петък, януари 06, 2023

Notepad++ Find & Rеplace IP Addresses

 Find & Rеplace IP Addresses in TXT file Regular Expression/ RegEx IP

 

За намиране на адрес без маска -        (\d{1,3}\.){1,3}\d{1,3}\/\d{1,2}

За намиране на адрес с маска -             (\d{1,3}\.){1,3}\d{1,3}\/\d{1,2}\/d{2}

 

CTRL+H

((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.){3}(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))



Replace 10.0.0.%2 with %1

  • Ctrl+H
  • Find what: (10(?:\.\d{1,3}){3})%2
  • Replace with: $1%1
  • Replace all

Explanation:

(               : start group 1
  10            : literally 10
  (?:           : start non capture group
    \.\d{1,3}   : a dot followed by 1 to 3 digits
  ){3}          : group must appear 3 times
)               : end group 1
%2              : literally %2

  • Check regular expression
  • DO NOT CHECK . matches newline

Replacement:

$1      : content of group 1
%1      : literally %1

 

Or another option:

 

  • Ctrl+H
  • Find what: ^.+?((?:\d+\.){3}\d+).+$
  • Replace with: $1
  • check Wrap around
  • check Regular expression
  • DO NOT CHECK . matches newline
  • Replace all

Explanation:

^           : beginning of line
.+?         : 1 or more any character but newline
(           : start group 1
  (?:       : start non capture group
    \d+     : 1 or more digit
    \.      : a dot
  ){3}      : end group, must appear 3 times
  \d+       : 1 or more digit
)           : end group 1
.+          : 1 or more any character but newline
$           : end of line

Replacement:

$1          : content of group 1 (ie. the IP)

Result for given example:

54.246.81.158
175.36.129.24

To be sure you have an IP address, use

((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?\.){3}(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)))

instead of

((?:\d+\.){3}\d+)

 

From <https://superuser.com/questions/1321363/how-to-extract-ip-address-from-the-logs-string-with-regular-expression-and-note>

 

Notepad++ replace/remove a line containing sting

 

Replace/remove the line containing word < string>

 

Find/Replace dialog and with regex:

 

1.  Ctrl + h to bring up the find replace dialog.

2.  In the Find what: text box include your regex: .*string.*\r?\n (where the \r is optional in case the file doesn't have Windows line endings).

3.  Leave the Replace with: text box empty.

 

    Make sure the Regular expression radio button in the Search Mode area is selected. Then click Replace All and voila! All lines containing your search term help have been removed.

 

 

  • Go to the search menu, Ctrl + F, and open the Mark tab.
  • Check Bookmark line (if there is no Mark tab update to the current version).
  • Enter your search term and click Mark All
    • All lines containing the search term are bookmarked.
  • Now go to the menu Search → Bookmark → Remove Bookmarked lines
  • Done.

петък, юли 15, 2022

Check remote computers for open UDP ports with PowerShell (ext. script) 2

Minimalistic-offensive-security-tools/port-scan-udp.ps1 at master · InfosecMatter/Minimalistic-offensive-security-tools · GitHub 

Function port-scan-udp {

  param($hosts,$ports)

  if (!$ports) {

    Write-Host "usage: port-scan-udp <host|hosts> <port|ports>"

    Write-Host " e.g.: port-scan-udp 192.168.1.2 445`n"

    return

  }

  $out = ".\scanresults.txt"

  foreach($p in [array]$ports) {

   foreach($h in [array]$hosts) {

    $x = (gc $out -EA SilentlyContinue | select-string "^$h,udp,$p,")

    if ($x) {

      gc $out | select-string "^$h,udp,$p,"

      continue

    }

    $msg = "$h,udp,$p,"

    $u = new-object system.net.sockets.udpclient

    $u.Client.ReceiveTimeout = 500

    $u.Connect($h,$p)

    # Send a single byte 0x01

    [void]$u.Send(1,1)

    $l = new-object system.net.ipendpoint([system.net.ipaddress]::Any,0)

