Hacking Linux Distro?

Printable View

July 22nd, 2002, 01:29 AM
SFNative

Hacking Linux Distro?

I was saying to a buddy of mine that, if I had the know-how and time, I would like to build a custrom distro that is setup specifically for hacking away at my network. Basically something I could run on a notebook that is hardened very well and comes standard with things like a solid portscanner, vulnerability assesor, password cracker, etc. Not a lot of frills though. It would be cool too if the kernel was trimmed down to only the necessities for such a system.

He said that he was pretty sure that something like this already existed but he couldn't remember the name. Personally I think he was just talking out of his ass.

Can anybody confirm this?
July 22nd, 2002, 02:01 AM
[WebCarnage]

Linux
Yeah...it's called Slackware...

http://www.linuxiso.org

Want programs like a vulnurability assesor and password cracker that run on Linux?

Links:
- John the Ripper
- NetIQ
...have fun.
July 22nd, 2002, 02:05 AM
avdven

If you're looking for something secure, check out the BSD line of Unix for i386s. As for the tools needed to hack your own network, there are tons of hacking tools available on the 'net, but what stops you from using them on external networks once you've finished with yours? If you want to do an assessment of what's not secure on your network, there are very good professional packages dedicated purely to looking for vulnerabilities on a local network and they will also give a list of patches and workarounds for most of the known vulnerabilities to lock down your network.

I haven't heard of a specific OS with everything already prepacked for something like that, though I know there are tools available which are small, proprietary computers which can be purchased through selected retailers. If you are interested in taking a look at one of inquiring regarding the pricing of such tools (they're not cheap...), PM me and I can give you some contacts to get a hold of.

AJ
July 23rd, 2002, 12:04 AM
SFNative

Re: Linux
Quote:
Originally posted here by [WebCarnage]
Yeah...it's called Slackware...

http://www.linuxiso.org

Want programs like a vulnurability assesor and password cracker that run on Linux?

Links:

John the Ripper
NetIQ

...have fun.
Actually, I've already done that. Just thought one day that it would have been nice to be able to have that prebuilt (eventhough the process did teach me a bit about Linux). On the other hand...

Quote:

Originally posted here by avdven
As for the tools needed to hack your own network, there are tons of hacking tools available on the 'net, but what stops you from using them on external networks once you've finished with yours?
AJ

Right. Were I to actually build one of these, I would surely keep it to myself. Of course, if somebody had already released one, I would surely grab it.

Of course, I guess that opens up the whole question of "If I install this what sorts of problems am I opening myself up to? A big neon sign that says 'Hack Me'? Investigation by the authorities next time something nasty happens?"

Guess the old addage is true: If you want something done right, do it yourself.
July 23rd, 2002, 01:44 AM
Sudo

Re: Hacking Linux Distro?

Quote:

Originally posted here by SFNative
I would like to build a custrom distro that is setup specifically for hacking away at my network.

I have no idea what you mean by "hacking away at my network", however, there is such a thing as a custom distro. It is called Linux From Scratch (http://linuxfromscratch.org/) LFS is great, but it takes a long time to build it and a good understanding of the innerworkings of Linux. One step down from that would be Gentoo Linux (www.gentoo.org). Gentoo Linux is an excellent distro that I would recommend to anyone.

Quote:

Basically something I could run on a notebook that is hardened very well and comes standard with things like a solid portscanner, vulnerability assesor, password cracker

For a portscanner I recommend Nmap (http://www.insecure.org/)

I've never heard of a vulnerability assesor.

Password cracker!? Why??? Make secure passwords and there is no need to be worry about someone brute forcing their way in.

Quote:

It would be cool too if the kernel was trimmed down to only the necessities for such a system.

That's easy enough. Compiling a custom kernel is a required step for the installation of both LFS and Gentoo Linux. When you configure it, be sure to remove any unnecessary drivers/options.

But, like I stated previously, I have no clue what you are trying to acheive here, or for that matter whether or not my suggestions hold any value to you.

--Sudo
July 23rd, 2002, 07:20 AM
souleman

WebCarnage> why are you recommending John the Ripper over Crack5? Just curious...

avden> BSD rocks, but have you ever tried installing it on a laptop? I can get it running, but not with everything running properly. Either network problems or X problems or.....

Sudo> Vulnerabilty scanner....SATAN, Nessus, etc etc etc... There are a lot of them out there now.

