OpenVAS Commands

This is about the best reference source I've found for reference on the XML you need to create for submitting commands via the omp command.

http://www.openvas.org/omp-2-0.html

Change OpenVAS password

For some reason my last automated install of OpenVAS didn't catch the creation of the random password at the beginning, here's how you can change it manually:

openvasmd --user=admin --new-password=<new_password>

OpenVAS on all interfaces

By default OpenVAS only listens for connections on 127.0.0.1, if you want to access it off-machine you'll need to do this:

cd /lib/systemd/system && sed -e 's/127.0.0.1/0.0.0.0/g' greenbone-security-assistant.service openvas-manager.service openvas-scanner.service -i.BAK

After that do a systemctl daemon-reload and either reboot or restart those services using systemctl. The grep command will create a file of the same name with a .BAK extension in that directory should something go wrong.

OpenVAS port 80

By default the OPenVAS security assistant listens on port 80 and redirects connections to port 9392, this causes issues if you want to run a web server on the same machine. This manifests itself with the following showing up with lsof:

root@pi-5785:/var/log/openvas# lsof -iTCP -sTCP:LISTEN
COMMAND     PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
sshd        349     root    3u  IPv4  12027      0t0  TCP *:ssh (LISTEN)
sshd        349     root    4u  IPv6  12029      0t0  TCP *:ssh (LISTEN)
gsad      12465     root    5u  IPv4 471034      0t0  TCP *:9392 (LISTEN)
gsad      12468     root    5u  IPv4 471736      0t0  TCP *:http (LISTEN)
openvasmd 14004     root    4u  IPv4 479681      0t0  TCP *:9390 (LISTEN)
postgres  16285 postgres    3u  IPv6  36152      0t0  TCP localhost:postgresql (LISTEN)
postgres  16285 postgres    6u  IPv4  36153      0t0  TCP pi-5785:postgresql (LISTEN)

Note gsad listening on port 80 there as well as 9392.

To completely disable port 80 on Kali Linux, and only use 9392, edit the file /lib/systemd/system/greenbone-security-assistant.service and add the --no-redirect option to the ExecStart part:

ExecStart=/usr/sbin/gsad --foreground --no-redirect --listen=0.0.0.0 --port=9392 --mlisten=0.0.0.0 --mport=9390

After that run systemctl daemon-reload then systemctl restart greenbone-security-assistant and port 80 won't be listening.

systemd and rc.local

Once again while in systemd land I discovered something, how to re-re-enable rc.local. Granted, from what I’ve read rc.local should really go the way of the dodo but I don’t feel like writing the new systemd stuff.

Link here.

To summarize it up:

The solution 

As you can see from above, The unit file have no [Install] section. As such Systemd can not enable it. First we need to create a file:

sudo vi /etc/systemd/system/rc-local.service

Then add the following content to it.

[Unit]
 Description=/etc/rc.local Compatibility
 ConditionPathExists=/etc/rc.local

[Service]
 Type=forking
 ExecStart=/etc/rc.local start
 TimeoutSec=0
 StandardOutput=tty
 RemainAfterExit=yes
 SysVStartPriority=99
[Install]
 WantedBy=multi-user.target

Save and close the file. Make sure /etc/rc.local file is executable.

sudo chmod +x /etc/rc.local

After that, enable the service on system boot:

sudo systemctl enable rc-local

Output:

Created symlink from /etc/systemd/system/multi-user.target.wants/rc-local.service to /etc/systemd/system/rc-local.service.

Now start the service and check its status:

sudo systemctl start rc-local.service
sudo systemctl status rc-local.service

Kali default runlevel

As I’m customizing the Kali image for my pen bot I once again came across the hell that is systemd, what would have been rc.local is now of course a steaming pile of systemd stuff. The same goes for the default run level since init is now a thing of the past, this Stack Exchange answer was helpful. You can no longer just set the initdefault level in /etc/inittab.

Debian as-shipped boots towards the graphical target. You can see this yourself:

$ ls -l /etc/systemd/system/default.target...No such file or directory

$ ls -l /lib/systemd/system/default.target... /lib/systemd/system/default.target -> graphical.target

So to boot towards the multiuser target all you need do is to put in own target:

$ cd /etc/systemd/system/

$ sudo ln -s /lib/systemd/system/multi-user.target default.target

It is highly recommended not to mess with the manual symlink-ing, but rather use appropriate options of the systemctl command. In this case, to set the default target you should run:

# systemctl set-default multi-user.target

OpenVPN server on a Raspberry Pi

I am in the middle of configuring a Raspberry Pi 3 to act as an OpenVPN server for my remote pen test bots to use as Command and Control (C2). Ultimately C2 will run in AWS but for now I'm prototyping at home using my crappy Comcast connection. The first issue to get around is the lack of a static IP for the clients to connect to so I'm setting up NoIP as the dynamic DNS for this, here's what I've done.

Step one, go to www.no-ip.com and create a free account. Once that’s done create a hostname for your dynamic connection.

Step two, obtain and install the No-Ip Linux client on the Pi like this:

cd /usr/local/src/
wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz
tar xvf noip-duc-linux.tar.gz
cd noip-2.1.9.1/
make install

This leaves /usr/local/bin/noip2 in place, run it and you will be prompted to enter the username/password for the noip account created in step 1, this will create /usr/local/etc/no-ip2.conf

Step three, create an init script. Edit a file /etc/init.d/noip2 and add the following contents to it:

#!/bin/sh
# /etc/init.d/noip2

# Supplied by no-ip.com
# Modified for Debian GNU/Linux by Eivind L. Rygge <eivind@rygge.org>
# Updated by David Courtney to not use pidfile 130130 for Debian 6.
# Updated again by David Courtney to "LSBize" the script for Debian 7.

### BEGIN INIT INFO
# Provides: noip2
# Required-Start: networking
# Required-Stop:
# Should-Start:
# Should-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: Start noip2 at boot time
# Description: Start noip2 at boot time
### END INIT INFO

# . /etc/rc.d/init.d/functions # uncomment/modify for your killproc

DAEMON=/usr/local/bin/noip2
NAME=noip2

test -x $DAEMON || exit 0

case "$1" in
start)
echo -n "Starting dynamic address update: "
start-stop-daemon --start --exec $DAEMON
echo "noip2."
;;
stop)
echo -n "Shutting down dynamic address update:"
start-stop-daemon --stop --oknodo --retry 30 --exec $DAEMON
echo "noip2."
;;

restart)
echo -n "Restarting dynamic address update: "
start-stop-daemon --stop --oknodo --retry 30 --exec $DAEMON
start-stop-daemon --start --exec $DAEMON
echo "noip2."
;;

*)
echo "Usage: $0 {start|stop|restart}"
exit 1
esac
exit 0

Install it to run at startup using the command: update-rc.d noip2 defaults the run it via service noip2 start. You can check it via the command service noip2 status, you should be good to go.