step2: Remove Four Screws to remove the back plate of DVD drive.
Step3: Detach two sets of Ribbon cable from the main board and remove the board, be careful there are two more cable behind the board as well.
Step4: Now you can just see under side of the board where in two more cable are attached.  The smaller Ribbon cable will pop out as soon as you pull it, However the larger one is clipped down, we have to move the clip up before pulling the largest Ribbon Cable.
Step5: Remove the assemble which holds the Lens by unscrewing two screws towards the end of the box.  The other side is just held with Rubber which can be squeezed to pull them out.
Step6: Now remove the Plastic where the Rubber was attached to the Lens assembly.
Step7: Now remove the Tray by sliding it out,  Here I broke a small notch as I did not know how to remove it.
Step8: Now clean all the place where you see movement and I applied Lip Vaseline.
Step9: Do all the steps shown above in reverse :-)
Step10: You have now breathed new air into your old DVD which was about to be dumped :-D Hurray.

Analyzing a Snort Alert

Yesterday I was going about doing my things and suddenly noticed that there were three alerts on my IDS with the signature shown below.

I tried looking at the payload it was really huge like shown below.

I tried looking up the IP http://whois.domaintools.com/91.229.143.59 however I did not get any information useful to me.

I wanted to clean up the payload shown above to see just the URL, so I used the command as shown grep http tmp.txt | cut -d" " -f1 | grep \' | cut -d\' -f1

Well fair enough except the first one all the others does seem to be malicious, so I set out seeking my Web Proxy logs to see how did I land up on the IP.

One look at the proxy logs I almost felt like a amnesia patient getting back his\her memories :-D, because yesterday I was using urlquery.net for some experiment which I was performing. 

Bottom line: Long story short it really pays to have logging enabled to determine if an incident is a false positive or not :-)