Author: Thomas Faddegon

Do you like my posts and want to do something back? You can buy me a beer :)  

Git SFTP

I was working for an elementary website of a friend of mine. I pushed the website to GitHub so it’s was way easier to maintain the site.

But I thought it must be easier than transferring all the changes every time by an FTP program. So I found git-ftp and of course FTPS didn’t work out of the box 😉

Windows

What you have to do to enable GIT FTP (on Windows)

First start an ssh sessions from powershell

ssh [email protected]

This will add the public key to you known host. Otherwise you will get this error later

fatal:  Can't access remote 'sftp://SOMEUSER:***@SOMEHOSTNAME'. Network down? Wrong URL? exiting...

You can see this with the -vv parameter

git ftp init -vv

Now it’s time to install git-ftp

  • First go to c:\program files\git
  • Then run git-bash as administrator

And install git-ftp (bin is an alias for program files)

$ curl https://raw.githubusercontent.com/git-ftp/git-ftp/master/git-ftp > /bin/git-ftp
$ chmod 755 /bin/git-ftp

No go to your project and enter these commands

git config git-ftp.user SOMEUSERNAME
git config git-ftp.url sftp://SOMEHOSTNAME/public/sites/SOMEWEBSITE/
git config git-ftp.password SOMEPASSWORD
git ftp init

And the next time you make a change you only have to do

git ftp push

Linux (Debian)

For linux the steps are much easier.

First start an ssh sessions from bash

ssh [email protected]

This will add the public key to you known host. Otherwise you will a error later.

Now install ftp-git

$ sudo apt install git-ftp

No go to your project and enter these commands

git config git-ftp.user SOMEUSERNAME
git config git-ftp.url sftp://SOMEHOSTNAME/public/sites/SOMEWEBSITE/
git config git-ftp.password SOMEPASSWORD
git ftp init

And the next time you make a change you only have to do

git ftp push

When you get an errors like these:

zo 19 dec 2021 23:11:50 CET: Retrieving last commit from sftp://******:***@s*******/public/sites/*********/.
*   Trying *********:22...
* Connected to ******* (********) port 22 (#0)
* Found host ******** in /home/******/.ssh/known_hosts
* Set "ecdsa-sha2-nistp256" as SSH hostkey type
* Closing connection 0
curl: (79) Error in the SSH layer

zo 19 dec 2021 23:11:50 CET: fatal: Could not get last commit. Use 'git ftp init' for the initial push. Can't access remote 'sftp://******:***@********'. Network down? Wrong URL? exiting..

Then try the --insecure parameter

git ftp push -vv --insecure

Happy uploading 🙂

Android LOGD battery drain

Pfff I’ve had a battery drain for weeks on my Oneplus device (you know that your phone battery drains faster than you would expect). But that drain was not visible in the android battery overview.

I had already installed an app (betterbattrystats) that give you more information about the drain. With betterbatterystats I found out that logd could be the issue, but logd is a log service so it should not be a root cause.

So I found out that you could just start a task manager (top) from the Android debug tools. What seems; the youtube music app was draining my battery. Even though I don’t even use it. You can’t delete that app either so I forced stopped it and now everything is quiet.

Really wtf; I am a tech guy and have to put in so much effort to figure this out. How many people don’t have the same issues but just accept it?

How can you fix this?

  • First install ADB
  • Put your phone in development mode
  • Start top
adb shell top -m 20 -d 2

Here you can see the logd and the com.google.and+

To figure out what PID 9036 is

adb shell ps | grep 9036

And voila; the root cause…. Youtube music

So I turned off the Youtube app and now everything looks nice!

Please google don’t hide you shitty services from the android battery overview!

Happy debugging!

DHCP Test Tool

I had to check my DHCP configuration for a Dell Wyse Thin Client. But when you configure specific options like 161 and 162 you don’t see that options in a Wireshark capture during a Windows DHCP request.

Luckily for us CyberShadow created a great tool to test some specific DHCP settings an he even make it open source: https://github.com/CyberShadow/dhcptest

This DHCP tool have 2 great features:

  1. You can do a request for specific DHCP option
  2. You can send a vendor class so in my case I can pretend to be a Wyse Thin client.

