Check for Shellshock Bash Vulnerability and how to fix it

Read full details here: Check for Shellshock Bash Vulnerability and how to fix it

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. In this guide we will show how to check for Shellshock Bash Vulnerability and how to fix it in multiple Linux Operating systems such as Debian based Ubuntu, Linux Mint and Red Hat Based CentOS, Fedora distributions.

The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. Red Hat (and rest of the open source community) would like to thank Stephane Chazelas for reporting this issue.

All bash users are advised to upgrade to these updated packages, which contain a back-ported patch to correct this issue.

The Shellshock vulnerability can be exploited on systems that are running Services or applications that allow unauthorized remote users to assign Bash environment variables. Examples of exploitable systems include the following:

1. Apache HTTP Servers that use CGI scripts (viamod_cgi and mod_cgid) that are written in Bash or launch to Bash sub-shells
2. Certain DHCP clients
3. Open SSH servers that use the ForceCommandcapability
4. Various network-exposed services that use Bash

 For additional information on the CVE-2014-6271 and CVE-2014-7169. flaw, refer to the Knowledge base article athttps://access.redhat.com/articles/1200223

Contents [hide]

• How to check for Shellshock Bash Vulnerability?
  • Sample output
• Test website for Shellshock Bash Vulnerability
• Fix Shellshock Bash Vulnerability by updating Bash
  • aptitude / apt-get: Debian based distro (i.e. Ubuntu, Linux Mint, Kali etc.)
  • yum: Red Hat based distro (i.e. Fedora, CentOS etc.)
• Links & Resources
• Conclusion
• Google+
• Related

How to check for Shellshock Bash Vulnerability?

Read the rest of it here: Check for Shellshock Bash Vulnerability and how to fix it

Find number of unique IP's and active connections to Web server

Read full details here: Find number of unique IP's and active connections to Web server


In computing, netstat (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol statistics. It is available on Unix-like operating systems including OS X, Linux, Solaris, and BSD, and is available on Windows NT-based operating systems including Windows XP, Windows Vista, Windows 7 and Windows 8.
It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.
netstat is the most frequent tool used for monitoring network connections on a Linux servers. netstat returns a variety of information on active connections such as their current status, what hosts are involved, and which programs are involved. You can also see information about the routing table and even get statistics on your network interfaces. netstat is a good all-around utility and it is an essential tool for the Linux administrators.
If you just type netstat, it would display a long list of information that’s usually more than you want to go through at any given time. The trick is that how to keeping the information useful and what you’re looking for and how to tell netstat to only display that information.

Users can also use man netstat command to get detailed netstat help and manual where there are lots of configurable options and flags to get meaningful lists and results.

Contents 

• What is netstat?
• The Holy Grail of netstat – My way
  • Step 1: Show active connections – TCP and UDP Internet  (w/o servers)
  • Step 2: Show all active connections – (/w servers and established)
  • Step 3: Show all active connections to Web server
  • Step 4: Show all active connections to Web server excluding self IP’s
    • >> Sample output
  • Step 5: Show all active connections to Web server – IP: Port only
    • >> Sample output
  • Step 6: Show all active connections to Web server – IP’s only
    • >> Sample output
  • Step 7: Show all active connections to Web server – sorted and unique
    • >> Sample output
  • Step 8: Show all active connections to Web server – connection count
    • >> Sample output
  • Step 9: Show all active connections to Web server – exclude self IP’s
    • >> Sample output
  • Step 10: Final count of all active IP’s to Web server
    • >> Sample output
  • Step 11: Final count of all active connections to Web server
    • >> Sample output
• Conclusion
• Further helpful links, sources and references:
  • Google+
  • Related

Read the rest of it here: Find number of unique IP's and active connections to Web server

Attack a website using slowhttptest from Linux and MAC

Read full details here: Attack a website using slowhttptest from Linux and MAC

SlowHTTPTest is a highly configurable tool that simulates some Application Layer Denial of Service attacks. It works on majority of Linux platforms, OSX and Cygwin – a Unix-like environment and command-line interface for Microsoft Windows.
It implements most common low-bandwidth Application Layer DoS attacks, such as slowloris, Slow HTTP POST, Slow Read attack (based on TCP persist timer exploit) by draining concurrent connections pool, as well as Apache Range Header attack by causing very significant memory and CPU usage on the server.
Slowloris and Slow HTTP POST DoS attacks rely on the fact that the HTTP protocol, by design, requires requests to be completely received by the server before they are processed. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. If the server keeps too many resources busy, this creates a denial of service. This tool is sending partial HTTP requests, trying to get denial of service from target HTTP server.
Slow Read DoS attack aims the same resources as slowloris and slow POST, but instead of prolonging the request, it sends legitimate HTTP request and reads the response slowly.

