Mike Bosland

How to Configure OpenRMF.io to use Domain Names and TLS

Sun, 24 Jul 2022 02:32:26 +0000

I heard about OpenRMF.io recently and decided to take a look. It’s deployed with docker containers so I figured it wouldn’t be too hard to get up and running. Turns out it was a little tricker than I expected, so I thought I’d write down how I did it.

Eventually, I wanted a deployment with TLS certificates and using domain names instead of IP Addresses. To get to this point, I stepped through a staged process. This let me make sure I had everything work in each step.

Migrating from ESXi 7 to Proxmox 7

Tue, 14 Jun 2022 07:49:19 +0000

I’ve been using ESXi as my virtualization platform in my homelab for years, 2012 maybe? It’s been a solid, but limited, platform. With Broadcom’s recent purchase, I figured it was time to start exploring more open source solutions for virtualization. I feel it’s only a matter of time before the free tier of ESXi is further limited.

I tried XCP-ng a few years ago, but I wasn’t able to get a virtual machine’s network interface into promiscuous mode for whatever reason. So this time, I think I’m going to set up Proxmox. I have 2 enterprise servers, so I want to set up a proxmox “cluster” (a true cluster needs 3 servers, so this will just be 2 servers in a “datacenter” that is my office). I want to be able to experiment with live migrating VMs from 1 host to another.

Technical Analysis of New CaddyWiper Malware discovered in Ukraine

Thu, 17 Mar 2022 03:30:48 +0000

Executive Summary

SHA 256 Hash: a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea

ESET researchers published a report on a new wiper malware first discovered in a limited number of organizations in Ukraine. It was first detected on 14 March 2022 at 9:38 AM UTC. This is the 3rd wiper malware discovered since 23 February 2022.

The sample, a 32-bit Windows Portable Executable (PE) binary, was obtained from MalwareBazaar. It is a destructive wiper program that runs on Windows platforms. Upon execution, the malware first identifies if it is running on a Primary Domain Controller, if so the malware exits harmlessly. If the machine is NOT a Primary Domain Controller, the malware continues executing.

TLDR: VNC on Linux Sucks...use xrdp

Mon, 09 Aug 2021 23:49:36 +0000

I have a ton of virtual machines running on VMWare ESXi servers at home. To access them, I had been logging into the ESXi server and opening a remote console with VMWare Workstation Player. Works great…but it’s a hassle…then I found Apache Guacamole.

Apache Guacamole is a clientless remote desktop gateway. It supports VNC, RDP and SSH. It works in the browser thanks to HTML5 so no agents on the remote side as well…just a web browser. It’s really making bouncing between machines.

Adding Windows 10 Enterprise to the Lab Network

Tue, 01 Jun 2021 23:13:43 +0000

This is the sixth and final lab building post in the Building An Atomic Red Team Lab series. This is going to be our manage workstation - the one we’ll run our Atomic tests on. It’s a pretty straightfoward Windows 10 install, so let’s get started.

Installing and Configuring Active Directory with Powershell

Tue, 01 Jun 2021 06:32:10 +0000

This post is part of my series on Building an Atomic Red Team Lab. This is the fifth part of this series where I’m going to document the installation process for the Active Directory Domain Controller. This will alsp be our DNS server as well.

Most enterprise networks are Windows Active Directory networks, so it’s good to be familiar with how to install, configure, break and fix them. We’re going to base the domain controller on Windows Server 2019 Standard Desktop Experience. So let’s get the Operating System installed.

Installing and Configuring Hunting ELK on ESXi

Tue, 01 Jun 2021 06:10:29 +0000

This post is part of my series on Building an Atomic Red Team Lab. This is the fourth part of this series where I’m going to document the installation process for Hunting ELK (HELK). This is the first log, alerting and analysis system I’m going to look at.

HELK is a hunting platform built around the ElasticSearch, Logstash and Kibana technology stack. Logs are sent from the host system, using WinLogBeat, to the HELK server.

The logs from WinLogBeat first enter into the Kafka listener. Kafka is a distributed publish-subsscribe messaging system. From there, the lgos are parsed by Logstash and stored in an ElasticSearch database. These stored messages can be searched and displayed in dashboards using Kibana.

So now that we have a little understanding of how the system works, let’s dive in to the installation process.

Intrusion Detection System Installation and Configuration with Security Onion 2

Sun, 30 May 2021 18:10:53 +0000

This post is part of my series on Building an Atomic Red Team Lab. This is the second part of this series where I’m going to document the installation process for the Intrusion Detection System (IDS).

Operating System

Our Intrusion Detection System (IDS) will monitor the network traffic for suspicious or malicious traffic…which I’ll be generating. I’m going to use the new version of SecurityOnion for this.

SecurityOnion is a free and opensource IDS and network monitoring platform. It has a suite of tools installed by default: A full ELK stack, Zeek, Wazuh, Suricata, Snort, etc. You can use the latest Emerging Threats ruleset to grab the most recent threat signatures known in the wild.

