Root Access

Journeyman Geek

00:14

0

Q: Is there a Windows utility to delete contents of RAM left by an application?

Ideally, this utility would know where in physical RAM an application was and completely clear its contents when it's closed. Does anyone know of such a utility?

I really want to know why

Oliver Salzburg

@JourneymanGeek That's why I asked :D

Journeyman Geek

@OliverSalzburg: Forensics is part of one of my majors ;p

Oliver Salzburg

@JourneymanGeek I was wondering if I should even mention security aspects. At this point, I'm mostly wondering if he's just trying to "free mem"

Journeyman Geek

well, you already mentioned that

And the first thing I thought of was something clever with that odd little win32 fork that could write to memory doing something similar to, but not entirely unlike a secure wipe

Oliver Salzburg

So, to my understanding, when you free memory, or when it's freed by the OS once the process exits, the memory space is added to the Standby part

Once the OS has time to do it, it will zero out the memory and move it to the Free part

Journeyman Geek

00:20

yup. Unless its used

so the trick is to fake a memory leak ;p

Oliver Salzburg

So, if someone doesn't even mention that, I usually don't expect them to be too hot in the security business :D

Journeyman Geek

;p

you'd be suprised how paranoid people are ;p

Oliver Salzburg

@JourneymanGeek Memory can move from Standby directly to being reallocated?

Journeyman Geek

@OliverSalzburg: I'd guess if something is actively using it, physical memory would be cleared...

and possibly moved to swap, which would be worse

;p

Oliver Salzburg

I just watched through that Windows memory talk by Russinovich once

It was tough! But I sat through it

Journeyman Geek

00:23

well if he's trying to free ram that would be better

Russinovich is a genius ;p

there's maybe 3-4 people who have anything close to his level of skills, who used to be outside MS

MS hired most of them, even the guy from reactos

Oliver Salzburg

I really love his talks

And the Case of the Unsolved posts

So much great stuff he put out there

Journeyman Geek

oh, and the sony rootkit discovery ;p

well he and nirsoft's tools are quite often the first thing I hit when I come across interesting problems

Oliver Salzburg

@JourneymanGeek I keep both on my Google Drive WSCC FTW!

Journeyman Geek

thats quite cool

I haven't had any interesting software problems lately

Oliver Salzburg

Our TV died today

We're hoping to get it repaired next week

Journeyman Geek

00:27

hardware on the other hand, my c2d is turning into Ship of Theseus

3

blah

lol

and my mouse. I hope I get it next week, else someone is going to get a VERY justifiably angry phone call

Oliver Salzburg

@JourneymanGeek wtf, I had to click that even though I only learned about that last month!

Journeyman Geek

lol

AKA My Grandfather's Axe

which is where I first learnt the concept ;p

Oliver Salzburg

I was just like "Damn... this sounds familiar"

So, what's a c2d?

Journeyman Geek

core 2 duo

Oliver Salzburg

oh

Journeyman Geek

00:31

my old desktop. Up until this point, I've replaced one hard drive (not the boot one tho), a fan, and a video card

I have a possibly failed stick of ram

If there's a motherboard failure, I'll basically have replaced everything but the case, and the boot drive, and the latter will fail eventually

so.. would it be the same computer? ;p

Oliver Salzburg

lol :D

Well, it doesn't work so well on a computer, does it?

Once you replace the storage...

...

Journeyman Geek

reinstalled the OS once too ;p

Oliver Salzburg

Let's not get started with philosophy!

Journeyman Geek

XD

Oliver Salzburg

Tomorrow is going to be really interesting

I'll go to the fair and implement all the last-second changes our client wants

Into the system that we're going to install tomorrow

So, step 1, install system. Step 2, make last-second changes once it runs for the first time

I love to work like this

Journeyman Geek

00:36

;p

(I'd argue its the same computer, but mainly cause its easier to justify ;p)

Oliver Salzburg

Writing software for fairs is really messed up. It's always the toughest deadlines. There can't be any delays, because they're not going to delay the fair because of your software :D

Journeyman Geek

lol. the thrill of "OHMYGODDONOTBLOWUPDONOTBLOWUPDONOTBLOWUP"

4

Oliver Salzburg

@JourneymanGeek I asked my girlfriend about the ship of theseus. I had only formulated and articulated the question and she instantly answered "It's not the same ship obviously"

Journeyman Geek

lol

ask her when does it stop being the same ship then ;p

Oliver Salzburg

Oh, I even asked her about "What if you construct a second boat from the parts you took from the first boat?"

