Build a recovery toolkit
10 June 2010 03:27 2 messages
License : Copyright Emeric Nasi, some rights reserved
This work is licensed under a Creative Commons Attribution 4.0 International License.
Introduction
All security guides recommend you should have a security audit toolkit (or forensic toolkit or recovery toolkit). This toolkit is constituted by a set of static-linked binaries (grep,w,netstat,ls,nc,strace,ps ... etc). The problem it that these security guides tell you to build this toolkit but never show you how to do it (they just tell it can be really difficult...). In this article I will explain why we need this toolkit then I will show how to build it.
Why a recovery toolkit?
If an attacker had gain a superuser access into your system, he could have install a malware iike a trojan or a rootkit. Therefore you cannot trust anything on your system. The su or login binaries could have been replaced by his own tool to grab your passwords. Other trojan can directly attack shared library meaning that even newly compiled code may be dangerous.
The other use of this toolkit is to "repair after an accident". A single wrong command is enough to damage important binaries or shared libraries (for example a rm -r on the wrong folder...).
This toolkit must be mounted on a read-only file-system and could be used by rootkit hunting tools such as chkrootkit.
It is also important to notice this toolkit is constituted of statically linked binaries.
We cannot rely on the system shared libraries if the system is corrupted.
Build the toolkit.
Note : The total size of the binaries + sources is about 500 Mo. The binaries size alone is less then 50 Mo.
Prerequisite :
Create a folder where you will install your toolkit.mkdir -p audit/src
mkdir -p audit/bin
You need to install the dpkg dev package.apt-get install dpkg-dev
The core binaries :
apt-get source coreutils audit/src cd audit/src/coreutils-x.x # replace x by the package version ./configure make CC="gcc -static -std=gnu99" cp src/cat "../bin" cp src/chmod "../bin" cp src/chown "../bin" cp src/cp "../bin" cp src/cut "../bin" cp src/dd "../bin" cp src/df "../bin" cp src/du "../bin" cp src/echo "../bin" cp src/head "../bin" cp src/id "../bin" cp src/ln "../bin" cp src/ls "../bin" cp src/md5sum "../bin" cp src/mkdir "../bin" cp src/mknod "../bin" cp src/mv "../bin" cp src/pwd "../bin" cp src/readlink "../bin" cp src/rm "../bin" cp src/stat "../bin" cp src/sha512sum "../bin" cp src/su "../bin" cp src/tail "../bin" cp src/touch "../bin" cp src/uname "../bin" cp src/wc "../bin" cp src/who "../bin" # These are essentials but there are more in the src folder
The proc binaries :
apt-get install libncurses-dev # required to build top apt-get source procps audit/src cd audit/src/procps-xxx # replace xxxx by the package version make SHARED=0 CC='gcc -static' cp "free" "../bin" cp "kill" "../bin" cp "ps/ps" "../bin" cp "top" "../bin" cp "uptime" "../bin" cp "vmstat" "../bin" cp "w" "../bin"
The net-tools binaries :
apt-get source net-tools audit/src cd audit/src/net-tools-xxx # replace xxxx by the package version sed -i 's@default:@&\n break;@' lib/inet_sr.c make config # Keep default config by answering [enter] to all prompts sed -i 's|#define HAVE_AFX25 1|#define HAVE_AFX25 0|' config.h # you probably do not need X.25 protocol support sed -i 's|#define HAVE_HWX25 1|#define HAVE_HWX25 0|' config.h # We needed to change to 0 values for HAVE_AFX25 and HAVE_HWX25 so it will compile on ubuntu # to avoid x25_sr.c:80: error: ‘x25_address’ undeclared (first use in this function) # If someone has found a better way do not hesitate to comment this article! make CC="gcc -static" ifconfig netstat arp route cp "arp" "THYLACINE_OUTPUT_PATH/../bin" # cp "ifconfig" "../bin" cp "netstat" "../bin" cp "route" "../bin"
The gawk binaries :
apt-get source gawk audit/src cd audit/src/gawk-xxx # replace xxxx by the package version LDFLAGS="-static" sh ./configure # Static compiling is not always easy... make LDFLAGS="-static" cp "gawk" "../bin" ln -s "../bin/gawk" "../bin/awk"
The grep binaries :
apt-get source grep audit/src cd audit/src/grep-xxx # replace xxxx by the package version ./configure make CC="gcc -static" cp "src/grep" "../bin" cp "src/egrep" "../bin"
The lsof binary :
apt-get source lsof audit/src cd audit/src/lsof-xxx # replace xxxx by the package version ./Configure -n linux make CC="gcc -static" cp "lsof" "../bin"
The strace binary :
apt-get source strace audit/src cd audit/src/strace-xxx # replace xxxx by the package version ./configure make CC="gcc -static" cp "strace" "../bin"
The sed binarie :
apt-get source sed audit/src cd audit/src/sed-xxx # replace xxxx by the package version ./configure make CC="gcc -static" cp "sed/sed" "../bin"
The netcat binary :
apt-get source netcat audit/src cd audit/src/netcat-xxx # replace xxxx by the package version sed -i 1i"#include \"resolv.h\"" netcat.c # Why is it always so difficult to compile source code... make linux cp "nc" "../bin"
The binutils binaries :
apt-get source binutils audit/src cd audit/src/binutils-xxx # replace xxxx by the package version ./configure make LDFLAGS="-all-static" &> make.log # CC="gcc -static" does not work here cp "binutils/strings" "../bin" # more binaries in there, pick the ones you want
The findutils binaries :
apt-get source findutils audit/src cd audit/src/findutils-xxx # replace xxxx by the package version ./configure make CC="gcc -static" cp "find/find" "../bin" cp "locate/locate" "../bin" cp "xargs/xargs" "../bin"
Finally
We finished building our toolkit. Remember you should keep this toolkit (at least the bin folder) on a separate read-only file-system (like a CD).
You may want to verify that your binaries are really static. Use the ldd command for that. ldd audit/bin/*
Should echo that all tools aren’t dynamic binaries.
Also in this section
20 July 2017 – Digging passwords in Linux swap
30 May 2016 – VNC to access Kali Linux on Raspberry Pi
5 December 2010 – Linux filesystem security scans
27 August 2010 – Linux security using a limited group (PAM modules)
14 August 2010 – How to secure Linux users
1 Forum posts
There is a misprint on line 5 of the net-tools section.
It should be:
5. sed -i ’s|#define HAVE_AFX25 1|#define HAVE_AFX25 0|’ config.h
1. Build a recovery toolkit , 6 October 2013, 11:00, by Emeric Nasi
Thx, article modified