Install and configure OSSEC with Agentless mode

Install and configure OSSEC with Agentless mode

Author: demonalex (chaoyi.huang@connect.polyu.hk)


[Installing OSSEC]
#cd /usr/local/sbin
#wget https://github.com/ossec/ossec-hids/archive/2.9.3.tar.gz
#tar -zxvf ./2.9.3.tar.gz
#cd ossec-hids-2.9.3/
#./install.sh


[Initialize OSSEC's setting]
For English type : en
What kind of installation do you want (server,agent,local.hybrid): server
Choose wghere to install the OSSEC-HIDS [/var/ossec]: /var/ossec
Do you want email notification: n
Do you want to run the integrity check daemon: y
Do you want to run the rootkit detection engine: y
Do you want to enable active response: n
Do you want to enable remote syslog (port 514 udp): y


[Primary files]
/var/ossec/bin/ossec-control #Main Application
/var/ossec/etc/ossec.conf #Main Configuration File
/var/ossec/bin/manage_agents #Agent Management Program
/var/ossec/agentless/register_host.sh #Agentless Host Registration Program
/var/ossec/logs/ossec.log #Main Log File
/var/ossec/logs/alerts/alerts.log #Alert Log File


[Executing OSSEC]
#/var/ossec/bin/ossec-control start
#ps -aef|grep ossec
ossec      747     1  0 May11 ?        00:01:03 /var/ossec/bin/ossec-analysisd
root       753     1  0 May11 ?        00:04:50 /var/ossec/bin/ossec-logcollector
root       765     1  0 May11 ?        01:18:33 /var/ossec/bin/ossec-syscheckd
ossec      789     1  0 May11 ?        00:00:08 /var/ossec/bin/ossec-monitord


[Adding more agents]
#/var/ossec/agentless/register_host.sh add root@192.168.1.189
After entering the password associated with the agent, utilize the following command to show the agent just added in the system.
#/var/ossec/agentless/register_host.sh list
*Available hosts:
root@192.168.1.189


[Configuring the Agentless mode]
#vi /var/ossec/etc/ossec.conf
Add the following content between <ossec_config> and </ossec_config> before saving and exiting VI:
<agentless>
<type>ssh_integrity_check_linux</type>
<frequency>3600</frequency>
<host>root@192.168.1.189</host>
<state>periodic</state>
<arguments>/bin /etc/ /sbin</arguments>
</agentless>
<agentless>
<type>ssh_generic_diff</type>
<frequency>3600</frequency>
<host>root@192.168.1.189</host>
<state>periodic_diff</state>
<arguments>ls -la /etc; cat /etc/passwd</arguments>
</agentless>


[Restarting OSSEC with Agentless mode]
#/var/ossec/bin/ossec-control enable agentless
#/var/ossec/bin/ossec-control restart
#ps -aef|grep -i ossec
ossec    21845     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-agentlessd
ossec    21855     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-analysisd
root     21859     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-logcollector
ossecr   21866     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-remoted
root     21871     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-syscheckd
ossec    21875     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-monitord


[Configuring Remote Syslog Pushing]
#vi /var/ossec/etc/ossec.conf
Add the following content between <ossec_config> and </ossec_config> before saving and exiting VI:
<syslog_output>
<server>192.168.1.35</server>
<port>115</port>
</syslog_output>


[Restarting OSSEC with Syslog Pushing]
#/var/ossec/bin/ossec-control enable client-syslog
#/var/ossec/bin/ossec-control restart


[Checking if there is any issue]
#tail -n 10 -f /var/ossec/logs/ossec.log


[Checking the detail of any alert]
#tail -n 30 -f /var/ossec/logs/alerts/alerts.log


[Setting up update-rc.d]
#update-rc.d ossec enable 3 5

Log in SSH server with Passwordless mode.

[On the client side:]

1)

#ssh-keygen -t rsa

Keep pressing [ENTER] button until the end.

2)

#ssh-copy-id -i $HOME/.ssh/id_rsa.pub root@192.168.0.3:

The IP address shown above, namely 192.168.0.3, refers to the server's IP address.

3)

#ssh root@192.168.0.3 "chmod 700 .ssh; chmod 640 .ssh/authorized_keys"

Done!

Utilizing WMI to execute Windows commands remotely at Kali Linux

Usage:

/usr/share/doc/python-impacket/examples/wmiexec.py "USERNAME":"PASSWORD"@IPADDRESS "COMMAND"

Example:

/usr/share/doc/python-impacket/examples/wmiexec.py "administrator":"test123"@192.168.0.68 "netstat -anb"

Detect whether Sniffer exists in your network.

Nmap can be a tool to verify whether there is any sniffer running in your network.