SecurityOnion2 is based on CentOS 7, so we’ll use that to build the base VM.

vyOS Firewall and Router Installation and Configuration in ESXi

Sun, 30 May 2021 18:03:07 +0000

This post is part of my series on Building an Atomic Red Team Lab. This is the first installation post where I’m going to document how I build, install and configure the central hub of the network.

Operating System

I’m going to be using vyOS. vyOS is a free and opensource firewall and router operating system. It’s a powerful platform, but there’s no GUI. It’s all CLI. I haven’t used it much so I’m excited to learn a new technology.

Building A Virtual Atomic Red Team Research Lab

Sun, 30 May 2021 17:55:52 +0000

Dectection is one of the most critical stages of the Information Security processes. There will always be some new zero day exploit, so the ability to detect when an attack is operating on your network is critical.

The Atomic Red Team is an attack emulation toolkit to help you measure, monitor and improve your detection capabilities.

I wanted to build out an active directory lab environment to explore this toolkit and the detection capabilities of various logging systems. It’s going to be a very bare bones network, but should be enough to experiment with the framework.

Pwning Kioptrix 2014 to find Social Security Numbers

Sat, 15 May 2021 05:37:02 +0000

I downloaded from vulnhub and put Kioptrix 2014 on my lab network for my next machine challenge. This box had some software I hadn’t seen before, exposed social security numbers and lacked some of the commands I usually attacked.

I wasn’t able to get an interactive shell without using the metasploit framework, which is a little disappointing….but overall it was a fun box to hack on.

How to Fix netstat command not found - Debian / Ubuntu

Sat, 08 May 2021 18:54:22 +0000

If you’re looking for tools like ifconfig, netstat, route and are getting a command not found error, you are missing the net-tools package. This used to be installed by default, but since Ubuntu 18.04 it is not.

Simple fix. Just install it:

sudo apt-get install -y net-tools

How to Set a Static IP using Netplan

Sat, 08 May 2021 18:43:15 +0000

Ever since Ubuntu, my Linux distro of choice, switched from ifconfig and /etc/network/interfaces to start using Netplan I have a mental block about how to configure a static IP. Hence this post.

Kioptrix Level 1.2 Walkthrough

Mon, 03 May 2021 20:00:00 +0000

Today I wanted to keep working through the Kioptrix Level 1.2. I pulled the machine from vulnhub and set it up on my ESXi lab network.

How to Fix Missing bcm43224 Firmware in Kali

Sat, 01 May 2021 21:46:44 +0000

I’m running Kali on an OLD Macbook Air. I ran an update today and was having trouble completing the initramfs update so I removed the old kernels and rebooted.

Of course when the system came back up, the wifi adapter wasn’t working. Missing firmware. The Macbook is using a Broadcom 43224 device.

After some troubleshooting and internet researching, I found I needed to install a brcmsmac package. Thanks to this debian wiki page. I grabbed an Alfa USB wireless adapter to get online in the meantime.

Contact

Fri, 30 Apr 2021 20:10:45 +0000

I’m a hacker, not a developer, but I’m starting to opensource some code I’ve written on Github.

whoami

Fri, 30 Apr 2021 20:00:13 +0000

`# whoami`

Viruses are fascinating. I’ve studied both biological viruses and computer viruses throughout my career. I think there’s an interesting parallel between the two.

I’m always studying a new technique, tool or technology to learn how it works. My home lab is always changing.

I hold a bachelor’s degree in Microbiology and I’m self taught in IT and Infosec.

`# echo work_experience`

I’m an information security professional. I’ve worked in both the public and private sector to secure sensitive systems from external and internal threat actors. I’ve designed security programs and policies from the ground up, managed servers and networks and identified bugs through bug bounty programs.

How To Install OVFTool on Ubuntu 20.04 with Python3

Sun, 25 Apr 2021 08:41:23 +0000

Since I use terraform to clone and provision VMs on ESXi, I need to use VMWare’s ovftool. However, I’ve been having errors lately. The OVFTool wants to install using python2, and I keep getting syntax errors. Seems like it’s using my Python3 install and I can’t get it to install.

If we cannot install the ovftool via the conventional way, we have to find a detour or a workaround to get there. For this particular issue with the failed installation on Ubuntu 20.04, this means extracting the ovftool files from the installation .bundle, copying them to /usr/bin/ and configure an alias for the ovftool executable.

How To Fix Ubuntu command-not-found sqlite errors

Sun, 25 Apr 2021 08:38:09 +0000

For my home network, I’ve been trying to transitioning to using an Infrastructure-as-code (IaC) approach based on a terraform and the terraform esxi provider plugin. I maintain a few “gold images” of the base line systems, then clone and provision as needed.

I’m not sure where the root cause of this issue is, but I’ve seen it pop up a few times now so I figured I’d write down how I’ve fixed it.

Simple Automated Phishing Infrastructure on DigitalOcean

Sun, 25 Apr 2021 01:59:26 +0000

I perform quarterly phishing awareness simulations for one of my consulting clients so I needed a way to easily recreate my phishing infrastructure. This is heavily inspired from this ired.team’s blog post. Just customized for my simple needs.

You can check out the code I’m using on GitHub.