Author: Tim Nott (Page 3 of 4)

Getting Started With Hyper-V

February 10, 2023 / Tim Nott

Virtual Machines are all the rage these days and there are many reasons for this. It can be a very cost effective way to run multiple ‘machines’. If you have one powerful server then you can have many VMs running at the same time, all performing different tasks. On top of that it is easy to add and remove them as you require.

VMs are easy to save (snapshot) and restore when things go wrong and also VMs can have enhanced security features such as isolation and secure boot. You can control the resource allocation with clicks of a mouse and you can run pretty much any OS you like, depending on licenses of course.

Hyper-V itself, and other hypervisors, allow for automation and simple management of your VMs with a simple GUI.

Installing a VM on Hyper-V

So let’s say that you want to try out your first VM on Windows, let’s have a look at the steps for that. (This will require administrative permissions). You will need an installer file for the OS you want to install. Linux Distros such as Ubuntu or Kali are free and easy to download.

First of all we need to enable the Hyper-V feature so go to Control Panel > Programs > Turn Windows Features on and off and you will be presented with this dialogue:

Then you check the box next to Hyper-V and press OK.

Next we can click in the search bar for windows and type in Hyper-V and should see these options:

Choose Run as administrator.

This will open the Hyper-V manager window and we can get started on creating our first VM! Click on New:

This will start the New Virtual Machine Wizard. Click Next:

Hyper-V manager New Virtual Machine Wizard

First option to choose is name and location for your VM. Here I am going to create an instance of Kali-Linux so I will call it Kali. When you get into many VMs you will want to have a regular naming convention so it’s best to start thinking about this early on. There is also the option to choose location here but to begin with I would just go with the default:

Generation. Generally speaking Generation 1 is BIOS and Generation 2 is UEFI. Unless you are using legacy OS versions go with Generation 2:

Assign memory. Depending on your host machine, VM OS and number of VMs you want to try and use at the same time you can set the allocated memory for the VM we are installing right now. You want to give a VM at least 4GB if you can. This is why VM workstations have 32 or 64 GB of RAM:

Configure Networking. Do you want your VM to talk with the network? Or just keep it isolated? Choose Default Switch for the former:

Similarly to the RAM allocation we now want to Create a VHD. Choose default location for now and decide the size you want to allocate:

Installation options. Choose how you want to install the OS. Usually best to point it at the ISO you have downloaded:

With all that done you can check the config you have asked for and click Finish:

Now we are back at the Hyper-V Manager windows and our Kali VM is present. Click on it and in the lower right hand section click on Start and then Connect:

All being well the machine will start and you will then go through the process of installing the OS as normal:

Using Hyper-V To Your Advantage

Once you have installed a virtual machine on Hyper-V and it is running well, there are several useful features that Hyper-V provides to manage and maintain the virtual machine:

Snapshots: Hyper-V allows you to take snapshots of the virtual machine’s state, including the operating system and all data and applications. Snapshots can be used to revert the virtual machine to a previous state in the event of a problem or to test changes before making them permanent.

Live Migration: With Live Migration, you can move a running virtual machine from one physical host to another without any downtime. This can be useful for maintenance tasks, such as hardware upgrades or repairs, or to load balance virtual machines across multiple hosts.

High Availability: Hyper-V provides High Availability features, such as failover clustering, to ensure that virtual machines are always available, even in the event of a host failure. This helps to minimise downtime and ensures business continuity.

Resource allocation: Hyper-V allows you to allocate resources, such as CPU, memory, and storage, to virtual machines as needed. You can also use resource controls, such as resource metering and resource allocation policies, to ensure that virtual machines have the resources they need to run effectively.

Network virtualisation: Hyper-V provides network virtualization features, such as virtual switches, that allow you to create virtual networks that are isolated from the host and from each other. This helps to secure virtual machines and to control network traffic.

Remote management: Hyper-V allows you to manage virtual machines remotely, using the Hyper-V Manager or Windows PowerShell. This makes it easier to manage virtual machines from a centralized location and to automate management tasks.

Backup and recovery: Hyper-V provides backup and recovery features, such as checkpoint-based backups and replication, to help protect virtual machines and ensure that they can be recovered in the event of a disaster.

These are just some of the useful features that Hyper-V provides for virtual machines once they are installed and running. By leveraging these features, you can manage and maintain virtual machines more effectively and ensure that they are always available and running optimally.

A first look at creating labs in Azure

Wireshark Basics

Dismantle The Whole Laptop

January 23, 2023 / Tim Nott

Replacing a single failed key on a laptop can be a hassle, especially when you have to take the whole thing apart just to get to the keyboard.

