Category: Security

DNS privacy issues

Until recently I though that having DNS subdomain entries provides enough obscurity thus should it be secure. If your DNS server does not offer transfering domain to another place then any subdomains should be hidden from public sight. Transfers, if enabled (or rather misconfigured) could be made by:

dig -t axfr example.com

Second thing is querying for ANY option, but it does not mean “all”:

dig example.com any

So, with disabled transfers and lack of exactly private entries while quering for any, you would think that you are on a safe side. And that is actually wrong. There are two 3 options on a table:

  • Someone run crawler and scrap websites for domain names, possibly there are plenty of such systems as I see them quite often in HTTP server logs
  • Someone hacked your network perimeter and changed your DNS addresses for their own, this affects all the clients connected to such network if you would be able to force such traffic. This is of course a malicious and intrusive procedure, not happening on every day manner.
  • You are using public/private/provider DNS server and it is saving your requests building a database. Of course it could be either DNS forwarder or resolver or any in DNS query chain with similar configuration.

As far as I know for the most of domains there is no possibility of transfering or exposing too much with “any”. Not every domain was ever present on any other website so it could have been automatically crawled. Is everyone hacked or the most popular public DNS server are involved in building domains list database? There are plenty of subdomains or even domains that are way too complicated to be guessed. I do not think that those information leak from domain registrars but there is a chance.

So there is this domainsproject.org. They say that they use crawling and DNS checks, but I do not bother even to check their code as it seems to be fugazi (fake). How on earth could they check for some random text put in subdomains. It is for sure coming from DNS queries that should stay at those servers safe. Fortunately it does not include every subdomain configured.

Today thinking should be changed a little bit. If you put something on the internet then it is not safe or hidden by default. Maybe I just assumed too naively, and took for granted that people running public DNS servers share the feeling about privacy things as myself.

MikroTik basic reconfiguration

In case you have access to MikroTik device without UI available, only CLI then you possibly would like to know how to do some basic reconfiguration to gain access to admin panel listening on local network. So… to change user password:

/user set admin password=mynewpassword

To see all the configuration:

export

To create PPTP VPN:

ip pool add name=PPTP-Pool ranges=192.168.99.10-192.168.99.200
ppp profile add change-tcp-mss=yes local-address=PPTP-Pool name=PPTP-Profile only-one=yes remote-address=PPTP-Pool use-encryption=yes dns-server=8.8.8.8,9.9.9.9
ppp secret add name=user1 password=YourPassword profile=PPTP-Profile
 interface pptp-server server set authentication=chap,mschap1,mschap2 default-profile=PPTP-Profile enabled=yes

To adjust firewall for PPTP VPN:

ip firewall filter add chain=input comment="PPTP VPN" dst-port=1723 protocol=tcp
ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
interface pptp-server add name=pptp-user1 user=user1

To enable HTTP web configuration:

ip service print
ip service set www port=81
ip service www address=0.0.0.0/0

Now, once you connect thru PPTP VPN to the remote host, you can access UI. But if you set 0.0.0.0/0 as an address then you may also be able to connect to it using public address.

KeeneticOS basic reconfiguration

In case you would like to have PPTP VPN server but no such is installed. But first things first. For such an obsolete hardware and software keep in mind that accessing it requires passing old host key algorithms and cipers. Then:

components install vpnserver
components commit
# now it will reflash software and reboot
service vpn-server
no isolate-private
# here you apply regular PPTP configuration (see my other posts)
# ...
system configuration save
copy running-config startup-config

If you have other VPN types enabled, better disable it as you will be using PPTP and not SSTP or OpenVPN/WireGuard. Now, for HTTP access, most of the time it will be configured for local network access only. We can change this:

ip http security-level public
ip http port 81

Changing HTTP UI port to something different than default will give us ability to run other service on that port and do port forwarding to inside of local network.

Cowrie Honeypot

Until recently I did not know that honeypots I encounter are based on Cowrie. But it does not change much to be honest. I already seen almost 100 of these while randomly exploring things on the internet. It was first thought that they are honeypots, by pure intuition. You enter a system and run ps to list processes and see broad range of things like:

  • ejabberd (erlang)
  • nginx worker process
  • VBoxService
  • mysqld

But on the other hand you are unable to run top command or any other which normally are available on valid systems. Then comes to your mind that there is something wrong with it. How naive it is to think that someone or something will be so dumb not to know that it is fake…

Anyway, I started thinking why on earth would someone deploy Cowrie or any other Honeypot setup. In theory by using honeypots you attract attacker to enter and play around. You can grab passwords, files with malware and commands they try to use. This way you can build your antimalware solutions. But it would require lots of such systems deployed and for sure it is just like that.