Read the rest of it here: Attack a website using slowhttptest from Linux and MAC

Linux Kernel panic issue: How to fix hung_task_timeout_secs and blocked for more than 120 seconds problem

Read full details here: Linux Kernel panic issue: How to fix hung_task_timeout_secs and blocked for more than 120 seconds problem

Linux Kernel panic issue

Short description: This guide shows how to fix hung_task_timeout_secs and blocked for more than 120 seconds problem in Linux.

Background

My server became unresponsive today (around 15:38hrs)

I’ve collected following logs that shows Memory and CPU usage and narrowed down /var/log/messages.

After doing a hard reboot, it came back online but I was unable to access it via VNC or SSH.

VNC connection showed an error (many errors but all contained /proc/sys/kernel/hung_task_timeout_secs“)

INFO: task jbd2/vda3-8:250 blocked for more than 120 seconds.
 Not tainted 2.6.32-431.11.2.el6.x86_64 #1
 kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

Step by step troubleshooting data and logs

Check Memory usage

Following log shows server memory usage

someuser@servercore [/var/log]# sar -r

15:00:01 kbmemfree kbmemused %memused kbbuffers kbcached kbcommit %commit
15:20:01 476604 1396772 74.56 110140 707116 1201652 30.64
15:30:02 526240 1347136 71.91 110412 710536 1165148 29.71

15:55:53 LINUX RESTART

16:00:01 kbmemfree kbmemused %memused kbbuffers kbcached kbcommit %commit
16:10:01 517168 1356208 72.39 136040 588964 1196724 30.52
16:20:01 510580 1362796 72.75 137488 596560 1191664 30.39

As you can see, it’s not that high and I had plenty of free Memory.

Check CPU usage

Following log shows CPU usage.

someuser@servercore [/var/log]# sar -u
15:00:01 CPU %user %nice %system %iowait %steal %idle
15:20:01 all 6.01 0.04 1.74 1.59 0.14 90.48
15:30:02 all 4.97 0.04 1.54 7.87 0.15 85.44
Average: all 7.20 0.06 2.19 2.69 0.26 87.60

15:55:53 LINUX RESTART

16:00:01 CPU %user %nice %system %iowait %steal %idle
16:10:01 all 9.13 0.04 2.78 6.98 0.31 80.76
16:20:01 all 4.21 0.04 1.39 3.49 0.15 90.73

Again, CPU wasn’t at 100%. This is now getting annoying that I can’t explain why I am getting into s**tstorm for nothing.

Let’s check //var/log/messages to find all the error logs related this this kernel panic