    $r = "Filtered"

    try {

      if ($u.Receive([ref]$l)) {

        # We have received some UDP data from the remote host in return

        $r = "Open"

      }

    } catch {

      if ($Error[0].ToString() -match "failed to respond") {

        # We haven't received any UDP data from the remote host in return

        # Let's see if we can ICMP ping the remote host

        if ((Get-wmiobject win32_pingstatus -Filter "address = '$h' and Timeout=1000 and ResolveAddressNames=false").StatusCode -eq 0) {

          # We can ping the remote host, so we can assume that ICMP is not

          # filtered. And because we didn't receive ICMP port-unreachable before,

          # we can assume that the remote UDP port is open

          $r = "Open"

        }

      } elseif ($Error[0].ToString() -match "forcibly closed") {

        # We have received ICMP port-unreachable, the UDP port is closed

        $r = "Closed"

      }

    }

    $u.Close()

    $msg += $r

    Write-Host "$msg"

    echo $msg >>$out

   }

  }

}


# Examples:

#

# port-scan-udp 10.10.0.1 137

# port-scan-udp 10.10.0.1 (135,137,445)

# port-scan-udp (gc .\ips.txt) 137

# port-scan-udp (gc .\ips.txt) (135,137,445)

# 0..255 | foreach { port-scan-udp 10.10.0.$_ 137 }

# 0..255 | foreach { port-scan-udp 10.10.0.$_ (135,137,445) }

Check remote computers for open TCP ports with PowerShell (ext. script) 1

Minimalistic-offensive-security-tools/port-scan-tcp.ps1 at master · InfosecMatter/Minimalistic-offensive-security-tools · GitHub 

Function port-scan-tcp {

  param($hosts,$ports)

  if (!$ports) {

    Write-Host "usage: port-scan-tcp <host|hosts> <port|ports>"

    Write-Host " e.g.: port-scan-tcp 192.168.1.2 445`n"

    return

  }

  $out = ".\scanresults.txt"

  foreach($p in [array]$ports) {

   foreach($h in [array]$hosts) {

    $x = (gc $out -EA SilentlyContinue | select-string "^$h,tcp,$p,")

    if ($x) {

      gc $out | select-string "^$h,tcp,$p,"

      continue

    }

    $msg = "$h,tcp,$p,"

    $t = new-Object system.Net.Sockets.TcpClient

    $c = $t.ConnectAsync($h,$p)

    for($i=0; $i -lt 10; $i++) {

      if ($c.isCompleted) { break; }

      sleep -milliseconds 100

    }

    $t.Close();

    $r = "Filtered"

    if ($c.isFaulted -and $c.Exception -match "actively refused") {

      $r = "Closed"

    } elseif ($c.Status -eq "RanToCompletion") {

      $r = "Open"

    }

    $msg += $r

    Write-Host "$msg"

    echo $msg >>$out

   }

  }

}


# Examples:

#

# port-scan-tcp 10.10.0.1 137

# port-scan-tcp 10.10.0.1 (135,137,445)

# port-scan-tcp (gc .\ips.txt) 137

# port-scan-tcp (gc .\ips.txt) (135,137,445)

# 0..255 | foreach { port-scan-tcp 10.10.0.$_ 137 }

# 0..255 | foreach { port-scan-tcp 10.10.0.$_ (135,137,445) }

Check remote computers for open TCP ports with PowerShell

Fast and simple: 


Test-NetConnection -ComputerName 172.30.33.11 -Port 22

Script:

Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Force -Scope Currentuser

cd $env:temp

Start-Transcript -LiteralPath .\Test_results.txt

$ip = Read-Host -Prompt 'Enter server IP'

$p1 = Read-Host -Prompt 'Enter 1st port to test (ENTER or 0 to skip): '

$p2 = Read-Host -Prompt 'Enter 2nd port to test (ENTER or 0 to skip): '

$p3 = Read-Host -Prompt 'Enter 3rd port to test (ENTER or 0 to skip): '

Write-Host ""

Write-Host "Open ports test results:"

if ($p1 -gt 0)