SFNative> Most distro's come with most of what you want. Other then a few things like a bloated kernal and a password cracker, most have it. Also look for a distro called bastille (can't remember the exact spelling). It is supposed to be more secure....
July 23rd, 2002, 07:26 AM
avdven

Souleman > Nice job replying to everyone who posted before you. hehe

Anyway, in response to your question, I actually have tried installing FreeBSD on a laptop. I originally had it installed on a new P4 workstation, but discovered that I had more uses for a new P4 desktop than an old P3 laptop. :-) It's a Dell Inspiron and everything seemed to work pretty well after installation. Granted, I had quite a bit of problems during the installation (just as you said, with the X installation) due to graphics adapter issues, but after a few installs, I finally found the right combination of settings which allowed it to work. I haven't used it extensively yet, but I'm pretty happy with it so far. I have two AIX machines (a server and a workstation) as well as a few Red Hat workstations and it's not all that different... kind of a cross between the two. :-)

AJ
July 23rd, 2002, 06:30 PM
SFNative

Sorry, guess I wasn't terribly clear.

What I meant by "hacking away at my network" was essentially penetration/vulnerability testing of my network. Both from the inside and the outside.

Here is what I currrently have and have had.

Currently Have:
RH 7.2 - Bastille Hardened
nmap
Nessus
SARA
clients (only) for SSH, Telnet, etc.

Have Had:
Slack 8.0
somewhat trimmed kernel
nmap
Nessus

What I would like to have:
All of the above (minus the Redhat/Slack)
Well-Hardened Customized Linux (a la LFS or BYOLinux to achieve the trimmed down kernel)
a very good password cracker
any other highly slick thing that I have missed

I want the kind of box that a cracker with real know-how would build for themself. Sort of a "Hack In The Box".

Yes, I can see where this would be like unleashing a doomsday weapon to a bunch of teenagers. However, as these posts indicate, those teenagers already can (and probably have) built one themselves.

The ones who are less likely to have such a device are network admins. Put together correctly and with solid documentation, it could be a boon to them (us).

Like I said though, if I did build it, I'd probably keep it to myself.
July 23rd, 2002, 06:46 PM
AngryBob

i think you are overlooking a sniffer. they are very usefull. i also dont quite get why hardening it is such a big deal...if its a laptop that means you would be moving around with it right? you think that hardening a desktop or server would be more imperative. if you are going to bring it somewhere and plug it in and hack away i wouldnt be that worried about someone hacking you.
July 26th, 2002, 06:57 PM
SFNative

Quote:

Originally posted here by AngryBob
i think you are overlooking a sniffer. they are very usefull. i also dont quite get why hardening it is such a big deal...if its a laptop that means you would be moving around with it right? you think that hardening a desktop or server would be more imperative. if you are going to bring it somewhere and plug it in and hack away i wouldnt be that worried about someone hacking you.

Actually, yes, I neglected to mention the sniffer. I'm using Ethereal. It comes with RH 7.3.

As far as hardening goes, it's not that it's a prerequisite for the type of machine I'd be using. I just can't see any reason to not harden a box, provided that hardening doesn't restrict you from making use of features you desire.

Which I guess brings up another question: Is there a good reason to not harden? For example, in the case of a honeypot, I would imagine you would not want it hardened much, if at all. Could the same be said for a machine being used as an IDS? Would not hardening it allow you to get a more accurate view of intrusions? Following that logic, what about the exact kind of box we are talking about here? Would hardening it prevent you from seeing little holes into your network you might spot otherwise?
July 26th, 2002, 09:31 PM
Sudo

Quote:

Originally posted here by SFNative
As far as hardening goes, it's not that it's a prerequisite for the type of machine I'd be using. I just can't see any reason to not harden a box, provided that hardening doesn't restrict you from making use of features you desire.

I agree, limit the risk as much as possible without restricting the access that is necessary for that specific machine.

Quote:

Which I guess brings up another question: Is there a good reason to not harden? For example, in the case of a honeypot, I would imagine you would not want it hardened much, if at all.

Well here lies one of the biggest problems when implementing a honeypot. If you don't "harden" the box at all (I.E firewall rules, basic securtiy practices) then the intruders may get suspicious very quickly, causing them to leave before you get to learn anything about what they do once they are in (I.E preserving root access.)

Also, If you neglect to secure your honeypot then the attackers that manage to get in will have full access to the server and your network. The intruder could then use your machine to scan and compromise more servers. If they use your machine to attack other networks, then you could be held liable for any damage.

On the other side of the scale, is hardening your honeypot too much. If it is too secure, then intruders will not even bother.

So as you can see, there is a very fine balance between hardening your honeypot too much and hardening too little (or not at all.)

Quote:

Could the same be said for a machine being used as an IDS? Would not hardening it allow you to get a more accurate view of intrusions?

As far as I know, IDS is generally run on a firewall machine, a gateway or in the situation of a honeypot. The level of "hardening" really depends on the machines application.

Quote:

Following that logic, what about the exact kind of box we are talking about here? Would hardefree reignning it prevent you from seeing little holes into your network you might spot otherwise?

Well, obviously if you limit or disallow all outgoing connections, then yes it would prevent you from exploring your network. However, you could probally safely drop all incoming packets, and only allow connections that you started.

--Sudo