Blundering on the CLI

August 25, 2010

Much to my own amusement, I’m still crashing around Linux like the proverbial bull in a china shop.

One of the odd things about working in an OS that you hardly ever use is there’s no “where is everything and how do I use it” button. Google brings up fifty ways to do the same thing, yet the syntax doesn’t quite work. I’m pretty sure most of the learned *Nix folks would be shaking their heads at the blundering of a Windows Admin in their home turf.

Thank goodness for the “revert to snapshot” button on in VMware workstation for when I download every piece of software for no real reason and stuff up a perfectly working environment.

Let me give you an example.

One of the objectives in the GSE is a simple netcat relay followed by lots of weird and twisted relays, then shove shell back to you with the lovely # prompt.

Normally this is easy, jump on to the final box type in nc –l –p 80 –e /bin/sh. Not on Fedora, which doen’t like the -l and –p being run together. So nc –l 80 –e /bin/sh then?

No – Fedora’s default installed out of the box netcat stops the evil shenanigans of the –e excution command. Oops, so you have to go and get then install another version of netcat, such as the original written by the Hobbit (make netcat, as along as long as there’s a complier on the box) which is on all Ed Skoudis’ SANS course materials or pulled download socat or one its friends.

Then using –e to shove a shell works tricks works fine.

Okay, so different OS have different versions of applications, but surely we could keep command syntax similar? Apparently not.

I decided to reach out for a bit of help and guidance, in the form of what books to read. The two I settled on were both recommendations by people in the know:

A Practical Guide to Fedora and Red Hat Enterprise Linux – Fifth Edition by Mark G. Sobell.

It’s all about Fedora 12, which is the subject of the current GSE Linux tests. Very solid and clear layout, comprehensively covering the features of Fedora and its syntax proving excellent examples

Unix and Linux System Administration Handbook – Forth Edition by Evi Nemeth, Garth Snyder, Trent Hein and Ben Whaley.

This one was recommended by Hal_Pomeranz, who wrote the SANS Linux 506 track, after I hassled him on twitter. This one goes covers many flavours of Linux and Unix, but it’s a marvelous journey through a SysAdmin approach to using *nix, making it a surprisingly easy read.

I don’t expect either book will make me a super admin over the next few weeks, but they go a great way to make me feel somewhat more at home and relaxed in Linux, rather than feeling like I just broken in to someone’s place and set fire to it.

 

  • 6

    31 days to the GSE Exam

    August 18, 2010

    31 days to the GSE Exam and counting down. The 18th of September is D-Day and I have to make it through to some point in the evening of the 19th, surviving what ever the fiendish SANS team have to throw at me at Caesars Palace in Las Vegas. I still have a giant pile [...]

  • 2

    “Don’t need AV, we have a firewall”

    July 12, 2010

    A friend stopped by to ask if security suite x was any good or not. This led onto a conversation about a place she was working that wasn’t running any AV on windows machines. The rational behind this came from a 3rd party IT support guy  who said “you don’t need AV on the Windows [...]

  • 0

    Netsh commands

    July 11, 2010

      This is nothing new or exciting, I just keep forget the syntax so I’m leaving here to make it much easier to find/remember. Interface Configuration Interface named Local Area Connection with the static IP address 192.168.66.100, the subnet mask of 255.255.255.0, and a default gateway of 192.168.66.1: netsh interface ip set address name=”Local Area [...]

  • 2

    Regaining reputation after defacement

    June 23, 2010

    After the defacement and clean up, I was going about my normal business when a couple of friends noted that select pieces of reputation software are highlighting the site as either a phishing site or malicious content. This means folks would be blocked or have WARNING EVIL signs as they attempted to connect to this [...]