{

if (Test-NetConnection -ComputerName $ip -Port $p1 -InformationLevel Quiet -WarningAction SilentlyContinue) {"Port $p1 is open" } else {"Port $p1 is closed"}

}

else {"No port - no test"}

if ($p2 -gt 0)

{

if (Test-NetConnection -ComputerName $ip -Port $p2 -InformationLevel Quiet -WarningAction SilentlyContinue) {"Port $p2 is open" } else {"Port $p2 is closed"}

}

else {"No port - no test"}


if ($p3 -gt 0)

{

if (Test-NetConnection -ComputerName $ip -Port $p3 -InformationLevel Quiet -WarningAction SilentlyContinue) {"Port $p3 is open" } else {"Port $p3 is closed"}

}

else {"No port - no test"}

Test-NetConnection -ComputerName $ip -TraceRoute -InformationLevel Detailed

Stop-Transcript

Set-ExecutionPolicy -ExecutionPolicy Undefined -Force -Scope CurrentUser


Start-Process notepad .\Test_results.txt



Retrieving IPsec VPN PSK key from Fortigate

The API entry point is ;

"https://x.x.x.x/api/v2/cmdb/vpn.ipsec/phase1-interface?plain-text-password=1?

The full http get would look like the following ;

curl -k -H "Authorization: rest_api_admin_user zw7q8QyGrHwtfrn8tkGyfNbnGGN7js" "https://192.168.1.99/api/v2/cmdb/vpn.ipsec/phase1-interface?plain-text-password=1?access_token=zw7q8QyGrHwtfrn8tkGyfNbnGGN7js"

The output and field for "psksecret": will show the text value. 

Account with API permissions is must

Ken Felix Security Blog: fortios how to recover ipsec-vpn PSK string in text format (socpuppet.blogspot.com)

 

Another method:  Retrieving passwords from Fortigate

вторник, април 05, 2022

Linux, allow SFTP only users (with shared and chroot-ed env)

Users must upload/download files only via sftp/scp (no ssh, local login) to a pre-defined directory.

Users must not browse other directories or list directory tree.

Multiply users may share single directory (e.g. list of users assotiated with particular organization)

1. Creating of local users and home/upload dir structure

adduser --no-create-home --home /opt/sftp/chroot/org1 --shell /bin/nosuch u1

adduser --no-create-home --home /opt/sftp/chroot/org1 --shell /bin/nosuch u2

addgroup sftp

adduser u1 sftp

adduser u2 sftp

mkdir -p /opt/sftp/chroot/org1/upload

chmod -R 0755 /opt/sftp/chroot/org1  # 755 is must

chown -R root:root /opt/sftp/chroot/org1 # owner=root is must

chgrp sftp /opt/sftp/chroot/org1/upload

chmod 0764 /opt/sftp/chroot/org1/upload


2. Edit sshd_config (after UsePAM yes)


Subsystem sftp internal-sftp -l VERBOSE -f LOCAL3 # VERBOSE and LOCAL3 are used for logging via rsyslog.d/sftp.log

Match Group sftp # only users members of sftp group are allowed

ChrootDirectory %h # chrooted to $HOME_DIR e.g. /opt/sftp/chroot/org1

 AllowTcpForwarding no

 X11Forwarding no

 ForceCommand internal-sftp  -l VERBOSE -f AUTHPRIV # force to use only sftp/scp but not ssh -> shell=/bin/such helps too


service sshd restart


3. Update rsyslog configuration by editing /etc/rsyslog.d/sftp_log.conf

input(type="imuxsock" Socket="/opt/sftp/chroot/org1/dev/log" CreatePath="on")

local3.*                                                /var/log/sftp_org1.log

AUTHPRIV.*                                                /var/log/sftp_org1.log


4. Test 

tail -n 20 /var/log/sftp_org1.log

Apr  5 17:42:53 vs sshd[32700]: pam_unix(sshd:session): session opened for user u1 by (uid=0)

Apr  5 17:42:54 vs internal-sftp[32723]: session opened for local user u1 from [1.2.3.4]

Apr  5 17:42:54 vs internal-sftp[32723]: received client version 3

Apr  5 17:42:54 vs internal-sftp[32723]: realpath "."