DHCP Request Option

This will only work when you have configured Global DHCP settings.

dhcptest.exe --query --request 161

DHCP Vendor Class

First I had to figure what the vendor class was. I checked this on the DHCP server:

Or on a Thin client itself:

Then run this command:

dhcptest.exe --query --option "60=wyse-1000"

And you will get Vendor Specific Information in Hex.

You can do different things to translate the Hex into readable data.

  1. Compile the open source yourself yourself and create a output in a string
  2. Use a (online) hex convertor
  3. Open wireshark during the capture. Wireshark will translate this for you 🙂

Compile the tool

  • Download the git repo
git clone https://github.com/CyberShadow/dhcptest.git
  • Edit the file (add these 2 lines)
161 : DHCPOptionSpec("File Server", OptionFormat.str),
162 : DHCPOptionSpec("Root Path to the File Server", OptionFormat.str),
dmd dhcptest.d

This will create a exe for you and will translate the Hex to readable format.

Happy sniffing!

Windows network package capture without installing anything (on the server)

I like Wireshark. But I don’t like to install software on a server for troubleshooting purposes. Especially when you need software like PCAP to sniff some network data.

But what you can do is capture data data with netsh, copy the data to your workstation, convert the data so you can read it with wireshark and do you thing.

Capture the data

Run this command to capture the data (elevated command prompt)

netsh trace start capture = yes ipv4.address = x.x.x.x

And stop the capture when you are done

netsh trace stop

Copy the files to you computer

Convert the capture

Download the etl2pcapng converter from the MS Github repo: https://github.com/microsoft/etl2pcapng

Convert the data

etl2pcapng.exe NetTrace.etl out.pcapng

You can open the out.pcapng file and do you thing.

Happy Troubleshooting!

Slow initial RDP connection

For me, this was a pain in the ass for a long time. When I connect to a Windows server through RDP/RDS it sometimes takes more than 2 minutes to connect to a server. Today after some waiting, and waiting and some more waiting I did a deep dive with Wireshark to figure out why it was so slow.

My setup

  • Azure domain joined Windows 10 device (Laptop)
  • Connection over a Cisco Anyconnect VPN
  • Remote Desktop Manager (Devolutions)
  • Native RDP client
  • MremoteNG

Remote VS local

I know for sure the issue should be in my setup. Because when I connect first to a jump host (RDP) and then connect to other domain-joined servers everything was connected almost immediately after I put in my user credentials.

What to do (TL;DR)

There are four things you have to modify to speed up the initial remote desktop connection speed:

  1. Disable SSL / TLS1.0
  2. Disable Netbios on the VPN network adapter
  3. Disable automatic proxy settings in Windows
  4. Change the credential to domain.local\admin or [email protected] instead of domain\admin

Disable SSL / TLS1.0

No, you don’t have to negotiate what protocol you have to use to connect a server. Use TLS1.2 or I don’t want to connect with you 😉 So:

How to

  • Start > Run > Regedit
  • Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client
  • If the TLS 1.0 and Client folders doesn’t exists create these keys
  • Create a 32 DWORD value with the name Enabled
  • Value data: 0 (Hex)
  • Restart the client
Enabled = 0

Disable Netbios on the VPN adapter

What I was seeing in my Wireshark capture is that RDP was trying to broadcast to get information over NETBIOS. You have a DNS server so you don’t need a legacy broadcast protocol! Unfortunately, I don’t have any screenshot of the capture but you can always check yourself 😉

How to

Change the VPN Adapter and reboot the computer:

Disable Netbios

Disable the proxy

After connection to a server with RDP and you enter the credentials Windows is trying constantly to WPAD.domain.local to autoconfigure itself. WPAD stands for Web Proxy Auto-Discovery and I think you never want to autoconfigure a MITM ehh proxy device. You always want to have full control of your device. So, disable this to speed up the connection and make your device more secure.

