Seguridad

Notas cortas de seguridad e inseguridad informática que me sirvieron en mi trabajo

Auditd

Process Accounting (PSACCT)

Exploits

Exploits útiles cuando vas a un lugar donde no se acuerdan el password de root

jessica_biel_naked_in_my_bed.c.gz Linux vmsplice Local Root Exploit - Linux 2.6.17 - 2.6.24.1

2009-linux-sendpage.c.gz Linux Kernel 2.4/2.6 sock_sendpage() Local Root Exploit

mempodipper.c.gz Escalada de privilegios remota con /proc/pid/mem write - Kernel 2.6.39 a 3.2

pty.c.gz CVE-2014-0196 DOS PoC [Written May 5th, 2014]

Understanding Bash fork() bomb ~ :(){ :|:& };:

Q. Can you explain following bash code or bash fork() bomb? :(){ :|:& };:

A. This is a bash function. It gets called recursively (recursive function). This is most horrible code for any Unix / Linux box. It is often used by sys admin to test user processes limitations (Linux process limits can be configured via /etc/security/limits.conf and PAM).

Once a successful fork bomb has been activated in a system it may not be possible to resume normal operation without rebooting, as the only solution to a fork bomb is to destroy all instances of it. [Warning examples may crash your computer] WARNING! These examples may crash your computer if executed. Understanding :(){ :|:& };: fork() bomb code

:() - It is a function name. It accepts no arguments at all. Generally, bash function is defined as follows:

foo(){ arg1=$1 echo '' #do_something on $arg argument }

fork() bomb is defined as follows:

:(){ :|:& };:

:|: - Next it call itself using programming technique called recursion and pipes the output to another call of the function ':'. The worst part is function get called two times to bomb your system.

& - Puts the function call in the background so child cannot die at all and start eating system resources.

; - Terminate the function definition

: - Call (run) the function aka set the fork() bomb.

Here is more human readable code:

bomb() { bomb | bomb & }; bomb

Properly configured Linux / UNIX box should not go down when fork() bomb sets off.

Extra

Perl exmaple:

perl -e "fork while fork" &

Python example:

import os while(1): os.fork()

Windows XP / Vista bat file example:

:bomb
start %0
goto bomb

UNIX style for Windows:

%0|%0

C program example:

#include int main() { while(1) fork(); }

Plz note that the fork bomb is a form of denial of service, so don’t run on production or unauthorized system.

Fuente

http://www.cyberciti.biz/faq/understanding-bash-fork-bomb/#comment-37097

How to: Prevent a fork bomb by limiting user process

Limiting user processes is important for running a stable system. To limit user process just add user name or group or all users to /etc/security/limits.conf file and impose process limitations.

Understanding /etc/security/limits.conf file

Each line describes a limit for a user in the form: <domain> <type> <item> <value> Where:

domain can be:

an user name

a group name, with @group syntax

the wildcard *, for default entry

the wildcard %, can be also used with %group syntax, for maxlogin limit

type can have the two values:

“soft” for enforcing the soft limits

“hard” for enforcing hard limits

item can be one of the following:

core - limits the core file size (KB)

value can be one of the following:

core - limits the core file size (KB)

data - max data size (KB)

fsize - maximum filesize (KB)

memlock - max locked-in-memory address space (KB)

nofile - max number of open files

rss - max resident set size (KB)

stack - max stack size (KB)

cpu - max CPU time (MIN)

nproc - max number of processes

as - address space limit

maxlogins - max number of logins for this user

maxsyslogins - max number of logins on the system

priority - the priority to run user process with

locks - max number of file locks the user can hold

sigpending - max number of pending signals

msgqueue - max memory used by POSIX message queues (bytes)

nice - max nice priority allowed to raise to

rtprio - max realtime priority

chroot - change root to directory (Debian-specific)

Login as the root and open configuration file:

# vi /etc/security/limits.conf

Following will prevent a “fork bomb”:

vivek hard nproc 300
@student hard nproc 50
@faculty soft nproc 100
@pusers hard nproc 200

Above will prevent anyone in the student group from having more than 50 processes, faculty and pusers group limit is set to 100 and 200. Vivek can create only 300 process. Please note that KDE and Gnome desktop system can launch many process.

Save and close the file. Test your new system by dropping a form bomb:

$ :(){ :|:& };:

Fuente

http://www.cyberciti.biz/tips/linux-limiting-user-process.html

Prevenir fingerprints

Como ayudar a que los fingerprint que realizen nuestros atacantes sean un poco menos exactos, configurar las sysctl de nuestro sistema de la siguiente manera:

net.ipv4.ip_default_ttl = 128
net.ipv4.tcp_timestamps = 0
net.ipv4.tcp_window_scaling = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_echo_ignore_all = 1
# Enable IP spoofing protection
net.ipv4.conf.all.rp_filter=1
# Disable IP source routing
net.ipv4.conf.all.accept_source_route=0
# Ignoring broadcasts request
net.ipv4.icmp_echo_ignore_broadcasts=1
net.ipv4.icmp_ignore_bogus_error_responses=1
# Make sure spoofed packets get logged
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

Conocer que procesos bloquean tal cosa

Uso: fuser [-fMuv] [-a|-s] [-4|-6] [-c|-m|-n ESPACIO] [-k [-i] [-SIGNAL]] NOMBRE...
fuser -l
fuser -V
Muestra que procesos usan los archivos, zócalos o sistemas de archivos indicados.
-a,--all muestra también los archivos no usados
-i,--interactive pregunta antes de finalizar (ignorado con -k)
-k,--kill finaliza los procesos que acceden al archivo NOMBRE
-l,--list-signals lista los nombres de señales disponibles
-m,--mount muestra todos los procesos que usan el sistema de ficheros o dispositivo de bloques con ese nombre
-M,--ismountpoint cumple la petición solo si NOMBRE es un punto de montaje
-n,--namespace ESPACIO busca en este nombre de espacio (archivo, udp, o tcp)
-s,--silent funcionamiento silencioso
-SIGNAL envía esta señal en lugar de SIGKILL
-u,--user muestra los ID de usuario
-v,--verbose salida detallada
-V,--version muestra información de la versión
-4,--ipv4 buscar solamente zócalos IPv4
-6,--ipv6 buscar solamente zócalos IPv6
- opciones de reinicio
nombres udp/tcp: [local_port][,[rmt_host][,[rmt_port]]]

Ejemplo si queremos ver que proceso nos bloquea el pendrive y no nos deja desmontarlo

$ fuser -m /dev/sdb1
/dev/sdb1: 13542

Que proceso bloquea el archivo /usr/local/nagios/var/nagios.lock

fuser /usr/local/nagios/var/nagios.lock
/usr/local/nagios/var/nagios.lock: 3178 13194 13342 13459 13472

Si queremos ver que PID usa el puerto 80 tcp.

fuser 80/tcp
80/tcp: 17233 17652 17870 18252 18779 19234 19484 19547 19621 19679 32454

Referencia útil como ver procesos escondidos: http://www.cyberciti.biz/tips/linux-unix-windows-find-hidden-processes-tcp-udp-ports.html