Exploring Mac OS Server – afctl Adaptive Firewall

I have learned a lot in the past months Mac OS X Server and his capabilities and what are services it can give with lower cost than competition.

The several services presented by OS Server are interesting, in the middle of the most eye candy services I have found one that allows us to improve security controls in a situation where for some time I thought there was not much to do in the native OS.

The bellow tool would allow us to mitigate brute force attacks in automated way. Something that was not known to me without extra tools.

Apple has implemented the Adaptive Firewall on Mac OS Server

Enable the service with the following command:

sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -c
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -f

afctl is a tool for temporarily blocking a given ipv4 or ipv6 address using the built-in firewall.
All blocking requests have a time to live; they are unblocked when it expires.

afctl also maintins a whitelist of addresses that it will not block.
All block requests are checked against this list before being added to the blacklist.

All the firewall rules managed by afctl are grouped into a rule set to allow for bulk enabling/disabling via -e & -d.

I did not find much documentation about this tool.

I will try to update this information while I learn.

For now what I have is the following from the man factl page:

afctl [-v debug_level] [-a ip_address -t ttl] [-w ip_address] [-r ip_address] [-x ip_address] [-c -i interval] [-e] [-d] [-f]


-v -debug_level Verbosity, ascenting numbers are more verbose. level 0 is default level 1 is basic progress.

-a -ip_address Add address to the blacklist. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed. An optional -t parameter allows the specification of the time in minutes that the address will remain blocked.

-r -ip_address Remove address from the blacklist. It will also be removed from the firewall rules.

-w -ip_address Add address to the white list. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed.

-x -ip_address Remove an address from the white list. ip_address can be ipv4 or ipv6 in CDIR notation. No DNS names allowed.

-c -i interval Self configure. The afctl tool will query the system configuration and determine the addresses that need to be  (routers, local interfaces, nameservers). It will also modify its launchd plist to invoke the tool every interval to remove old entries from the blacklist. If -i interval is not specified, then a default value of 15 minutes will be used.

-d Disables all firewall rules managed by afctl using a rule set (see man page for ipfw ). Currently ipfw only ( ip6fw does not support rule sets).

-e Enables the rules disabled by -d (above)

-f Forces afctl into a running state (sets the proper key in af.plist and writes out af_state )

We can also get a summary of the afctl activity running the following command:

sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/hb_summary

Information available from Apple is very restrict and almost resumes to this and user support questions:

https://support.apple.com/en-us/HT200259

I will post more as soon I have news.

OpenWRT and Raspberry PI Access Point

Today I decided to build one personal access point for my travels.

I had one Raspberry PI 2 in my drawers and I decided to use it.

I wanted to prepare something fancy based on web environment and not in bash.

Trying to see what exists compatible with raspberry pi I have found OpenWRT…

I tried to install it and everything work well until I tried to put the wireless cards working. 🙁

The wi-fi did not start-up, I could not make it work…
Until I found I had to install some packages…

I have installed the hostapd package
I have installed the hostapd-common
I have installed the hostapd-utils

This is required to transform the device into an access point.

To install this packages I used the web interface.
Menu System -> Software

Finally I discovered that the network drivers did not exist, I have installed the drivers for the wireless network cards…

1
opkg install kmod-rt2800-lib kmod-rt2800-usb kmod-rt2x00-lib kmod-rt2x00-usb

The suddenly I have a new menu and I can see wi-fi networks… 🙁

But I am not still able to connect or able to advertise my SSID… 🙁

I Hope to be able to complete this post very soon with all the required steps.

List all IP addresses range in a 16 bit network v1.0

Objective:

Pass some IP address as part of a command string to test reverse proxy vulnerability and scan the internal network behind the proxy. Running one already existing python script that receives this Ip as one possible dmz host to scan open tcp ports.

Exploit only accepts one DMZ ip as argument. Does not accept any range or array of IP addresses.

Requirements:

Script that provides me all possible IPs one per one in a network with 16 or more bits so the python exploit script can be called with the ip address as argument.

Missing:

The python script call from shell with the ip and argument for scanning the DMZ network.

Observation:
Script does nothing it only list all the ip address in a 16bit network starting from 192.168.0.0 until it reaches 192.168.255.255

Improvements:
Create multiple parallel requests as they are not dependent and will be faster if executed in parallel.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#!/bin/bash
 
############################################################################
# List all IPs in 16 Bit Network
############################################################################
 
let first_Octet=192
let second_Octet=168
let third_Octet=0
let fourth_Octet=0
 
while [ $third_Octet -lt 255 ]
do
		while [ $fourth_Octet -lt 255 ]
		do
			let fourth_Octet=$[$fourth_Octet+1]
			host=$first_Octet.$second_Octet.$third_Octet.$fourth_Octet
			echo $host
		done
		let third_Octet=$[$third_Octet+1]
		let fourth_Octet=0
done

INTRO TO BASH SHELL on MAC part 3

File Management

Working in bash will force us to understand file management and how to work with them.