And I even bridged the gap to human life and how you are not at all the same person you were 20 years ago

Journeyman Geek

00:40

poor lass ;p

Oliver Salzburg

The whole shebang!

Journeyman Geek

... actually by that metric, I'm still running the dell 530

my current computer was that computer, but I started swapping parts. The one part that was on the dell was the only part I installed to it

mind blown

Oliver Salzburg

@OliverSalzburg and Journeyman Geek: I am a bit worried about live forensics, and am looking for a solution to zero out an area of RAM when a restart would not be ideal. — christiansonk 9 mins ago

You were on the right track :)

Journeyman Geek

XD , Unplugging is the smart thing

and a lockable case

most forensics guys do NOT carry boltcutters

Bob

@JourneymanGeek maybe rig up the chassis alarm to interrupt power?

actually, that would be pretty good protection against a cold boot attack

interrupt power if the case is removed

@Boris_yo I have no idea. Creative Cloud isn't as outrageously expensive as the full Master Collection, though.

Journeyman Geek

01:51

Pretty much. Ooh or have a key based lock/power switch. You would never open a running system anyway

hanleyhansen

02:26

i can ssh into my remote server but i can't get any outbound traffic on the server

wth?!?!

i can't ping anything or wget anything

but i can ping my gateway just fine

HackToHell

@hanleyhansen check your iptables

hanleyhansen

passwd:     files
shadow:     files
group:      files

#hosts:     db files nisplus nis dns
hosts:      files dns

# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files

bootparams: nisplus [NOTFOUND=return] files

ethers:     files
netmasks:   files

@HackToHell that's my /etc/nsswitch.conf

anything look weird?

[root@localhost ~]# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:bootps
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

HackToHell

@hanleyhansen That seems to be ok

hanleyhansen

look at the last line of my iptables list

nothing under Chain OUTPUT

is that ok?

HackToHell

yeah, that's ok

hanleyhansen

02:39

so what can it be? this is a fresh install. i can ssh into the machine but i can't ping anything or wget anything and nothing resolves

HackToHell

You could post a question on SU

And you could save your current iptables, flush it and check just to be sure

hanleyhansen

even when i stop iptables i can't ping google.com

0

Q: CentOS 6.4 Inbound Working Outbound Isn't

I have a CentOS box installed remotely and I can ssh into it fine. However, I can't get any outbound connections to work (wget, ping etc). I can ping my gateway and other machines on the network using the same gateway have an Internet connection. FYI, this is a fresh install of CentOS 6.4. Any i...

linux networking centos internet-connection

Bob

03:11

@hanleyhansen have you tried pinging an ip?

e.g. 8.8.8.8 (Google public DNS #1)

hanleyhansen

@Bob yeah. no luck.

Bob

does name resolution work?

hanleyhansen

nope

so far i can only ping stuff inside the network.

i can ping the gateway

Bob

could you post your routing tables?

hanleyhansen

[root@localhost ~]# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT udp -- anywhere anywhere udp dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp dpt:bootps
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Bob

03:13

no, your routing tables

route

hanleyhansen

k hold on

Bob

it should look something like this

bob@ubuntu:~$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.255.2   0.0.0.0         UG    0      0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.255.0   *               255.255.255.0   U     1      0        0 eth0

hanleyhansen

[root@localhost ~]# route
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    10.10.20.0      *               255.255.255.0   U     1      0        0 eth0
    192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0

whoops forgot one

Bob

...you're missing a default route

hanleyhansen

[root@localhost ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.10.20.0      *               255.255.255.0   U     1      0        0 eth0
192.168.122.0   *               255.255.255.0   U     0      0        0 virbr0
default         10.10.20.1      0.0.0.0         UG    0      0        0 eth0

Bob

03:20

yea, that's a bit better :P

hanleyhansen

last one took a while to come up btw not sure if that means anything

that first destination, what is that? the network address?

my ip is 10.10.20.55

and my gateway should be 10.10.20.1

Bob

that one is probably for the local subnet

i.e. it shouldn't go through a gateway

hanleyhansen

gotcha

Bob

The Windows equivalent (as of Vista) will say On-link

hanleyhansen

any idea what can be wrong?

