Sudo doesnt work with "&&" and various other bash keywords

    Lets say I want to run apt update and upgrade one after another. Typically you do this with:

apt-get update && apt-get upgrade

    Unfortunately, oftentimes you need root permissions to do that. So a person will usually simply type:

sudo apt-get update && apt-get upgrade

    And if you hit enter, "apt-get update" will run successfully and "apt-get upgrade" will fail. This is do to the fact that when you hit enter, bash has to interpret the line you just submitted. And according to the rules of bash, your line was interpreted to mean three things. First run "sudo apt-get update" then if that returns an execution code of 0, then continue to "apt-get upgrade".
    What you want to do is send your WHOLE line to sudo for execution. You do this with the "-s" argument of sudo. so that:

sudo -s 'apt-get update && apt-get upgrade'


Of course my short way is usually simply typing "sudo !!" after i mess up the line, it works just fine.

Learning to love the man

manpages are awesome. some people tend to think there are only manpages for programs, which is completely not true. take for example "man ascii" or "man hier" which display the ascii tables and an explanation of the purpose of each unix directory respectively. You can discover where the manpages on your system are located by executing 'manpath'. This will output a list of directories in a similar format to  "echo $PATH". Look through the directories to find the 7zipped files containing the manpage data.

I've gotten into the habit of opening each one just out of curiosity. Its actually kind of fun if you have nothing to do.

SSH Inception

I must go deeeeper -_-

I have a box on a network that is only accessible via connecting to multiple SSH boxes in succession. the "-t" option in ssh allows me to go straight through all the boxes using one line:

ssh user@vps.com -t ssh user@homeserver -t ssh user@home-desktop

You literally just chain together as many ssh connections as you'd like. They just pass the arguments on and on. If you alias that to something like:


et-phone-home="ssh user@vps.com -t ssh user@homeserver -t ssh user@home-desktop"

then you should be all set.

Supplying a file to metasploit rhosts

Apparently lots of people dont know you can do this... I will often parse things like FTP hosts into a file and then supply that file as the value of the RHOSTS option in metasploit. This makes it much easier for me to supply a crap ton of hosts without actually typing much of anything.

msfcli auxiliary/scanner/ftp/anonymous RHOSTS=file://root/clients/clientname/nmap/ftphosts E


Apparently it only takes absolute paths unforuntaely, but if your using msfcli instead of msfconsole, why not use bash to your advantage?


msfcli auxiliary/scanner/ftp/anonymous RHOSTS=file://$(pwd)/ftphosts E


That line works great if you're 10 directories deep and are too lazy to type.

EDIT:
I noticed I didn't actually talk about msfconsole, in case it wasn't obvious you do "set rhosts file:/root/blah/ftp.hosts" or whatever your file is and it will take it.

Doesnt work if the module only takes on host though :(

Delete conflicts in known_hosts

Often times i will connect to an ssh server in one network and so some work. Later on, I will move somewhere else and connect to some other network and have to ssh in. Incidentily i'm ssh'ing into two different servers that happen to have the same IP (even though they are two completely different networks). I know whats going on here and i'm doing it all on purpose. Unfortunately ssh still likes to freak out that this IP now magically has a new public key. cool story bro, i already knew.


I got sick of every time this happened to have to go into known_hosts and delete that entry. ssh will always tell you the line number that contains the conflicting key, so all i have to do is delete that line from known_hosts and bam. i'm done.  So i came up with this little function to make my life easier:

ssh-del-line() {

    if [[ -z $1 ]]; then

        echo 'Deletes the specified linenumber from ~/.ssh/known_hosts'

        echo 'Usage: ssh-del-line linenumber'

    else

        sed -i "/$1/d" ~/.ssh/known_hosts

    fi; }

A better way to expand hosts in a subnet

Before i mentioned that you could expand the hosts in a subnet by using bash brace expansion. While that works fine, if you have a file with 40 different CIDR subnets in them it can be REALLY annoying. In walks nmap.
Nmap has a scan feature called list scan that will output the IPs to be tested. All you need to do is supply it with a range/file-with-ranges and it will output the IPs, one in a line. The output may be a little ugly so i created a quick function to parse out just the IPs

expandrange() {
    if [[ -z $1 ]]; then
        echo 'Expands the subnets/ranges provided in the first argument to output in the second argument (file)'
        echo 'Usage: expandrange range.cidr.txt range.long.txt'
    else
        nmap -sL -n -iL $1 | grep 'Nmap scan' | cut -d ' ' -f 5 > $2
    fi; }