Check Kernel Panic Logs

Now I am getting somewhere …

someuser@servercore [/var/log]# grep 'Aug 22 15' messages | grep -v Firewall | grep -v blackmore | grep -v operational | grep -v ec2
Aug 22 15:38:05 servercore kernel: INFO: task jbd2/vda3-8:250 blocked for more than 120 seconds.
Aug 22 15:38:05 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:05 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:05 servercore kernel: jbd2/vda3-8 D 0000000000000000 0 250 2 0x00000000
Aug 22 15:38:06 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:06 servercore kernel: Call Trace:
Aug 22 15:38:06 servercore kernel: INFO: task rs:main Q:Reg:1035 blocked for more than 120 seconds.
Aug 22 15:38:06 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:06 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:06 servercore kernel: rs:main Q:Reg D 0000000000000000 0 1035 1 0x00000080
Aug 22 15:38:06 servercore kernel: Call Trace:
Aug 22 15:38:06 servercore kernel: INFO: task queueprocd - qu:1793 blocked for more than 120 seconds.
Aug 22 15:38:06 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:06 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:06 servercore kernel: queueprocd - D 0000000000000000 0 1793 1 0x00000080
Aug 22 15:38:06 servercore kernel: Call Trace:
Aug 22 15:38:06 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:06 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:06 servercore kernel: Call Trace:
Aug 22 15:38:06 servercore kernel: INFO: task httpd:30439 blocked for more than 120 seconds.
Aug 22 15:38:06 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:07 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:07 servercore kernel: httpd D 0000000000000000 0 30439 2223 0x00000080
Aug 22 15:38:07 servercore kernel: Call Trace:
Aug 22 15:38:11 servercore kernel: INFO: task httpd:30482 blocked for more than 120 seconds.
Aug 22 15:38:11 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:38:11 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:38:11 servercore kernel: httpd D 0000000000000000 0 30482 2223 0x00000080
Aug 22 15:38:11 servercore kernel: Call Trace:
Aug 22 15:39:54 servercore kernel: INFO: task jbd2/vda3-8:250 blocked for more than 120 seconds.
Aug 22 15:39:54 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:39:54 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:39:54 servercore kernel: jbd2/vda3-8 D 0000000000000000 0 250 2 0x00000000
Aug 22 15:39:54 servercore kernel: Call Trace:
Aug 22 15:39:54 servercore kernel: INFO: task flush-253:0:263 blocked for more than 120 seconds.
Aug 22 15:39:54 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:39:54 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:39:54 servercore kernel: flush-253:0 D 0000000000000000 0 263 2 0x00000000
Aug 22 15:39:54 servercore kernel: Call Trace:
Aug 22 15:39:56 servercore kernel: INFO: task rs:main Q:Reg:1035 blocked for more than 120 seconds.
Aug 22 15:39:56 servercore kernel: Not tainted 2.6.32-431.11.2.el6.x86_64 #1
Aug 22 15:39:56 servercore kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
Aug 22 15:39:56 servercore kernel: rs:main Q:Reg D 0000000000000000 0 1035 1 0x00000080
Aug 22 15:39:56 servercore kernel: Call Trace:
Aug 22 15:42:11 servercore kernel: Clocksource tsc unstable (delta = -8589964877 ns)

15:55:53 LINUX RESTART

As you can see all the errors contained “echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.” and “blocked for more than 120 seconds” somewhere.

Now let’s fix this problem once and for all..

Read the rest of it here: Linux Kernel panic issue: How to fix hung_task_timeout_secs and blocked for more than 120 seconds problem

How to check loaded and compiled modules in HTTPD in Linux?

Read full details here: How to check loaded and compiled modules in HTTPD in Linux?

This is a very common question and sometimes hard to find answer. How do you check which Apache modules are loaded in your HTTP / Apache server? The second part is, how do you check which modules are compiled and ready to be loaded? Following two commands will show you you can easily check loaded and compiled modules in HTTPD or Apache2 in any flavour of Linux such as CentOS, Ubuntu, Fedora, RedHat etc.

Find list of loaded modules in HTTPD Apache

Use the following command to list Loaded modules in your Apache/HTTPD server in Linux

root@centos [~]# httpd -D DUMP_MODULES
(or)
user@centos [~]# sudo httpd -D DUMP_MODULES
(or)
user@ubuntu [~]# sudo apache2 -D DUMP_MODULES

Depending on your Linux distro, you need to use either httpd or apache2. Also use ‘sudo’ if you’re not logged in as root user.

Sample loaded modules in Apache

Loaded Modules:
 core_module (static)
 include_module (static)
 proxy_module (static)
 proxy_connect_module (static)
 http_module (static)
 autoindex_module (static)
 info_module (static)
 cloudflare_module (shared)
 php5_module (shared)
 reqtimeout_module (shared)
 pagespeed_module (shared)
Syntax OK

Read the rest of it here: How to check loaded and compiled modules in HTTPD in Linux?

Connect to WiFi network from command line in Linux

Read full details here: Connect to WiFi network from command line in Linux



How many of you failed to connect to WiFi network in Linux? Did you bumped into issues like the followings in different forums, discussion page, blogs? I am sure everyone did at some point. Following list shows just the results from Page 1 of a Google search result with “Unable to connect to WiFi network in Linux” keywords.

1. Cannot connect to wifi at home after upgrade to ubuntu 14.04
2. Arch Linux not connecting to Wifi anymore
3. I can’t connect to my wifi
4. Cannot connect to WiFi
5. Ubuntu 13.04 can detect wi-fi but can’t connect
6. Unable to connect to wireless network ath9k
7. Crazy! I can see wireless network but can’t connect
8. Unable to connect to Wifi Access point in Debian 7
9. Unable to connect Wireless

Following guide explains how you can connect to a WiFi network in Linux from command Line. This guide will take you through the steps for connecting to a WPA/WPA2 WiFi network.