Here is an example of using Nmap to address the sniffer, and 192.168.30.29 is the PC hosting a sniffer.

root@is:~# nmap -sn --script=sniffer-detect 192.168.30.0/24

Starting Nmap 7.40 ( https://nmap.org ) at 2018-07-06 11:27 EDT
Nmap scan report for 192.168.30.1
Host is up (0.025s latency).
MAC Address: 00:24:C4:92:C3:21 (Cisco Systems)

Host script results:
|_sniffer-detect: Unknown (tests: "________")

Nmap scan report for 192.168.30.29
Host is up (0.069s latency).
MAC Address: 9C:4E:36:9E:36:2C (Intel Corporate)

Nmap scan report for 192.168.30.128
Host is up (0.024s latency).
MAC Address: EC:88:92:72:20:8C (Motorola Mobility, a Lenovo Company)

Host script results:
|_sniffer-detect: Unknown (tests: "_______1")

Nmap done: 256 IP addresses (3 hosts up) scanned in 12.06 seconds

Performing ARP SPOOFING/POISONING on Kali Linux #2

1) Enable "net.ipv4.conf.all.forwarding" by executing the command below.
#sysctl net.ipv4.conf.all.forwarding=1

2) Run the "ettercap-graphical".

3) Click "Sniff"->"Unified sniffing...". When a small window pops up, choose the appropriate network adapter as the "Network interface" before tapping the "OK" button.

4) Click "Hosts"->"Scan for hosts".

5) Click "Mitm"->"ARP poisoning...". When a small window shows up, check "Sniff remote connections." before clicking the "OK" button.

6) Finally, tap "Start"->"Start sniffing".

7) Any usernames and passwords will show up on the bottom of the ettercap window if any.

Performing ARP SPOOFING/POISONING on Kali Linux #1

1) Utilize the "netdiscover" command to address those nodes located in the same subnet. An example:
#netdiscover -i wlan0 -r 192.168.0.0/24
P.S.: The "wlan0" is the corresponding network adapter, and "192.168.0.0/24" is the corresponding subnet.

2) Enable "net.ipv4.conf.all.forwarding" by executing the command below.
#sysctl net.ipv4.conf.all.forwarding=1

3) Leverage the "arpspoof" command to perform ARP SPOOFING. An example is shown below.
#arpspoof -i wlan0 -t 192.168.0.7 -r 192.168.0.1
P.S.: The "wlan0" is the corresponding network adapter, and "192.168.0.7" is the target IP address. Furthermore, "192.168.0.1" is the gateway.

4) After the commands above are executed, run the Wireshark so that such confidential information as passwords can be gathered by us.

WIFI Security Inspection Checklist

1) The security of Access Points and Access Controllers
Connect into the corresponding wlan before leveraging either Nessus or OpenVAS to fully scan those Access Points and Access Controllers.


2) The robustness of Wireless protocols
Run Kismet by executing the command, kismet, in a shell.
Manually check the encryption algorithm of each WIFI signal.
Bear in mind that there is a sequence listing the security robustness towards each of those WIFI protocols as shown below.
WPA2 Enterprise > WPA Enterprise > WPA2 PSK > WPA PSK > WEP > None Encryption


3) Wi-Fi Protected Setup (WPS) function
Run Fern WIFI Cracker and select the appropriate wlan0 interface before clicking the "Scan for Access points" button.
Check each access point and see if each of them enables the WPS function.


4) Rogue AP
Run Kismet by executing the command, kismet, in a shell.
Check all signals stronger than -40dBm while walking around.


5) Twins of Evil
Run the command, iwlist wlan0 scanning|grep -i 'address:\|essid:'.
There is an example as shown below.
root@alex-kali:~# iwlist wlan0 scanning|grep -i 'address:\|essid:'
          Cell 01 - Address: 90:2B:CF:DC:09:15
                    ESSID:"alex11"
          Cell 02 - Address: 80:29:94:D2:2A:1C
                    ESSID:"Highbridge26"
          Cell 03 - Address: 00:26:62:9B:47:87
                    ESSID:"E5426"
          Cell 04 - Address: B0:C2:87:B5:2B:79
                    ESSID:"TC8717T73"
          Cell 05 - Address: 90:1A:CA:DC:12:10
                    ESSID:"alex6"
          Cell 06 - Address: 00:14:D1:D4:64:02
                    ESSID:"ling23828"
          Cell 07 - Address: 58:EF:68:60:C9:87
                    ESSID:"Linksys15"
          Cell 08 - Address: 48:5D:36:56:44:0E
                    ESSID:"FiOS-TQ4TB"
          Cell 09 - Address: 48:5D:36:21:6D:BA
                    ESSID:"FiOS-Q9BY2"
          Cell 10 - Address: D8:D7:75:A8:59:5E
                    ESSID:"MySpectrumWiFi58-2G"
          Cell 11 - Address: 80:29:94:D2:2A:1D
                    ESSID:"Highbridge23"
          Cell 12 - Address: 58:EF:68:60:C9:88
                    ESSID:"Linksys15"
          Cell 13 - Address: 58:EF:68:60:C9:89
                    ESSID:"Linksys15"
          Cell 14 - Address: 20:C0:47:D3:4D:CA
                    ESSID:"Fios-DRARW-5G"
          Cell 15 - Address: 22:C0:47:D3:4D:CB
                    ESSID:"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
          Cell 16 - Address: 48:5D:36:56:44:0C
                    ESSID:"FiOS-TQ4TB-5G"
          Cell 17 - Address: 4A:5D:36:56:44:0D
                    ESSID:"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
          Cell 18 - Address: B8:D9:4D:4B:AA:0F
                    ESSID:"MySpectrumWiFi08-5G"
Check the output in order to filter out those Twins of Evil.