R3verse - Linux Hardning guide v.1

▄▀ Linux Hardening distribution tutorial provided by ▄▀

Rquirements:

[*] Linux distribution 64 bit or 32 bit.
[*] Knowledge of basic linux commands! 
[*] Knowledge behind the scenes of executing linux commands
[*] Encryption knowledge



I will like to thank the following for motivating me, to provide,
this tutorial right here, and why it's neccesary!.
In my opinion, you gotta treat shell access, like it is physical access!.
Before we start, I would like to give some credit around here.

Thanks to:

HAK5

There is several ways of hardening linux distributions!.
In this scenario, we will dive into Ubuntu, and we will enumerate,
my way of doing it, in a linux environment.

Okay, so let's dive right into it.
No more wasting time, doing 1337 copy + paste, of any source code!,
Now I, breakdown concept tools, and techniques, for hackers, network gurus, and IT ninjas.
It's all about to make internal/local security, at your Linux box!. Off we go...

This thread will cover, How To Linux Hardening, with my opinion

[*] Encrypt files with GPG
[*] Chattr
[*] Encryption on harddrive partition
[*] Linux Distributions & scripts to hardening!
[*] Umask benefits!


GPG encryption folders & files

So basically GPG & GPGdir, is a tool provided by default in most likely,
any linux distribution. You might want to enumerate your own way of encrypt,
a file/directory. In this scenario, I'm going to show you the way I do, for hardening my own Linux environment.

Below here you will see my output from my terminal,
this indicates how gpg works when I entered a pass phrase,
and used cat to view the output.

Code:

root@r3verse-M11x:/test1# cat test2.txt
hello there
root@r3verse-M11x:/test1# gpg -c test2.txt
gpg: gpg-agent is not available in this session
root@r3verse-M11x:/test1# ls -l
total 8
-rw-r--r--. 1 root root 12 Apr 30 23:44 test2.txt
-rw-r--r--. 1 root root 60 Apr 30 23:45 test2.txt.gpg
root@r3verse-M11x:/test1# cat test2.txt.gpg
% ��
�+��Y�� ���-�y~�
����(Ԉ[�7�"����;,x8����root@r3verse-M11x:/test1#

Resources:

GPG - file encryption
http://www.cyberciti.biz/tips/linux-how-...sword.html

GPGdir - directory encryption
You might, want to study this on your own!
http://cipherdyne.org/gpgdir/download//


Chattr - user privileges attributes

Okay, we now explained how GPG works, now let's dive into
Chattr, which you mind find a bit tricky.

As you may see in this scenario, we set our attribute on test2.txt
afterwards we determine, which file had the immunate flag "i". Below you will find my output,
and which kind of access to the file I have.

Code:

root@r3verse-M11x:/test1# chattr +i test2.txt
root@r3verse-M11x:/test1# lsattr *
----i--e- test2.txt
root@r3verse-M11x:/test1# ls -l
total 4
-rw-r--r--. 1 root root 12 Apr 30 23:44 test2.txt
root@r3verse-M11x:/test1#

Even if you try to nano test2.txt
and try to modify this bit of code, you WONT,
be able to.. even as root!. ;-) scary huh?. This is my output...

Now imagine, how great is this security enchance!?..
Pretty good right.

To remove the file simply, use the command below.
I just added a minus symbol instead of a plus..
You can now change permissions by chmod or remove it by rm,
in the way you want!.

Code:

root@r3verse-M11x:/test1# chattr -i test2.txt

WARNING - BIG IMAGE!

Spoiler (Click to View)

Encryption on harddrive partition


We all know of Truecrypt right...Well this is ONE solution.
To point it out, we have of course several ways of disk encryption!..
Such as How-To by David Braun
The other ones, I have to credit my own study. :).

Below here, you can find more info on it. I won't dive into it, since I'm trying,
to keep this tutorial small and smooth to understand n' follow!, for you to enjoy!

[*] Truecrypt
http://www.truecrypt.org/downloads

[*] Bastille
http://www.bastille-unix.org/running_bastille_on.htm

[*] Hardened Linux distribution
http://hardenedlinux.sourceforge.net/?sub=doc

[*] EnGarde
http://www.engardelinux.org/


Umask benefits!

To start off with, I have to say, you might think, well chmod is one way of
change the permissions of a file / directory. Right... well you might not know this yet then. :) ... We'll dive into it in a bit.