Apr  5 17:43:04 vs internal-sftp[32723]: realpath "/up"

Apr  5 17:43:05 vs internal-sftp[32723]: stat name "/up"

Apr  5 17:43:06 vs internal-sftp[32723]: opendir "/up"

Apr  5 17:43:06 vs internal-sftp[32723]: closedir "/up"

Apr  5 17:43:19 vs internal-sftp[32723]: opendir "/up/"

Apr  5 17:43:19 vs internal-sftp[32723]: closedir "/up/"

Apr  5 17:43:19 vs internal-sftp[32723]: lstat name "/up/file1.txt"

Apr  5 17:43:20 vs internal-sftp[32723]: remove name "/up/file1.txt"

Apr  5 17:43:23 vs internal-sftp[32723]: open "/up/file2.sftp" flags WRITE,CREATE,TRUNCATE mode 0644

Apr  5 17:43:23 vs internal-sftp[32723]: close "/up/file2.sftp" bytes read 0 written 854

Apr  5 17:43:27 vs internal-sftp[32723]: lstat name "/up/file2.sftp"

Apr  5 17:43:27 vs internal-sftp[32723]: stat name "/up/file2.sftp"

Apr  5 17:43:27 vs internal-sftp[32723]: open "/up/file2.sftp" flags READ mode 0666

Apr  5 17:43:27 vs internal-sftp[32723]: close "/up/file2.sftp" bytes read 854 written 0

Apr  5 17:43:36 vs internal-sftp[32723]: session closed for local user u1 from [1.2.3.4]

Apr  5 17:43:36 vs sshd[32700]: pam_unix(sshd:session): session closed for user u1



вторник, март 29, 2022

Generate test syslog message on Junos

 
The logger utility is a shell command, and so the user must first start a system shell by invoking the start shell command:

    user@Junos> start shell %

The logger utility has the following command syntax: logger -e EVENT_ID -p SYSLOG_PRIORITY -d DAEMON -a ATTRIBUTE=VALUE MESSAGE. Only the EVENT_ID is required, and it must be entered entirely in uppercase:

    % logger -e UI_COMMIT
    % logger -e UI_COMMIT -d mgd "This is a fake commit."

 Some syslog tips

I’m ONLY sending messages to external host 192.168.56.11 if the facility is ‘external’ AND the severity is ‘info’ or greater (ie. not debug) AND the regex of the message matches LICENSE. Otherwise, we’ll likely have a local catch-all configured with any-any to locally log messages we may not be explicitly interested in looking at on the remote server.

root@vSRX-NAT-GW> show configuration
system {
  syslog {
    host 192.168.56.11 {
      external info;
      match LICENSE;
    }
   file messages {
     any any;
     authorization info;
   }
   file interactive-commands {
     interactive-commands any;
   }
}


The following configuration command will transfer output from all activated traces to your syslog server: 

set system tracing destination-override syslog host 10.0.0.13 

To exclude some of traces to be send to remote syslog (for example dhcp): 

 set forwarding-options dhcp traceoptions no-remote-trace


To send information from syslog to every (currently) logged in user console:  (except matching regex "Login attempt")

set system syslog user * any critical
set system syslog user * authorization info
set system syslog user * interactive-commands notice
set system syslog user * match "!(.*Login attempt.*)"

сряда, януари 05, 2022

Hyper-V trunk port to VM

Passing through VLAN ID/tags to Hyper-V virtual machine NIC

This functionality is not exposed via the UI but here's an example of how to configure it via PowerShell.

