Blog¶

7/23/24
4 min read

During Apple's transition to ARM architecture, there were significant challenges with VM compatibility due to the differences between ARM and x86 architectures. While ARM Assembly has been prevalent in devices like Raspberry Pis and other IoT devices, its introduction to personal computers like desktops and laptops is relatively recent. This transition prompted many cybersecurity and IT educational institutions to adapt their VM labs. To address compatibility issues, some institutions shifted from using downloadable .ISO files to web-based environments, utilizing tools like Cockpit and KVM for easier management and deployment of virtual machines. However, not all institutions have made this shift, necessitating a different solution for this student. Switching to a PC was not an option so I decided to host my VMs on a server connected to my local network.

Initially, I tried using Cockpit and KVM, but the setup didn't meet my needs. I needed something more robust—a type 1 hypervisor.

I had loved using VMWare Fusion, but the Broadcom takeover turned me away from using ESXi. The customer experience for downloading any VMWare tools/products was frustratingly difficult. Thus, ESXi was not an option. Eventually, I landed on Proxmox, an open-source type 1 hypervisor that operates similarly to ESXi but without the headaches. Below is the process for installing the system and some examples (with links to each) of the VMs I chose to add to my lab environment with their individual setups.

Installing and Setting up Proxmox VE

Step 1: Download and Flash Proxmox VE

Go to the Proxmox VE website and download the latest ISO image.
Use a tool like Etcher (official website) to flash the ISO image onto a USB drive.
Insert the USB drive into your computer and restart it.
Continue reading

7/6/24
3 min read

Draft

Web Server Setup

Nginx

web-chacho

The following guide provides a walkthrough for setting up a web server on a local network using Nginx. This guide assumes you are using Ubuntu or another debian-based flavor of Linux as your operating system.

Step 1: Install Nginx

Before we start, make sure to update your package manager:

sudo apt update

Next, install Nginx:

sudo apt install nginx

Once the installation is complete, check the status of Nginx:

sudo systemctl status nginx

Ensure Nginx is running. You should see output indicating that the service is active (running).

Verify that port 80 (the default HTTP port) is open:

netstat -ant

5/25/24
7 min read

Draft

Airgeddon: Setup & Use Walkthrough

swissarmyknife-chacho

Airgeddon is essentially a Swiss Army knife for wireless network auditing, without the risk of nicking your fingers. It's a multi-use bash script that does everything from monitoring to cracking Wi-Fi networks, offering several tools wrapped in one streamlined interface. Trusting your network security to luck is like using a paper umbrella in a hurricane— optimistic, but impractical. This post will focus on the use of Airgeddon to poke at your Wi-Fi networks and then implement more secure practices that will harden your Wi-Fi, saving the paper umbrella for a mai tai.

This covers the setup of Airgeddon in a Docker container and the usage of various plugins to enhance your wireless network testing and auditing capabilities. Ensure to follow legal and ethical guidelines while using these tools.

Git Hub Repo

Essential Tools

1. Install Docker:

Ensure Docker is installed and running on your system.

2. Optional: Create a Custom Dockerfile (if you want to customize the image):

Create directory

mkdir airgeddon-docker && cd airgeddon-docker

Create Dockerfile:

FROM kalilinux/kali-rolling

RUN apt-get update && \
    apt-get install -y git iw net-tools wireless-tools aircrack-ng reaver macchanger mdk3 gpsd kismet

RUN git clone https://github.com/v1s1t0r1sh3r3/airgeddon.git /opt/airgeddon

WORKDIR /opt/airgeddon

ENTRYPOINT ["./airgeddon.sh"]

5/25/24
3 min read

Log Server Setup Using rsyslog

The following is a basic setup for implementing rsyslog on your local network. Setting up logging is highly specific to a specific user/network needs so this is just to get started and consider some basic security best practices.

logserver-chacho

Server-side Configuration

Grab server IP address and add to client's /etc/hosts file

sudo echo "10.3.2.240 syslog-server" >> /etc/hosts

Install rsyslog

sudo apt install rsyslog

Get Info

rsyslog -v

systemctl status rsyslog

5/23/24
5 min read

Creating a Custom Shell

Customizing Zsh

Customizing my shell significantly enhanced my productivity, made my workflow more efficient and made content more readable. With a tailored shell environment, you can streamline tasks, reduce repetitive actions, and access powerful features that improve your overall user experience. In this walkthrough, I'll be going through the steps I took to set up a customized Zsh shell using zinit as the plugin manager.

chacho-shell

1. Install zsh

If you don't already have zsh installed, you can install it using your package manager.

macOS, use Homebrew:

brew install zsh

Ubuntu/Debian:

sudo apt install zsh autojump git

2. Set zsh as the Default Shell

Set zsh as default shell:

chsh -s $(which zsh)

3. Install zinit

zinit is a plugin manager for zsh that makes it easy to manage and load plugins.