Wireshark Capture WPAD A record

How to

  • Go to settings
  • Search for proxy
  • Switch the Automatically detect settings to Off
  • Restart Windows
Turn WPAD off

Change the login name

I found out that this is the most annoying and time consuming one. I always use DOMAIN\User when I connect to a server. But this is what happens:

Domain.Domain.TLD

Kerberos is doing a DNS query on _kerberos._tcp.dc._msdcs.domain.domain.tld and of course he will never can find that double domain A record. But if you change the logon name to domain.tld\admin or [email protected] Kerberos will find the A record and connects immediately 🙂

Top speed!

Kerberos

And even now it’s possible to tune the Kerberos authentication further and fix the last KRB5KDC_ERR_PREAUTH_REQUIRED error you can see in the screenshot. Maybe next time but for now I’m happy with the initial connection speed 🙂

Happy hack ehh… connecting!

OWASP ZAP Proxy with Android on Genymotion

It can be fun to reverse engineer some android applications. I think it’s better to do this on your workstation instead of your phone because it’s way more flexible and you don’t ruin your phone when you break things 😉

In my case, I use Debian 11. But of course, you can do this with any OS.

Requirements

  • An app you want to debug
  • OWASP ZAP Proxy
  • Genymotion
  • NPM
  • APK Export (Android App)

OWASP ZAP Proxy

I use the snap package for ZAP because it’s easy to install and you’ve always the latest version.

$ sudo snap install zaproxy --classic

Start ZAP and export the dynamic certificate (tools > options)

Dynamic SSL Certificate
  • Click on the save button an place the file somewhere on your disk.

You can check if the OWASP ZAP is running with:

$ netstat -tulpen | grep 8080
tcp6       0      0 127.0.0.1:8080          :::*                    LISTEN      1000       89190      14016/java

Genymotion

Now the proxy is in place it’s time to install genymotion for the android emulation. First install virtualbox.

Install virtualbox APT keys

$ wget -q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
$ wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add -

Edit the /etc/apt/sources file and add this line:

deb [arch=amd64] https://download.virtualbox.org/virtualbox/debian bullseye contrib

Update the repo and install virtualbox

$ sudo apt-get update
$ sudo apt-get install virtualbox-6.1
  • Now go the the genymotion website and download the latest bin file
Download Genymotion
  • Make the file executable and run the installer
$ chmod +x genymotion-3.2.1-linux_x64.bin 
$ ./genymotion-3.2.1-linux_x64.bin
  • Follow the wizards, create an genymotion account and create a new virtual device. In my example I used a google Pixel 3 with Android 10.
Overview virtual devices

Now it’s time to configure the proxy within the android device!

Configure proxy in Android

Start the created virtual genymotion android device and copy the certificate file we create earlier with a simple drag and drop.

drag & drop the certificate file
Succesfull copy
  • Now we can can configure the proxy in the wifi settings.
  • Go to settings > search for certificate and install the certificate.
settings > find >certificates
Import the certificate

Edit the wifi connection, add the proxy and restart the wifi.

  • Edit the Wifi
  • Go to the advance options
  • Set the proxy to Manual
  • The IP is always: 10.0.3.2 This is the “localhost” setting for the genymotion host server
  • Port 8080
Genymotion Proxy Settings

When you (re)connect the the wifi you have the accept the proxy error (but this is a good thing).

Sign in the the wifi
Accept the warning

Now you will see all the traffic. But only the traffic for the apps who respect the android HTTP_PROXY settings. So this is what you can do when an app don’t respect this setting:

Rebuild the APK with APK-MITM

Now everything is in place. So the last thing we need to do is rebuild the APK file so we can proxing all the network traffic. So:

  • First export the APK file trough the APK Export
  • Place the APK somewhere on your disk
  • Install npm (at least version 14)
$ curl -sL https://deb.nodesource.com/setup_14.x | sudo bash -
$ sudo apt-get install nodejs npm
  • Install java
$ sudo apt install openjdk-17-jre openjdk-17-jdk
  • And rebuild the APK
$ npx apk-mitm SomeAppName.apk
Some nice MITM patching

And here we go!

Everything is in place now. So the only thing you have to do is drag & drop the *-patched.apk file to genymotion, install this file and you are fully in control 🙂

ZAP Proxy with MITM Apk

Happy hacking!