Add-VMNetworkAdapter -SwitchName Switch -VMName "VmName" -Name "TrunkNic"
Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "100,101" -VMName "VmName" -VMNetworkAdapterName "TrunkNic" -NativeVlanId 1

 

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816585(v=ws.10)?redirectedfrom=MSDN#Anchor_2

https://docs.microsoft.com/en-us/archive/blogs/adamfazio/understanding-hyper-v-vlans

https://docs.microsoft.com/en-us/powershell/module/hyper-v/set-vmnetworkadaptervlan?view=winserver2012-ps&redirectedfrom=MSDN

понеделник, юни 28, 2021

Restorepoint - network device config backup

 https://www.restorepoint.com/

Restorepoint automates network configuration backup, recovery, compliance analysis, and change management for more than 100 network and security vendors. 

Nice mgmt interface with Oxidized or rancid is running under the hood. API/ansible/other DevOps tools.

четвъртък, май 20, 2021

Access files between WSL instances

 Preamble:

C:\Users\Ivan Popov>ver && wsl --list
Microsoft Windows [Version 10.0.19041.985]
Windows Subsystem for Linux Distributions:
Debian (Default)
kali-linux

ToDo: access files in $HOME on Debian wsl instance from kali-linux wsl instance 

Dunno how (and don't care actually) rootfs is mounted in Windows, but files are located here: 

C:\Users\%USERNAME%\AppData\Local\Packages\TheDebianProject.DebianGNULinux_76v4gfsz19hv4\LocalState\rootfs\home

(TheDebianProject.DebianGNULinux depends of installed distro)

In WSL current disk partitions are already mounted under /mnt/Disk_Letter

To access my debian_home from kali I executed: 

echo "sudo mount -B /mnt/c/Users/My\ Current\ WinUserName/AppData/Local/Packages/TheDebianProject.DebianGNULinux_76v4gfsz19hv4/LocalState/rootfs/ /mnt/deb/
" >> ~/.bashrc

[fstab entry should be in format /old_dir /new_dir none bind but for some reason didn't work]

The result:

$ls /mnt/deb/
total 620
drwxr-xr-x 1 root root   4096 May  3 23:31 .
drwxr-xr-x 1 root root   4096 May 20 15:59 ..
drwxr-xr-x 1 root root   4096 May 17 19:04 bin
drwxr-xr-x 1 root root   4096 Mar 20 00:44 boot
drwxr-xr-x 1 root root   4096 Apr  6 14:47 dev
drwxr-xr-x 1 root root   4096 May 17 19:04 etc
drwxr-xr-x 1 root root   4096 May  3 23:33 home
-rwxr-xr-x 1 root root 632048 May  5 00:48 init
drwxr-xr-x 1 root root   4096 Apr  6 14:48 lib
drwxr-xr-x 1 root root   4096 Apr  6 14:47 lib64
drwxr-xr-x 1 root root   4096 Apr  6 14:47 media
drwxr-xr-x 1 root root   4096 May  5 22:31 mnt
drwxr-xr-x 1 root root   4096 Apr  6 14:47 opt
drwxr-xr-x 1 root root   4096 Mar 20 00:44 proc
drwx------ 1 root root   4096 May  3 23:35 root
drwxr-xr-x 1 root root   4096 Apr  6 14:47 run
drwxr-xr-x 1 root root   4096 May  3 23:31 sbin
drwxr-xr-x 1 root root   4096 Apr  6 14:47 srv
drwxr-xr-x 1 root root   4096 Mar 20 00:44 sys
drwxrwxrwt 1 root root   4096 May 20 14:49 tmp
drwxr-xr-x 1 root root   4096 Apr  6 14:47 usr
drwxr-xr-x 1 root root   4096 Apr  6 14:47 var


петък, март 12, 2021

HA with ExaBGP

The idea is simple: convenient way to blackhole some prefixes (bogus, wellknown C&C, spam,malicious, personally predefined, etc)

I'm using Linux + exaBGP + python script to collect some prefixes from a list of sources; exaBGP holding BGP session with our 2 RR and announce generated list of prefixes with blackhole community.