Bob

03:23

> An asterisk (*) appears in this column if no forwarding gateway is needed for the network.

it looks right?

hanleyhansen

looks right to me

[root@localhost ~]# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
55 packets transmitted, 0 received, 100% packet loss, time 54875ms

Bob

is there any chance that the gateway is blocking outgoing from this machine?

hanleyhansen

the network admin says "no"

Bob

:\

hanleyhansen

this is a fresh install of CentOS and he swears it's something in the server

Bob

03:27

I don't know much on the iptables side

so it might be something there

please update your question with more details

for example, the iptables and route output, and the IPs of the machine, subnet and gateway

you might get more help that way

(put it under a heading as additional information or something, so it doesn't look too scary to anyone opening it.. :P)

hanleyhansen

lol ok

will do thanks

Bob

it's odd that you have so many iptables rules though

root@kvm:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

relatively clean Ubuntu installation... might be a CentOS thing

check the output for iptables -t nat -L and iptables -t mangle -L?

hanleyhansen

[root@localhost ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535
MASQUERADE  udp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-65535
MASQUERADE  all  --  192.168.122.0/24    !192.168.122.0/24

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

[root@localhost ~]# iptables -t mangle -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
CHECKSUM   udp  --  anywhere             anywhere            udp dpt:bootpc CHECKSUM fill

Bob

huh

hanleyhansen

problem?

Bob

03:33

you have some NAT going on with anything not sent to the 192.168.122.0/24 subnet..?

hanleyhansen

same dude set this server up unfortunately

i'm just a humble developer trying to bring up a web server

Bob

wait.. if he set it up.. shouldn't it be his job to make sure the internet connection is working?!

hanleyhansen

i don't understand what you mean

@Bob believe me i tried convincing him that it was his job

new and improved question

0

Q: CentOS 6.4 Inbound Working Outbound Isn't

I have a CentOS box installed remotely and I can ssh into it fine. However, I can't get any outbound connections to work (wget, ping etc). I can ping my gateway and other machines on the network using the same gateway have an Internet connection. FYI, this is a fresh install of CentOS 6.4. Any i...

linux networking centos internet-connection

anything else you can think of that i can add to help?

Bob

I don't think so..

@hanleyhansen is there any reason you have to use this server? :P

hanleyhansen

bc he's an idiot

well he happens to be a partner at the company that hired me to do their website

Bob

03:39

I guess this isn't a commercial VPS provider or anything?

ah

hanleyhansen

not at all

Bob

so, their local machine?

hanleyhansen

i wouldn't be surprised if this server is in his house or something

lol

Bob

:P

then I wouldn't be surprised if he bungled the config somewhere

I guess you can't you get them to set up a working webserver? I know quite a few developers require one.. :\

or get your own machine and charge them for upkeep :P

though I guess it's a little late for things like that

hanleyhansen

i offered them hosting but they said no

Bob

03:42

sigh

hanleyhansen

i also offered to do the installation myself but he said he's been installing linux servers since before i was born

Bob

if they won't let you provide hosting, they should at least provide working hosting themselves :\

double sigh

hanleyhansen

i'm only 21 lol

Bob

still, unless you've gone and fiddled with it, he effed up

I wouldn't be surprised if he thought hey, it's a webserver, it should only need incoming connections!

Journeyman Geek

lol

probably BS

Bob

03:44

actually, wait...

what do you need an outgoing connection for?

hanleyhansen

lol

Journeyman Geek

linux has only existed since 91

Bob

I guess downloading packages/updating

hanleyhansen

@Bob updates

yeah

and packages

Bob

have you considered a VPN from your home machine to the server? :P

hanleyhansen

03:45

i asked and he said no

Bob

you can initiate the connection from your side

...

hanleyhansen

now he's going to try installing another server

face-palm

Bob

can you get over there and slap him?

hanleyhansen

i know where he lives and the server must be in his house if he's playing with it now. it's 10:40 on a saturday night

he lives about 40 mins away driving distance. slapping him is becoming really tempting right now.

Bob

you're not allowed to do anything! now make me a website! and I won't help get things set up, even though I won't let you set anything up!

people like that have no business near... well, anything, really.

hanleyhansen

03:47

lol you were at our meeting?

if i wasn't getting married in august and needed the extra projects i would've given this guy the boot!

Bob

oh? congratulations!

hanleyhansen

thanks! can't afford to say no to a project lol

Bob

your iptables output is weird

ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-port-unreachable
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

it... looks like they're all rules with the same conditions (anywhere anywhere)

hanleyhansen

now he's telling me he installed ssh via yum...