Definition of Umask:

A great tool provided to automate the permission assignments.
There is a standard permission for Umask, which set the permissions for files and folders,
which are created in an environment where 002, which means, the files which we focus on would be set with the permissions (rw-r--r--).
Folders will by default, used this command, being set to 775 (rwxr-xr-x).

We are focused on our own asset of security implementing,
of our own linux environment right?.

Now, the best solution for YOU, to implement by using the Umask command would be setting the file / folder to 0037.
This will gain the permissions 640 (rw-r--), and folders by default, 
will have permissions 750 (rwxr-x---).

Below here I show you how I create a file,
showing the permissions of the user by root, and what I did change it to.
Now imagine, if you had several users, you could set like in my case r3verse,
to only have the minimal amount of permissions!..

I have a basic rule. Don't ever make an attackers job easy!
EVER!.

My PoC here in this scenario:

Code:

root@r3verse-M11x:/test1# umask
0022
root@r3verse-M11x:/test1# umask 037
root@r3verse-M11x:/test1# umask
0037
root@r3verse-M11x:/test1# su r3verse
r3verse@r3verse-M11x:/test1$ touch test2.txt
touch: cannot touch `test2.txt': Permission denied
r3verse@r3verse-M11x:/test1$ ls
test2.txt
r3verse@r3verse-M11x:/test1$ ls .l
ls: cannot access .l: No such file or directory
r3verse@r3verse-M11x:/test1$ ls -l
total 4
-rw-r--. 1 root root 37 May  1 01:14 test2.txt
r3verse@r3verse-M11x:/test1$ umask
0002
r3verse@r3verse-M11x:/test1$

If you have any questions, regarding this thread,
please feel free to post a comment! ;-)

Standfords University - Cryptography Part 4!

Python Programming Week 4 Completed

BruteForcing

Programmerings opgaven var rimelig simpel, der skulle bare lidt SQL injection indblandet i programmeringsarbejdet.

Herunder her koden som jeg benyttede mig af for at extracte enhver byte af de hexidecimaler fra hjemmesiden, til at kunne løse opgaven!

#! /usr/bin/env python import urllib2 import sys from time import sleep def strxor(s1, s2): return "".join([ chr(ord(c2) ^ ord(c1)) for (c1, c2) in zip(s1, s2)]) def strrep(s, sub, pos): endpos = pos + len(sub) return s[:pos] + sub + s[endpos:] TARGET = 'http://crypto-class.appspot.com/po?er=' #-------------------------------------------------------------- # padding oracle #-------------------------------------------------------------- class PaddingOracle(object): def query(self, q): target = TARGET + urllib2.quote(q) # Create query URL req = urllib2.Request(target) # Send HTTP request to server try: f = urllib2.urlopen(req) # Wait for response except urllib2.HTTPError, e: return e.code return 200 start_query='f20bdba6ff29eed7b046d1df9fb7000058b1ffb4210a580f748b4ac714c001bd4a61044426fb515dad3f21f18aa577c0bdf302936266926ff37dbf7035d5eeb4'.decode('hex') def try_byte(query, byte_at, pad): po = PaddingOracle() g200 = None def try_guess(g): sleep(0.1) g200 = 0 last = query[byte_at] last = chr(ord(last) ^ pad ^ g) q = strrep(query, last, byte_at) http_status = po.query(q.encode('hex')) if http_status == 404: print "Good padding found: 0x%02x" % g return g if http_status == 200: g200 = g # if http_status not in (200, 403): print " 0x%02x failed (%d)..." % (g, http_status) return g200 if try_guess(0x09): return 0x09 if try_guess(0x20): return 0x20 for i in xrange(0x7f, 0x00, -1): if try_guess(i): return i for i in xrange(0x80, 0xFF): if try_guess(i): return i if g200: print "Assuming: 0x%02x" % g200 else: print 'Failed to guess query[%d]' % byte_at return g200 def oracle_byte_s(query, guess, start, end): for i in xrange(end - 1 - len(guess), start - 1, -1): print 'Guessing query[%d]' % i padlen = end - i subst = strxor(strxor(query[i+1:end], guess), chr(padlen) * padlen) q = strrep(query, subst, i+1) g = try_byte(q, i, padlen) if g is None: print ' Failed.' return None guess = chr(g) + guess return guess def oracle_bytes(query, start, end): return oracle_byte_s(query, '', start, end) if __name__ == "__main__": s3 = oracle_bytes(start_query, 32, 48) s2 = oracle_bytes(start_query[:48], 16, 32) s1 = oracle_bytes(start_query[:32], 0, 16) print s1 + s2 + s3