Contents [hide]

• WiFi network from command line – Required tools
• Linux WPA/WPA2/IEEE 802.1X Supplicant
  • iw – Linux Wireless
  • ip – ip program in Linux
  • ping
• Step 1: Find available WiFi adapters – WiFi network from command line
• Step 2: Check device status – WiFi network from command line
• Step 3: Bring up the WiFi interface – WiFi network from command line
• Step 4: Check the connection status – WiFi network from command line
• Step 5: Scan to find WiFi Network – WiFi network from command line
• Step 6: Generate a wpa/wpa2 configuration file – WiFi network from command line
• Step 7: Connect to WPA/WPA2 WiFi network – WiFi network from command line
• Step 8: Get an IP using dhclient – WiFi network from command line
• Step 9: Test connectivity – WiFi network from command line
• Summary
• Google+
• Related

WiFi network from command line – Required tools

Following tools are required to connect to WiFi network in Linux from command line

1. wpa_supplicant
2. iw
3. ip
4. ping

Before we jump into technical jargons let’s just quickly go over each item at a time.

Linux WPA/WPA2/IEEE 802.1X Supplicant

wpa_supplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 (IEEE 802.11i / RSN). It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key negotiation with a WPA Authenticator and it controls the roaming and IEEE 802.11 authentication/association of the wlan driver.

iw – Linux Wireless

iw is a new nl80211 based CLI configuration utility for wireless devices. It supports all new drivers that have been added to the kernel recently. The old tool iwconfing, which uses Wireless Extensions interface, is deprecated and it’s strongly recommended to switch to iw and nl80211.

ip – ip program in Linux

ip is used to show / manipulate routing, devices, policy routing and tunnels. It is used for enabling/disabling devices and it helps you to find general networking informations. ip was written by Alexey N. Kuznetsov and added in Linux 2.2. Use man ip to see full help/man page.

ping

Good old ping For every ping, there shall be a pong …. ping-pong – ping-pong – ping-pong … that should explain it.

BTW man ping helps too …

Step 1: Find available WiFi adapters – WiFi network from command line

This actually help .. I mean you need to know your WiFi device name before you go an connect to a WiFi network. So just use the following command that will list all the connected WiFi adapters in your Linux machines.

root@kali:~# iw dev
phy#1
    Interface wlan0
        ifindex 4
        type managed
root@kali:~#

Let me explain the output:
This system has 1 physical WiFi adapters.

1. Designated name: phy#1
2. Device names: wlan0
3. Interface Index: 4. Usually as per connected ports (which can be an USB port).
4. Type: Managed. Type specifies the operational mode of the wireless devices. managed means the device is a WiFi station or client that connects to an access point.

Read the rest of it here: Connect to WiFi network from command line in Linux

Remote DSL ADSL router hack using NMAP in Kali Linux

Read full details here: Remote DSL ADSL router hack using NMAP in Kali Linux

In this guide we will use namp to scan a range of IP addresses, from output we will determine which are DSL ADSL Routers and have left their Management ports open to External Network. (again read top section to know which one is a external network). A typical ADSL Router's Management interface is available via following URL:

http://10.0.0.1/

http://192.168.0.1/

http://192.168.1.1/

http://192.168.1.254/
etc.

This is the Management page for DSL ADSL modem router and it's always protected by a password. By default, this password is written below a DSL ADSL modem router in a sticker and they are one of these combinations: Username/Password

admin/admin
admin/password
admin/pass
admin/secret
etc.

A lot of the home users doesn't change this password. Well, that's ok. It doesn't hurt much cause this is only available via a connected device. But what's not OKAY is when users open up their management to the external network. All you need to know what's the Public IP address for your target and just try to access this management page externally.

Installing NMAP

I use Kali Linux which comes with NMAP Preinstalled. If you are using Windows or MAC (or any other flavour of Linux) go to the following website to download and install NMAP.

Linux Installation:

For Ubuntu, Debian or aptitude based system NMAP is usually made available via default repository. Install NMAP using the following command:

sudo apt-get install nmap

For YUM Based systems such as Redhat, CentOS, install via

sudo yum install nmap

For PACMAN based systems such as Arch Linux, install via

sudo pacman -S nmap

Windows Installation:

For Windows Computers, download installer and run the executable. Link: http://nmap.org/dist/nmap-6.46-setup.exe

MAC Installation:

For MAC users, download installer and install Link: http://nmap.org/dist/nmap-6.46.dmg

Official NMAP site

You can read more about NMAP here: http://nmap.org/


Read the rest of it here: Remote DSL ADSL router hack using NMAP in Kali Linux