Bob

and the middle two are exact copies..

hanleyhansen

03:51

dude wasn't kidding when he said he was going to install another server lol i just got kicked off

Bob

is there a chance that ssh is more restricted than a tty login?

hanleyhansen

i've done this at least 100 times in my IT career and i've never had a problem with ssh

it's usually the same procedure when clients host their own server. someone installs linux and gives me an ip and root password

i disable ssh login via password and put my pub key in

Bob

I guess restrictions are more user-based, not login method

hanleyhansen

start installing my packages then develop

never had this issue before

Journeyman Geek

blah, you guys are reminding me I am procrastinating ;p

hanleyhansen

03:54

here procrastinate some more

caylin-hanley.com

Journeyman Geek

lol

I have a desktop to troubleshoot, and a wordpress install to set up

KronoS

@JourneymanGeek meh that can wait til tomorrow :P

Journeyman Geek

I also need to call and very politely ask about the status of my mouse, though I really want to yell at someone at this rate

Bob

@hanleyhansen you could try a traceroute, but most likely it's being dropped at the gateway anyway

hanleyhansen

right now i can't try anything

Journeyman Geek

03:57

It could, but more productive procrastination is nice

hanleyhansen

he must've powered off

Journeyman Geek

I also have two assignments ;p

hanleyhansen

i'll do your wordpress install if you do this network crap for me.

Journeyman Geek

lol

it takes maybe 5 minutes ;p

and of course set up a virtual server with my other domain name

Bob

actually, should've done a traceroute

if we could confirm it was reaching the gateway, then that's really a not-my-fault situation :P

hanleyhansen

03:59

i did in the begining

HackToHell

Network problems suck, reminds me that i still have not fixed this issue askubuntu.com/questions/239921/…

hanleyhansen

it went through the 30 hops and got nowhere

Bob

so not even a single hop?

hanleyhansen

nope

Bob

blah. ok, server's misconfigured. probably.

unless the gateway is set to not respond to expired icmp packets..

hm..

hanleyhansen

04:00

@Bob well hopefully he gets it right this time

Bob

tcptraceroute?

hanleyhansen

didn't try it

"Install should be done soon"

hanleyhansen

04:31

headdesk headdesk headdesk

same crap

Bob

sigh

try a tcptraceroute for kicks?

hanleyhansen

he fixed it

it was on his end, of course

multiple firewalls on the network lol

Bob

-__-

hanleyhansen

should i delete my question?

Bob

1 hour ago, by hanleyhansen

the network admin says "no"

sigh

@hanleyhansen if you want

hanleyhansen

04:44

lol he feels stupid now. that's enough satisfaction for me.

Bob

I guess you could self-answer with a 'the issue was an external one' or something, but that might be too localised

hanleyhansen

@Bob i think i should. i don't think it'll be of any use to anybody. unless i mark the answer as "don't believe the network guy...ever"

Bob

lol

Journeyman Geek

04:59

lol

@hanleyhansen: in some cases the process of finding the answer is as useful as the answer

Bob

@JourneymanGeek you mean bugging the network guy? :P

Journeyman Geek

and by bugging, you mean THE BEATINGS WILL CONTINUE TILL MORALE IMPROVES!

HackToHell

05:22

This site is lame lockergnome.net

Journeyman Geek

05:39

why does the name of the guy who runs that site sound oddly familiar

lo @Sam

HackToHell

gironsec.com/blog/2013/03/reversing-a-botnet

FUN !

HackToHell

06:01

Someone's there, runs away

Bibhas

Nowadays I come across too many clones of SE

Journeyman Geek

prolly cause it works ;p

its only as good on the people on it tho ;p

Bibhas

yeah. Without the community, it's yet another yahoo answers. :P

Journeyman Geek

yeah, and SE does some smart things to keep em

Journeyman Geek

06:25

/me totally blames the first year T shirt for keeping me around ;p

HackToHell

/me curses Indian Postal system for loosing my tee

Bibhas

/me curses himself for not being around long enough to get the tee. :P

jokerdino

07:20

@HackToHell they made your tee bigger?

HackToHell

@jokerdino They lost it, i never got it :/

jokerdino

yeah, I got it. ;) but you said they made your tee looser.

and how's the exams going so far?

