Build a recovery toolkit

D 10 June 2010 H 03:27 A Emeric Nasi C 2 messages

License : Copyright Emeric Nasi, some rights reserved
This work is licensed under a Creative Commons Attribution 4.0 International License.

Introduction

All security guides recommend you should have a security audit toolkit (or forensic toolkit or recovery toolkit). This toolkit is constituted by a set of static-linked binaries (grep,w,netstat,ls,nc,strace,ps ... etc). The problem it that these security guides tell you to build this toolkit but never show you how to do it (they just tell it can be really difficult...). In this article I will explain why we need this toolkit then I will show how to build it.

Note : The "build the toolkit" part of this article uses the apt-get package installer (for Debian-like distribs). I tested this code with success on Ubuntu, and with Debian (however some package are different and the described method may not always work).

Why a recovery toolkit?

If an attacker had gain a superuser access into your system, he could have install a malware iike a trojan or a rootkit. Therefore you cannot trust anything on your system. The su or login binaries could have been replaced by his own tool to grab your passwords. Other trojan can directly attack shared library meaning that even newly compiled code may be dangerous.
The other use of this toolkit is to "repair after an accident". A single wrong command is enough to damage important binaries or shared libraries (for example a rm -r on the wrong folder...).
This toolkit must be mounted on a read-only file-system and could be used by rootkit hunting tools such as chkrootkit.
It is also important to notice this toolkit is constituted of statically linked binaries.
We cannot rely on the system shared libraries if the system is corrupted.

Build the toolkit.

Note : The total size of the binaries + sources is about 500 Mo. The binaries size alone is less then 50 Mo.
Prerequisite :
Create a folder where you will install your toolkit.
mkdir -p audit/src
mkdir -p audit/bin
You need to install the dpkg dev package.
apt-get install dpkg-dev
The core binaries :

apt-get   source coreutils  audit/src
cd audit/src/coreutils-x.x # replace x by the package version
./configure
make CC="gcc -static -std=gnu99"
cp src/cat "../bin"
cp src/chmod "../bin"
cp src/chown "../bin"
cp src/cp "../bin"
cp src/cut "../bin"
cp src/dd "../bin"
cp src/df "../bin"
cp src/du "../bin"
cp src/echo "../bin"
cp src/head "../bin"
cp src/id "../bin"
cp src/ln "../bin"
cp src/ls "../bin"
cp src/md5sum "../bin"
cp src/mkdir "../bin"
cp src/mknod "../bin"
cp src/mv "../bin"
cp src/pwd "../bin"
cp src/readlink "../bin"
cp src/rm "../bin"
cp src/stat "../bin"
cp src/sha512sum "../bin"
cp src/su "../bin"
cp src/tail "../bin"
cp src/touch "../bin"
cp src/uname "../bin"
cp src/wc "../bin"
cp src/who "../bin"
# These are essentials but there are more in the src folder

The proc binaries :

apt-get install libncurses-dev # required to build top
apt-get   source procps  audit/src
cd audit/src/procps-xxx # replace xxxx by the package version
make SHARED=0 CC='gcc -static'
cp "free" "../bin"
cp "kill" "../bin"
cp "ps/ps" "../bin"
cp "top" "../bin"
cp "uptime" "../bin" 
cp "vmstat" "../bin" 
cp "w" "../bin"

The net-tools binaries :

apt-get   source net-tools  audit/src
cd audit/src/net-tools-xxx # replace xxxx by the package version
sed -i 's@default:@&\n break;@' lib/inet_sr.c 
make config # Keep default config by answering [enter] to all prompts 
sed -i 's|#define HAVE_AFX25 1|#define HAVE_AFX25 0|' config.h # you probably do not need X.25 protocol support
sed -i 's|#define HAVE_HWX25 1|#define HAVE_HWX25 0|'  config.h
# We needed to change to 0 values for HAVE_AFX25 and HAVE_HWX25 so it will compile on ubuntu 
# to avoid x25_sr.c:80: error: ‘x25_address’ undeclared (first use in this function)
# If someone has found a better way do not hesitate to comment this article!
make CC="gcc -static" ifconfig netstat arp route
cp "arp" "THYLACINE_OUTPUT_PATH/../bin" # 
cp "ifconfig" "../bin"
cp "netstat" "../bin"
cp "route" "../bin"

The gawk binaries :

apt-get   source gawk  audit/src
cd audit/src/gawk-xxx # replace xxxx by the package version
LDFLAGS="-static" sh ./configure # Static compiling is not always easy...
make LDFLAGS="-static"  
cp "gawk" "../bin"
ln -s "../bin/gawk" "../bin/awk"

The grep binaries :

apt-get   source grep  audit/src
cd audit/src/grep-xxx # replace xxxx by the package version
./configure 
make CC="gcc -static" 
cp "src/grep" "../bin"
cp "src/egrep" "../bin"

The lsof binary :

apt-get   source lsof  audit/src
cd audit/src/lsof-xxx # replace xxxx by the package version
./Configure -n linux 
make CC="gcc -static" 
cp "lsof" "../bin"

The strace binary :

apt-get   source strace  audit/src
cd audit/src/strace-xxx # replace xxxx by the package version
./configure 
make CC="gcc -static" 
cp "strace" "../bin"

The sed binarie :

apt-get   source sed  audit/src
cd audit/src/sed-xxx # replace xxxx by the package version
./configure 
make CC="gcc -static" 
cp "sed/sed" "../bin"

The netcat binary :

apt-get   source netcat  audit/src
cd audit/src/netcat-xxx # replace xxxx by the package version
sed -i 1i"#include \"resolv.h\"" netcat.c # Why is it always so difficult to compile source code...  
make linux 
cp "nc" "../bin"

The binutils binaries :

apt-get   source binutils  audit/src
cd audit/src/binutils-xxx # replace xxxx by the package version
./configure 
make  LDFLAGS="-all-static" &> make.log # CC="gcc -static" does not work here 
cp "binutils/strings" "../bin"
# more binaries in there, pick the ones you want

The findutils binaries :

apt-get   source findutils  audit/src
cd audit/src/findutils-xxx # replace xxxx by the package version
./configure 
make CC="gcc -static"
cp "find/find" "../bin"
cp "locate/locate" "../bin"
cp "xargs/xargs" "../bin"

Finally

We finished building our toolkit. Remember you should keep this toolkit (at least the bin folder) on a separate read-only file-system (like a CD).
You may want to verify that your binaries are really static. Use the ldd command for that.
ldd audit/bin/*
Should echo that all tools aren’t dynamic binaries.