Cisco VPN - Fix for Error 51: Unable to communicate with the VPN subsystem

sudo kextload /System/Library/Extensions/CiscoVPN.kext

CLI Twitter and Oauth

Since twitter no longer allows the "basic" authentication mechanism for posting tweets, it has moved over to a much more secure alternative: OpenAuth

Before it was as easy as creating a cURL line to post the contents to the twitter api. Things have gotten more complicated since then. I could describe everything, but someone else has already done a fine job of the walk-through:

http://talkfast.org/2010/05/31/twitter-from-the-command-line-in-python-using-oauth

Your MD5 is wrong

This is an annoying display of ignorance on the part of many people at certain conferences. They will enter a contest and often times the answer must be submitted in the form of an md5 hash. So they will solve the puzzle and the secret key to give them points will be "kittens". They need the MD5 of the string "kittens" so they run the following:

echo 'kittens' | md5sum
f261adc7c891836ecc58c62fb80c6e34

They submit that hash to the scoring engine and it says INCORRECT, TRY AGAIN. "Well wtf...lets check our answer again". *1 minute later* "yeah its definitely right, their scoring engine must be broken or something"

I've heard that muttered all too often at contests and it makes me cringe. Here is what went wrong, and the scoring engine is working perfectly fine, you just dont understand how echo works. It helps if we look at things with our hexray vision.

echo 'kittens' | xxd -p
6b697474656e730a

you see that? whats that last character? '0a' - if you look up what '0a' means in the ascii table (man ascii), you will see that it represents  the new line. echo, BY DEFAULT, appends a new line to whatever string you wrote. That folks, is what fucked up your hash.

echo -n 'kittens' | xxd -p
6b697474656e73

now the 0a is gone. now pipe your new echo command into md5sum and you have the correct hash the scoring engine was expecting.

you could avoid the whole issue if you used printf instead of echo. To visualize this:


printf kittens | md5sum
84169a8d5b3289e8ece00d7735081b53  -

echo kittens | md5sum
f261adc7c891836ecc58c62fb80c6e34  -

echo -n kittens | md5sum
84169a8d5b3289e8ece00d7735081b53  -

just an fyi: apparently bsdutils of 'md5' have a -s for string argument that does it all in one go:


md5 -s kittens
MD5 ("kittens") = 84169a8d5b3289e8ece00d7735081b53

Bad Passwords and Password Complexity

I've heard this time and time again: "We are ok, we require password complexity". lulz, are you serious? I'm not even going to get into how bad windows "password complexity" or the rest of their policies are. I'm just going to remind people of this one simple truth:

Password policies only apply on new passwords.

Which means, if you had accounts before you enabled the policies, you may still be at risk for accounts with password of password, or same as username, or other really retarded "it would never happen to me" passwords.

This is the exact reason why I STILL find weak passwords in environments where password complexity is on, minimum password length of like 20. jimbob's password is still jimbob, because he created that password before the policies were enacted.

Solutions?

Well you could set every person's password to require a change on next login. and then set the password change interval for every 30 days. But, thats not enough. Because you could force every user to reset their password on login, but if there are accounts not being actively used, they will simply ask the attacker to change their password.

What I would do is this:

1. Temporarily turn off the account lockout threshold on the domain.
2. get a list of every user on every domain
3. use metasploit or medusa to try a decently sized dictionary file against all the users
4. make a note of all the users with weak passwords and either disable that account or change the password yourself
5. reenable the lockout threshold to something reasonable, like 3 or 4
6. make sure password complexity is on
7. make sure minimum password length is on, I would make it 15 to kill all chances of LM hashes being stored.
8. disable LM hashes ery'where

You also want to make sure to write up a basic "dont be a idiot with your passwords" email to distribute. Make it humorous so that its memorable, this way when someone is breaking the policy, it will be funny to their coworkers to belittle them. Make the minions do your policing for you.

Some simple "Human Password Policies"
1. Never write down your password anywhere - thats what your brain is for
2. Never give out your password to anyone, you dont give you safe combination to anyone do you?
3. You no longer have a Pass-"word", you have a Pass-"phrase", make it a sentence, a lyric, something funny only you will remember.
4. Like your wife said, the longer the better.