Taking It Apart

I recently had to go through this process myself, and it was not an easy task. From gathering the necessary tools to carefully disassembling the MacBook Pro and replacing the keyboard, it was a time-consuming and meticulous process. The keyboard itself has 51 miniature screws holding it in place. There are very few parts of the laptop that are not removed for this. Fortunately the screen is one of them.

The logic board was completely disconnected and removed. Obviously a good time for a clean up but I stopped short of going at it with a toothbrush and isopropyl alchohol fearing that I was more likely do more harm than good.

The keyboard is exposed — Only the keyboard seal left, however this contains more components

Once everything has been removed and there is only the keyboard seal left you have to carefully remove this without damaging it or the lightboard inside which provides the backlighting for all the keys.

Finally we reach the keyboard itself and start on the 50+ tiny screws that need to removed and not lose.

Now Put It All Back Together

With the new keyboard in place we now have the task of putting it all back together correctly. Most of it is common sense but it is strongly advised to take as many photos as you can as you disassemble. Knowing which screws go where is the main challenge. They are all fairly similar.

Replacing the keyboard connector tab was nearly impossible — Not easy!

The hardest part of the reassembly was reconnecting the keyboard itself to the logic board. It’s just a thin ribbon of a tab with very little to get hold of to push into the socket. It took many attempts and it’s easy to damage it.

The laptop is fixed. — The finished article

But it’s all worth it when the we have a fully functional laptop once again.

Azure Lab No1

Git/GitHub

Creating Sockets In Python

January 17, 2023 / Tim Nott / 0 Comments

Python is a powerful and versatile programming language that is well-suited to many different tasks, including network programming. In this post, we’ll show you how to use Python to create a socket connection between a server and a client.

Before we do anything I would like to point out that it is recommended to try this on a single machine which acts as both the server and the client. Telusko does this in his tutorial https://www.youtube.com/watch?v=u4kr7EFxAKk and it makes life much simpler as you are not having to fight firewalls and more if you try and connect to a VM in the cloud for example.

With that said, let’s take a look at the server-side code. Here is an example of a simple Python server that listens on a specific port and returns a message to any client that connects to it:

import socket

# Create a socket object
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Bind the socket to a specific address and port
s.bind(("localhost", 12345))

# Listen for incoming connections
s.listen(5)

while True:
    # Establish a connection with the client
    c, addr = s.accept()
    print("Got connection from", addr)

    # Send a message to the client
    c.send(b"Thank you for connecting")

    # Close the connection
    c.close()

In this example, we first import the socket module, which provides all the necessary functions for working with sockets in Python. Next, we create a new socket object using socket.socket() and specify the address family (AF_INET) and socket type (SOCK_STREAM). These specify IPv4 and TCP respectively. (You can in fact leave these out as they are the default settings.)

We then use the bind() method to bind the socket to a specific address and port. In this case, we’re binding to “localhost” (which refers to the local machine) and port 12345. Don’t use a port in the 1-1000 range as it will probably be busy.

Next, we use the listen() method to start listening for incoming connections. The argument to this method specifies the maximum number of queued connections.

The while loop is used to accept incoming connections, using the accept() method. This method returns a new socket object representing the connection, as well as the address of the client. We use the send() method to send a message to the client, and then close the connection using the close() method.

Now let’s take a look at the client-side code. Here is an example of a Python client that connects to the server and sends a message:

import socket

# Create a socket object
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Connect to the server
client_socket.connect(('localhost', 1234))

# Receive data from the server
data = client_socket.recv(1024)
print(f"Received data: {data}")

# Close the client socket
client_socket.close()

This client code is similar to the server code, but with some important differences. First, instead of calling bind() and listen(), we call connect() to connect to the server. We then use the send() method to send a message to the server, and the recv() method to receive data from the server. Finally, we close the connection using the close() method.