Second use case is when such honeypot is deployed on private networks and would be the first choice of person or system entering your perimeter. It will spend time and effort on hacking fake system loosing interest in other things and gives time to identify this threat and properly mitigate it by applying patches and reconfiguring systems.

Further reading:

https://github.com/cowrie/cowrie

SSH access using Ruby to outdated servers

If for some unknown reasons you need to connect thru SSH to some outdated server using Ruby code, then you are in the right place. But first a little piece of theory behind it. There are 4 configurable things in OpenSSH concerning security configuration:

  • KexAlgorithms: per-connection keys (key exchange)
  • HostkeyAlgorithms: public key to identify server to clients
  • Ciphers: connection encryption
  • MACs: message authentication codes

As time passes various algorithms become deprecated and are known to be vulnerable. However there are tons of servers on the internet and on private networks which still use these old things. On a regular SSH client as well as net-ssh Ruby client code you will not be able to connect to such servers, instead you will receive error messages that you are unable to establish connection.

There is solution for that.

First:

:host_key => "+ssh-dss"

Then:

append_all_supported_algorithm: true

With these two additional options which you pass to Net::SSH.start method you will be able to connect to the most of running servers out there. Still there will be some chance you may need to adjust it, like for some old Cisco hardware, but you will cover 99.99%. Hope that you find it useful no matter if you try to administer you old networking rig or just playing around with various things…

KeeneticOS PPTP VPN server

If you own this router then you might be interested how to setup VPN Server. I am personally interested in a way of how to do this using CLI only. It looks easy however there is one odd settings you should be aware of. To start with, it will be PPTP VPN server, but as far as I know this KeeneticOS can set up also OpenVPN and possibly WireGuard, but as always PPTP is the easiest to configure. Start with logging into the box. It might sound obvious, but there are plenty of hardware which requires now unsuported algorithms and ciphers:

ssh  -o "HostKeyAlgorithms=+ssh-dss" admin@x.x.x.x -o"KexAlgorithms=+diffie-hellman-group1-sha1" -c aes256-ctr

Fortunately you can pass options to ssh client for HostKeyAlgorithms, KexAlgorithms and also ciphers (-c argument). This allows you to enter the box. Next:

vpn-server
mtu 1400
system configuration save
exit
service vpn-server
vpn-server interface YOURINTERFACE
vpn-server pool-range x.x.x.x y

Now we are close, but one odd thing:

no isolate-private
system configuration save
copy running-config startup-config

A word of explanation here. We just set up server on a interface with given pool-range which is client IP range while connecting to the VPN. We connect using username and password which is also used to access the box via SSH. Service command enables VPN server or any particular service you work on. Last thing is to disable network isolation, and we do this by specifying “no” before isolate-private. In the end we save configuration and copy current configuration into defaults. We are done here.

PPTP VPN on Wive-NG router

On Wive-NG router when talking about VPN you have either PPP or WireGuard. As PPP is first listed so I tried it before trying WireGuard. Here are my thoughts. Configuration is pretty simple. In the router menu, go to Services – VPN Server. Then select PPTP protocol. In the Users section create new user with login and password and that’s all from the server side.

From the client side it is also pretty simple. First install pptp-linux:

sudo apt install pptp-linux
cd /etc/ppp/peers
touch PPTP

Next thing is to fill configuration file with settings as follows:

pty "pptp x.x.x.x --nolaunchpppd --debug"
name USERNAME
password PASSWORD
remotename PPTP
require-mppe-128
require-mschap-v2
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
noauth
debug
persist
maxfail 0
defaultroute
replacedefaultroute
usepeerdns

With this configuration it is time to activate connection:

chmod 600 /etc/ppp/peers/PPTP
pon PPTP

To disable connection:

poff PPTP

There is one downside of using it. It create several routes of course but it prevents accessing client from outside, so in case of setting it up on remote host you will instantly loose connection. On a local machine it will not be a problem.

EcoRouter 2008 change user password

Possibility that you own or operate EcoRouter 2008 with EcoBNGOS are very low. However just in case you will have to work with this one it will be useful to know at least some basic commands. I choose user password change as it is the most important thing at first glace after setup, so:

enable
configure terminal
username admin
password YOURPASSWORD
write

After this logout and login again to check if it is working. On some routers there might be a problem with not enough disk space to save configuration change, that’s why you need to also check if the change has been applied properly.

MikroTik RouterOS 7.5 change default DNS

Want to change default DNS for the network in MikroTik’s RouterOS CLI? You can use web UI but it could have some issues preventing from configuration save, so it is nice to know how to use it via CLI. First login into the box and then:

ip dhcp-server network set dns-server=1.1.1.1 X

Change X with the network number of your preference. You can show them using print command at /ip/dhcp-server/network level. Last thing: the option that may prevent from configuration save on UI is DHCP Option Set. When empty (for various reasons) then you need to go to CLI to do the job. It is the only way.