Create Files

To create a folder / directory use the mkdir command the argument will be the folder name that you wish to create, you can use more than one argument and in that case it will create more than one folder.

touch command can be used to create files, like in the folders the argument is the file name. If you use more than one argument you will create more than one file.

Cat command outputs the content of a file to screen. It has no paging, if you open the wrong type of files your terminal might get mess up, you will need to use reset to make it return to initial state.

less also allows you to see the content of a command, the difference is that this command will allow us to search contents or move up or down in the file.

Less command also tries to identify the type of file.

Open command can be used to open a file with the program that is associated to it. This command will open the file in the graphic mode so you will leave bash.

open .

The command “file” will tell you what type of the file is, this will allow you to understand if the file is a picture or a binary file for example.

Remember that the extension is not mandatory in the shell.

Use the “TAB” key for autocomplete

Working with Files

rm is remove command

mv is move command

In Mac OS the file names are not case sensitive. This is a difference between Linux and OSx

File names can contain almost any character except the “/”

Advises for file names:

  • Use only letters and numbers if you use multiple words use a “-” or “_” as a separator
  • Use only lower case characters
  • Avoid using spaces specially if they are in the end of the file.
  • Avoid using the following characters
    • `
    • *
    • #
    • !
    • $
    • ?
    • @
    • &
    • |
    • { }
    • ( )
    • : ;
    • \
    • < >
    • “TAB”
    • “SPACE”
    • “DELETE”
    • “BACKSPACE”

If we have file names with this previous characters we need to use an escape character.

  1. Backslash ( \ ) is the escape character and it can escape a single character.
  2. Single quotes (‘ ‘) can escape all characters between them

Path types

There are 2 types of file paths, relative and absolute paths.

Absolute paths normally start with a “/” or with a “.

Example: /var/log

Relative paths

They do not start with a “/” or “.” and are resolved to a working directory.

Example: cd ~ will send us to the current user home path.

Handling Files and Folders

To copy files we use the command “cp” that stands for copy.

You can use now the “man cp” to know what you can do with the command. If you notice the command takes 2 arguments where the first argument is the Origin and the second argument is the destination.

It also can take multiple arguments as sources to one destination.

cp command will silently overwrite existing files.

To copy directories and the contents we need to use the option -R that states for recursively.

The command will be similar to the files “cp -R Origin Destination”

Like files we can also use multiple sources to one or multiple destinations.

Another command to deal with Files and Folders is the “mv” command that states for moving.

Like the copy command we need also 2 arguments, one for origin and another to destination.

Use the “man mv” to get more information about the command and his arguments and options.

Files can be deleted with the “rm” command, that stands for remove.

The command can receive one or more arguments that are the list of the files or folders to remove.

Because removing the files is permanent we can use the -i option, that will ask us to confirm for each file to remove.

The “-i” option can also be used for other commands.

INTRO TO BASH SHELL on MAC part 2

In the part 1 of this learning topic you had one introductory approach to BASH in this part we will go deeper in the knowledge of BASH in MAC OS

Now that we know how to open a terminal window in a MAC we will need to confirm that we are really running bash on that window.
For that it is required to execute a simple command.

The command bellow will check if we are running bash.

echo $BASH

Notice that if you do not use the capitals in “BASH” you will not get the return.

If your output is not “/bin/bash” then install and enable BASH in your machine.

Command Arguments

A command is a word that is written in the shell.

In the previous example the command is “echo”.

Everything that comes after the command is called argument.

In the previous example “$BASH” is the argument for the command echo.

Options

If an argument starts with a  ” – ” then it is considered an option.

Examples:

  • ls -a
  • ls -l
  • ls -la

In this example the command is “ls” that corresponds to list and the -a is the option that instructs ls command to list all the files including the ones that are hidden, -l is the option that instructs the command to list the files in long format.

Help

The commands might have several options available. To list those options or to know how to use the commands we can call the manual for that command.

For that we use the command “man” and then as argument the name of the command that we wish to receive help for.

This will open the manual page for the specified command.

Space key will move down a page, “b” will move back a page.

Search will be done with the “/” and exit with “q”

Test this new commands and pay attention to the differences in the output.