Download and install zinit:

sh -c "$(curl -fsSL https://raw.githubusercontent.com/zdharma-continuum/zinit/main/scripts/install.sh)"

4. Configure zsh with zinit and Oh My zsh

Create or edit your `.zshrc` file to configure zinit and load Oh My zsh:

vi ~/.zshrc

Add content to the file:

# Load zinit
source ~/.zinit/bin/zinit.zsh

#  On a Linux box, you won't need this next line, but if you're on macOS, you may need to source autojump so you can uncomment this: 
# [[ -s /opt/homebrew/etc/profile.d/autojump.sh ]] && source /opt/homebrew/etc/profile.d/autojump.sh

# Load Oh My zsh
zinit light ohmyzsh/ohmyzsh

# Load the theme
zinit light romkatv/powerlevel10k

# Load plugins
zinit light zsh-users/zsh-autosuggestions
zinit light zsh-users/zsh-syntax-highlighting
zinit light zsh-users/zsh-completions
zinit light hcgraf/zsh-sudo
zinit light wting/autojump
zinit light ael-code/zsh-colored-man-pages

5/22/24
2 min read

Draft

CLI Random Tips

taco-chacho

Adding Commands

When you download an application using wget, you can add it to your command directory rather than updating your PATH variable.

wget DOMAIN-TO-DOWNLOAD-APPLICATION

Extract Application from tarball if necessary:

tar -xf APPLICATION-TARFILE-NAME

CD

cd APPLICATION-EXTRACTED-DIRECTORY

List the contents of the directory to see the exact name of the applicaiton.

ls

Install the application where it belongs.

install APPLICATION-NAME /usr/local/bin

Forgetting Sudo

It turns out this is such a common occurance, there's a shortcut for when it happens. Rather than punching that up arrow, CTRL+A to the beginning, you can just sudo !! and it will apply sudo to whatever your last command was.

sudo !!

Read the Error Message!

This sounds like common sense, but it turns out that I'm not alone in sometimes getting caught up in what I thought the error was that if I'd just read the error output, it would have led me to the issue quicker.

Pipe Output to `vim -`

If you don't know where you want to put the output of a command yet

grep -Hnri "chacho" | vim -

This opens the output of the command in vim where you can edit it or you can use :%! to run the output back through another command:

:%!grep -v sushi

or

:%!sort

5/18/24
3 min read

Draft

DNSmasq

masq-chacho

Dnsmasq: the unsung hero of network management, where DNS meets DHCP with a side of TFTP, just to keep things spicy. (Speaking of spicy, how do you like the novelty glasses?) DNSmasq is a lightweight, yet robust service that doesn't just juggle network requests—it makes local network life easier. Ideal for smaller networks like your home or that tiny, yet over-ambitious office, Dnsmasq helps devices play nice with each other by resolving hostnames and dishing out IP addresses. So why bother? Because manually handling network configurations is about as enjoyable as stepping on LEGOs. Read on for the more boring installation and config instructions/considerations.

Installation Walkthrough for a Local DNS Server.

To set up dnsmasq on an Ubuntu server for local DNS queries, with forwarding to Cloudflare's nameservers for internet queries, follow these detailed step-by-step instructions:

Install `dnsmasq`

Update your package list to ensure you get the latest version available:
```
sudo apt update
```
Install dnsmasq:
```
sudo apt install dnsmasq
```

Configure `dnsmasq`

Backup the original configuration file for safety:

sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.backup

Edit the configuration file:
```
sudo nano /etc/dnsmasq.conf
```
Add/update the following settings to tailor dnsmasq for your needs:
Set the listening interface, if you want dnsmasq to listen only on specific network interfaces (e.g., eth0 for Ethernet):
```
interface=eth0
listen-address=127.0.0.1  # Listen on localhost
bind-interfaces           # Bind to the interface specified
```
Continue reading

5/15/24
4 min read

Draft

MySQL

gardendb

Install

sudo apt install mysql-server -y

Run the mysql Secure Installation Program

sudo mysql_secure_installation

Establish Password Validity Policy
You can use more secure authentication means like keys rather than passwords.
MySQL has an anonymous user capability for testing, but it should be removed for security.
Root user should only be allowed to connect from localhost.
Remove the test database.
Reload the privileges table.

Enable the Firewall

sudo ufw enable

sudo ufw allow mysql

Check to ensure it's listening:

netstat -ant

You should see the 127.0.0.1:3306 (3306 indicating the default port for mySQL) The database server will eventually need to talk to other systems on the network.

Set Up

Configuration

cd /etc/mysql/mysql.conf.d && ll

mysql.cnf configures the command line's behavior
mysqld.cnf configures the server's behavior

vi mysqld.cnf

4/21/24
4 min read

Setting Up a Pihole Docker

pihole-chacho

For some easy-listening learning, I often turn to NetworkChuck's YouTube channel. Recently, I decided to set up Pi-hole, a network-wide ad and tracker blocking application that acts as a DNS sinkhole and optionally as a DHCP server. However, Chuck's video used a Pi-hole image that wasn't ARM architecture compatible. I modified it, pulled the regular pihole/pihole:latest image, and then watched Brandon Lee's VirtualizationHowTo channel for additional insights. Here are my notes from this process:

Option 1: Create the Pihole Container

docker run -dit -p 53:53/tcp -p 53:53/udp -p 80:80 -p 443:443     -v "$(pwd)/etc-pihole:/etc/pihole:z" -v "$(pwd)/etc-dnsmasq.d:/etc/dnsmasq.d:z" --name chacho_pihole pihole/pihole:latest

Explanation:
1. We are running the container with the latest version of Pi-hole, naming it chacho_pihole.
2. Port forwarding is set up so the host forwards traffic to the Pi-hole container. Note: On macOS, mDNSResponder may use port 53 (and possibly 5353). In that case, use an alternative port like 5399 for the host while keeping port 53 for the container.
3. We are mounting two volumes from the current working directory to the container's directories.

Once this container is spun up, and in a healthy status (docker ps to check this), we're ready to visit the Pi-hole interface. Open up a browser and use your docker host IP address like so:

http://10.2.3.4/admin