Some useful docker commands

Attach to a container

docker exec -i -t container_name /bin/bash

List images

docker image ls

List all existing containers

docker ps -a

Delete a image

docker image rm image_name

Delete all images

docker image rm $(docker images -a -q)

Stop a container

docker stop container_name

Stop all running containers

docker stop $(sudo docker ps -a -q)

Delete a container

docker rm container_name

Delete all containers

docker rm $(docker ps -a -q)

Display logs of a container

docker logs container_name

Ubuntu cannot connect to Cisco Router

Please follow these steps if you cannot can connect to a router. For example

ssh [email protected]

Output

Unable to negotiate with blog.wapnet.nl port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

use the -o parameter

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 [email protected]

Output:

Unable to negotiate with blog.wapnet.nl port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

and add the -c parameter

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 -c aes256-cbc  [email protected]

and you are connected 🙂

The authenticity of host 'blog.wapnet.nl' can't be established.
RSA key fingerprint is SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Fix Screen Tearing in Linux

It cost me a lot of time to troubleshoot the screen tearing. So I want to share my solution for everyone with the same frustrating tearing issues. My private setup is a Lenovo Ideapad (gaming) with Nvidia and Intel (Prime) GPU. I use the laptop screen and an external 24″ HDMI display.

In Windows 10 everything goes smooth but when I switch my dual boot to Linux than the frustrations begin.

I tried a lot of different Linux distributions (Fedora, Solus, Ubuntu, Pop_OS!, Arch Linux, OpenSuse, and Zorin OS) and I try KDE Plasma, Gnome, and Budgie a lot of hacks for all these systems to get a smooth Linux GUI without screen tearing or other lag.

But I don’t like manual modifications/hacks to get the Nvidia setup smooth. Especially the proprietary Nvidia drivers can break your system easily. So this fix is easy to remember and easy to switch if you want the power saver back to full and use the Intel driver instead of the Nvidia one.

Important, choose your display!

What you have to keep in mind when you have a lot of screen tearing is to make a decision. Use your laptop display or external display. You can fix both displays but not at the same time in a smooth way. If I found a solution in the feature I will post it on my blog. But in the meanwhile, I use only one screen at the same time.

This procedure is for Ubuntu 20.04 LTS but it will work for other distributions for sure.

Install the driver

After a fresh ubuntu installation, Nvidia and HDMI do not work as they should be. So, kick off the first command and reboot.

$ sudo ubuntu-drivers autoinstall

And reboot!

Configure Nvidia driver Part I

Now configure the Nvidia/Intel prime in on-demand mode. So you can do further configuration in the nvidia-settings gui

$ sudo prime-select on-demand

  • And reboot again
  • Now start Nvidia settings and switch to NVIDIA (Performance Mode)
  • Click save and….. reboot!

Turn off one display

Go to your KDE or Gnome display settings and turn off one display. KDE saves these settings so when you plug out the HDMI cable afterward KDE will activate your laptop display. And of course, when you plug in your HDMI cable next time he will turn off your laptop display.

Configure Nvidia driver Part II

These steps are optional but needed for a better performance.

  • Start nvidia-settings > GPU 0 > PowerMixer
  • Change the Preffered Mode to “Prefer Maximum Performance”

Last but not least: Firefox hardware rendering

For some compatibility reasons, hardware rendering in Firefox is turned off by default. So you have to enable it.

  • about:config
  • Set layers.acceleration.force-enabled to true
  • Quit Firefox and restart it

Some debug information

I always use this YouTube video to check if the screen tearing is varnished completely

When you want to see if your have the right drivers loaded, use this command:

$ lspci -k | grep -EA3 'VGA|3D|Display'

And you can start an application with max video power with this command. Change gears to your own program off course. But I like gears because you can see the FPS realtime (see the screen what a differance 😉 )

$ __NV_PRIME_RENDER_OFFLOAD=1 glxgears

With nvidia-smi you can see if nvidia is running the application

Enjoy your tearing free Linux 🙂

/edit

Hahaha I saw this video today 🙂 Exactly my thoughts