Let the Syscheck function of OSSEC check files' integrity for many times

1)#vi /var/ossec/etc/ossec.conf

2)Add the following line into the <syscheck></syscheck> labels:

<auto_ignore>no</auto_ignore>

3)Restart OSSEC

Install and configure OSSEC with Agentless mode

Install and configure OSSEC with Agentless mode

Author: demonalex (chaoyi.huang@connect.polyu.hk)


[Installing OSSEC]
#cd /usr/local/sbin
#wget https://github.com/ossec/ossec-hids/archive/2.9.3.tar.gz
#tar -zxvf ./2.9.3.tar.gz
#cd ossec-hids-2.9.3/
#./install.sh


[Initialize OSSEC's setting]
For English type : en
What kind of installation do you want (server,agent,local.hybrid): server
Choose wghere to install the OSSEC-HIDS [/var/ossec]: /var/ossec
Do you want email notification: n
Do you want to run the integrity check daemon: y
Do you want to run the rootkit detection engine: y
Do you want to enable active response: n
Do you want to enable remote syslog (port 514 udp): y


[Primary files]
/var/ossec/bin/ossec-control #Main Application
/var/ossec/etc/ossec.conf #Main Configuration File
/var/ossec/bin/manage_agents #Agent Management Program
/var/ossec/agentless/register_host.sh #Agentless Host Registration Program
/var/ossec/logs/ossec.log #Main Log File
/var/ossec/logs/alerts/alerts.log #Alert Log File


[Executing OSSEC]
#/var/ossec/bin/ossec-control start
#ps -aef|grep ossec
ossec      747     1  0 May11 ?        00:01:03 /var/ossec/bin/ossec-analysisd
root       753     1  0 May11 ?        00:04:50 /var/ossec/bin/ossec-logcollector
root       765     1  0 May11 ?        01:18:33 /var/ossec/bin/ossec-syscheckd
ossec      789     1  0 May11 ?        00:00:08 /var/ossec/bin/ossec-monitord


[Adding more agents]
#/var/ossec/agentless/register_host.sh add root@192.168.1.189
After entering the password associated with the agent, utilize the following command to show the agent just added in the system.
#/var/ossec/agentless/register_host.sh list
*Available hosts:
root@192.168.1.189


[Configuring the Agentless mode]
#vi /var/ossec/etc/ossec.conf
Add the following content between <ossec_config> and </ossec_config> before saving and exiting VI:
<agentless>
<type>ssh_integrity_check_linux</type>
<frequency>3600</frequency>
<host>root@192.168.1.189</host>
<state>periodic</state>
<arguments>/bin /etc/ /sbin</arguments>
</agentless>
<agentless>
<type>ssh_generic_diff</type>
<frequency>3600</frequency>
<host>root@192.168.1.189</host>
<state>periodic_diff</state>
<arguments>ls -la /etc; cat /etc/passwd</arguments>
</agentless>


[Restarting OSSEC with Agentless mode]
#/var/ossec/bin/ossec-control enable agentless
#/var/ossec/bin/ossec-control restart
#ps -aef|grep -i ossec
ossec    21845     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-agentlessd
ossec    21855     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-analysisd
root     21859     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-logcollector
ossecr   21866     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-remoted
root     21871     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-syscheckd
ossec    21875     1  0 16:47 ?        00:00:00 /var/ossec/bin/ossec-monitord


[Configuring Remote Syslog Pushing]
#vi /var/ossec/etc/ossec.conf
Add the following content between <ossec_config> and </ossec_config> before saving and exiting VI:
<syslog_output>
<server>192.168.1.35</server>
<port>115</port>
</syslog_output>


[Restarting OSSEC with Syslog Pushing]
#/var/ossec/bin/ossec-control enable client-syslog
#/var/ossec/bin/ossec-control restart


[Checking if there is any issue]
#tail -n 10 -f /var/ossec/logs/ossec.log


[Checking the detail of any alert]
#tail -n 30 -f /var/ossec/logs/alerts/alerts.log


[Setting up update-rc.d]
#update-rc.d ossec enable 3 5

Log in SSH server with Passwordless mode.

[On the client side:]

1)

#ssh-keygen -t rsa

Keep pressing [ENTER] button until the end.

2)

#ssh-copy-id -i $HOME/.ssh/id_rsa.pub root@192.168.0.3:

The IP address shown above, namely 192.168.0.3, refers to the server's IP address.

3)

#ssh root@192.168.0.3 "chmod 700 .ssh; chmod 640 .ssh/authorized_keys"

Done!

Utilizing WMI to execute Windows commands remotely at Kali Linux

Usage:

/usr/share/doc/python-impacket/examples/wmiexec.py "USERNAME":"PASSWORD"@IPADDRESS "COMMAND"

Example:

/usr/share/doc/python-impacket/examples/wmiexec.py "administrator":"test123"@192.168.0.68 "netstat -anb"

Detect whether Sniffer exists in your network.

Nmap can be a tool to verify whether there is any sniffer running in your network.

Here is an example of using Nmap to address the sniffer, and 192.168.30.29 is the PC hosting a sniffer.

root@is:~# nmap -sn --script=sniffer-detect 192.168.30.0/24

Starting Nmap 7.40 ( https://nmap.org ) at 2018-07-06 11:27 EDT
Nmap scan report for 192.168.30.1
Host is up (0.025s latency).
MAC Address: 00:24:C4:92:C3:21 (Cisco Systems)

Host script results:
|_sniffer-detect: Unknown (tests: "________")

Nmap scan report for 192.168.30.29
Host is up (0.069s latency).
MAC Address: 9C:4E:36:9E:36:2C (Intel Corporate)

Nmap scan report for 192.168.30.128
Host is up (0.024s latency).
MAC Address: EC:88:92:72:20:8C (Motorola Mobility, a Lenovo Company)

Host script results:
|_sniffer-detect: Unknown (tests: "_______1")

Nmap done: 256 IP addresses (3 hosts up) scanned in 12.06 seconds

Performing ARP SPOOFING/POISONING on Kali Linux #2

1) Enable "net.ipv4.conf.all.forwarding" by executing the command below.
#sysctl net.ipv4.conf.all.forwarding=1

2) Run the "ettercap-graphical".

3) Click "Sniff"->"Unified sniffing...". When a small window pops up, choose the appropriate network adapter as the "Network interface" before tapping the "OK" button.

4) Click "Hosts"->"Scan for hosts".

5) Click "Mitm"->"ARP poisoning...". When a small window shows up, check "Sniff remote connections." before clicking the "OK" button.

6) Finally, tap "Start"->"Start sniffing".

7) Any usernames and passwords will show up on the bottom of the ettercap window if any.

Performing ARP SPOOFING/POISONING on Kali Linux #1

1) Utilize the "netdiscover" command to address those nodes located in the same subnet. An example:
#netdiscover -i wlan0 -r 192.168.0.0/24
P.S.: The "wlan0" is the corresponding network adapter, and "192.168.0.0/24" is the corresponding subnet.

2) Enable "net.ipv4.conf.all.forwarding" by executing the command below.
#sysctl net.ipv4.conf.all.forwarding=1

3) Leverage the "arpspoof" command to perform ARP SPOOFING. An example is shown below.
#arpspoof -i wlan0 -t 192.168.0.7 -r 192.168.0.1
P.S.: The "wlan0" is the corresponding network adapter, and "192.168.0.7" is the target IP address. Furthermore, "192.168.0.1" is the gateway.

4) After the commands above are executed, run the Wireshark so that such confidential information as passwords can be gathered by us.