HackToHell

;p

EXAMS SUCK !

jokerdino

haha, 12th board right?

HackToHell

Have my physics exam tomorrow and I am really scared ! :(

jokerdino

07:24

cant afford to muck it

HackToHell

@jokerdino unfortunately yeah

but then there are a lot of entrance exams even if i muck it (which i will)

jokerdino

eh :/

HackToHell

too much to memorize :P

jokerdino

don't worry. you dont need most of them after exams ;)

HackToHell

Should have joined a ISC school :/

:D

Journeyman Geek

07:27

lol

true of school in general at any level

jokerdino

i had work today. totally bunked it.

Journeyman Geek

:/

jokerdino

hey wait, @JourneymanGeek you still in singapore right?

Journeyman Geek

yeah

jokerdino

i need some favour :P

Journeyman Geek

07:28

duh, where else would I be?

like? ;p

HackToHell

lol

jokerdino

my bro wants me to inquire on IDEC singapore.

Journeyman Geek

like call them? Go there?

jokerdino

@JourneymanGeek go there and ask them details. kinda

like the product details and prices.

Journeyman Geek

ahh

jokerdino

07:30

i think it is in the heart of the city.

Journeyman Geek

nope

tannery lane is in mcpherson/ubi

jokerdino

oh.

Journeyman Geek

If I happen to need to go there I can ;p

jokerdino

well, the idea is to countercheck idec products from the indian distributor.

Journeyman Geek

I might have to go to AMK for a RMA. The stupid distributor seems to be taking their own sweet time authorising my replacement :/

ahh pricewise?

lol

jokerdino

07:32

i can send you a small gift if done ;)

Journeyman Geek

We do on occation purchase and cross ship parts for an indian customer

jokerdino

@JourneymanGeek where'd you get that?

Journeyman Geek

oh, its a company that we use when we need to rebuild motors

we also sell them parts they can't get in india

jokerdino

we can source idec products in india but the distributor is a dick.

Journeyman Geek

lol

I mean, I can talk to my dad and see if he or my brother can check

jokerdino

07:34

@JourneymanGeek oh those. yeah that would be awesome.

Journeyman Geek

not sure what the status of the old company is right now tho ;p

jokerdino

might also want to know about how to become a distributor in india ;)

HackToHell

So both your families do the same business ?

Journeyman Geek

nope ;p

jokerdino

@JourneymanGeek eh, get it back.

Journeyman Geek

07:35

we do port engineering and random crap

jokerdino

@HackToHell no. not my family. the brother is my uncle's son.

Journeyman Geek

but looking at this, its something I have no idea about, and others might ;p

jokerdino

i am helping them with cleaning up the office

@JourneymanGeek oh, this one is electric engineering stuff

Journeyman Geek

lol

@jokerdino: yeah, I know that much

jokerdino

@JourneymanGeek that's all i know

Journeyman Geek

07:37

lol

PLCs are microcontrollers for controlling very large machines

jokerdino

probably yeah.

Journeyman Geek

/me hates phonecalls tho

and If I go around there, I might drop by the ban leong service center, they sell older parts dirt cheap

(its still rather out of my way :/)

jokerdino

i kinda forgot about the singapore geography

Journeyman Geek

lol

ya ;p

Don't so did I last week ;p

I have a friend who lives in joo koon. I had some military stuff all week, which involved visiting museiums...

including one right next to where she lives. I'd told her 'its a wee bit far, we'll see after i'm done' ;p

I could have walked in, popped a cd, and told her to turn it off in an hour or so ;p

jokerdino

lol

joo koon is in the west. so was my school.

Journeyman Geek

07:43

lol

Dover right?

jokerdino

you were in the south. where is this lane?

Journeyman Geek

Joo koon is.. wester

jokerdino

@JourneymanGeek yeah.

Journeyman Geek

what lane?

jokerdino

Potong Pasir. the IDEC office dude.

Tannery ln

Journeyman Geek

07:44

oh, mcpherson/ubi area

near the postal center

maps.google.com.sg/…

jokerdino

hm, not terribly far from sentosa :P

Journeyman Geek

lol

I can see ~~russia~~ sentosa from my house

jokerdino

:P

jokerdino

07:58

@JourneymanGeek anyway, if you get anything, drop me an email or something.

i cant wait for the power to go down anytime soon.

Journeyman Geek

lol

god I wish they would fix that

Transcript for