 exaBGP  is a python application to interact with BGP networks

List of prefixes is generated by generate_blacklists.py 

https://drive.google.com/file/d/1XgksQVcb2rpabv8OVCBkFabR6YuQpxV9

The configuration itself is pretty straightforward  and self-explanatory 

1. to announce a single static route:

neighbor 192.168.0.1 {
router-id 192.168.0.10;
local-address 192.168.0.10;
local-as 12345;
peer-as 12345;

### optional

### hold-time 180;
### outgoing-ttl 1;
### capability {
### multi-session;
### }


family {
ipv4 unicast;
}
static {
route 10.0.0.1/32 next-hop self;

route 10.0.0/24 origin IGP as-path [10 20 30 30 30  ]  next-hop 192.168.2.1;

route 172.10.0.0/22 next-hop 192.168.2.1 med 200 community [30303:30303] split /24;

route 9.9.9.9/32 next-hop 192.168.2.1 extended-community [ target:120000L:123 origin:130000:1234 ];
}
}

### Or 

announce {
        ipv4 {
            unicast 10.0..0/24 next-hop 192.168.2.1 local-preference 200 community 30303:30303;
        }
    } 

A direct API command (via exabgcli <- for systemd https://github.com/Exa-Networks/exabgp/blob/master/etc/systemd/exabgp.service)

announce route 10.0.0/24 origin IGP as-path [10 20 30 30 30  ]  next-hop 192.168.2.1

2 servers; preview VIP is assigned as secondary IP; nginx listening on this "VIP"; if no output from curl == stop announcing VIP i.e. no incoming connections (ToDo: more detailed explanation about healthcheck and route announce)

process service-nginx {
run python3 -m exabgp healthcheck -s --name nginx --cmd "curl --fail --verbose --max-time 2 http://localhost" --start-ip 0;
encoder text;
}
neighbor 192.168.0.1 {
router-id 192.168.0.10;
local-address 192.168.0.10;
local-as 12345;
peer-as 12345;

api services {
processes [ service-nginx ];
}

} 

ExaBGP could be used for DDoS protection (with NetFlow/syslog/monitoring), Internet Watch Inerception, Traffic Engineering, Server's HA and any other SDN variations


Some useful links:

https://github.com/Exa-Networks/exabgp

https://vincent.bernat.ch/en/blog/2013-exabgp-highavailability

https://thepacketgeek.com/exabgp/

Part 1 : https://www.dasblinkenlichten.com/working-with-exabgp-4/

Part 2: https://www.dasblinkenlichten.com/building-static-routes-with-exabgp/

https://blog.plessis.info/blog/2020/02/11/haproxy-exabgp.html

 

 

Simple example from developer:

neighbor 192.168.127.128 {        
description "will flap a route until told otherwise";        
router-id 198.111.227.39;        
local-address 192.168.127.1;        
local-as 65533;        
peer-as 65533;        
### add and remove routes when flap.sh prints
### flap.sh should produce readable for ExaBGP output
### in proper ExaBGP API syntax
process loving-flaps {                
run etc/processes/flap.sh;        
}

1 - take your favourite language : perl, python, lua, C, shell, french !
2 - create a forever loop3 - print what you want to do ...
#!/bin/sh
# ignore Control C
trap
'' SIGINT
while `true`;

### that echo result is understandable for ExaBGP API
do echo "announce route 192.0.2.1 next-hop 10.0.0.1"
sleep 10
echo "withdraw route 192.0.2.1 next-hop 10.0.0.1"
sleep 10
done

Real life example:








neighbor 10.255.1.254 {
    router-id 10.255.42.1;
    local-as 65042;
    peer-as 65001;

    api services {
        processes [ watch-loghost, watch-mailhost ];
    }
}

process watch-loghost {
    encoder text;
    run python -m exabgp healthcheck --cmd "nc -z -w2 -u localhost 514" --no-syslog --label loghost --withdraw-on-down --ip 10.255.255.1/32;
}

process watch-mailhost {
    encoder text;
    run python -m exabgp healthcheck --cmd "nc -z -w2 localhost 25" --no-syslog --label mailhost --withdraw-on-down --ip 10.255.255.2/32;
}