Azure Lab No 1

AbilityNet

Azure Lab No1

December 21, 2022 / Tim Nott / 0 Comments

All images courtesy of Microsoft

For my first attempt at a virtual lab to simulate an enterprise environment I was tempted to install devices listed in a reddit post that inspired me to start this project:

Virtual security appliances – firewalls etc
Virtual switches
Domain controller
DNS server
DHCP Server
SIEM
IDS
Endpoints
Active Directory
Groups

Clearly this would be trying to run before I could walk so I asked ChatGPT for a simple network to virtualise in Azure:

Sure! Here is a basic network setup that you can try to implement in Azure:

Create a virtual network (VNet) in Azure. A VNet is a logically isolated section of Azure’s cloud network where you can create and manage your Azure resources.
Create a subnet within the VNet. A subnet is a range of IP addresses within a VNet that you can use to segment your network.
Create a network security group (NSG) and associate it with the subnet. An NSG is a firewall that controls inbound and outbound traffic to and from your resources.
Create an Azure virtual machine (VM) and associate it with the subnet. An Azure VM is a virtual machine that runs in the cloud and can be used to host applications and services.
Connect the VM to the Internet by creating a public IP address and associating it with the VM. A public IP address is an IP address that can be accessed from the Internet.
Configure the NSG to allow inbound and outbound traffic to and from the VM. You can do this by creating inbound and outbound rules that specify the source and destination of the traffic and the port number.
Test the network setup by connecting to the VM using Remote Desktop Protocol (RDP) or SSH. You can use RDP to connect to a Windows VM, and you can use SSH to connect to a Linux VM.

I hope this helps! Let me know if you have any questions.

So going from this:

Project Details

Subscription = Primary_subscription
Resource group = Basic_resourcegroup
Virtual Network Name = Basic_vNW
Region = UK South

Subnet

Subnet = Basic_subnet
Starting Address = 10.0.1.0
Subnet size = /29 (8 addresses)
No Security
IP Address Space = 10.0.0.0 – 10.0.0.255 – No Gateway

Network Security Group

NSG = Basic_nsg

Virtual Machine

VM = BasicVM
Size = Standard_B2ms ($0.1 per hour)
Image = Win 10 Pro 21H2
Admin = Basic_admin
Password = *******************
Public inbound ports = RDP 3389

Connect VM to Internet

Public IP = *********

Configure NSG

Inbound rule: Allow MyIPAddress – Port 3389 – TCP – Source 51.199.159.108 – Dest Any – Allow
Inbound rule: AllowAnySSHInbound – Port 22 – TCP – Source Any – Dest Any – Allow
Outbound rule: AllowCidrBlockHTTPSOutbound – Port 443 – TCP – Source 10.0.1.0/29 – Dest Any – Allow

Testing

Testing the network by connecting via RDP does allow me to connect to the VM but I cannot ping it or connect via SSH at this time.

Conclusion

It seems that I managed to implement the virtual lab into Azure to a degree. There are still a lot of question marks about the virtual network and the network security group. The rules set in the NSG didn’t seem to have an effect on the VM so there’s work to be done there.

Git/GitHub – Basics

December 15, 2022 / Tim Nott / 0 Comments

What is git?

Open source and free Source Control Management – SCM. You can manage changes to files over time. Download for your system. Use gitbash to control. Other command line tools can be used.

Configure git

Specify name and email address – so git knows who is doing stuff

git config --global user.name “Your Name”

git config --global user.email <your email>

Specify default branch name – (this was done in the installation too)

git config –global init.default branch main

Initialise Repository

cd c:/<file location>

cd c:/users/BADASS/Onedrive/Documents/git_experiment (for example)

git init

there will now be a hidden file in the folder – .git

git Status

git status

All the files are untracked

Track a File

git add <filename>

git add word1.docx (for example)

git add –all

git add -A (another way of tracking all)

Unstage a file (stop tracking)

git rm --cached <filename>

git rm --cached word1.docx (for example)

Ignore files

create new text file called .ignore
insert files you want to ignore

Commit

Takes a snapshot of the repository

git commit -m “message”

Changes to files

If you change a file git will recognise this

git diff

To see the difference

Environments

Working Files
Staging
Commit

Add/remove modified file to ‘snapshot’

git add txt1.txt

Places this file into Staging where it will stay until we are ready to commit

git restore --staged txt1.txt

This will remove the file from Staging

Bypass Staging

git commit -a

Commits all

Restore a file

You could delete a file from the folder and then git status would show

We can then restore this file with

git restore txt1.txt

Change filename

Use mv

git mv “txt1.txt” “txt2.txt”

git Log

git log

git log --oneline

Amend Commit

git commit -m ”message” –amend

Reset to Previous Commit

git reset 1ea7a0a

Rebase

git rebase -I --root

Branches

A copy of your main branch which you can edit and then merge once you are satisfied with the changes
Used a lot in coding development

Create New Branch

git branch fixbug

creates new branch

git branch

shows branches

git switch fixbug

switches to this branch

Merge branches

git merge -m “merge fixbug with main” fixbug

Delete Branch

git branch -d fixbug

Merge Conflicts

if you change the main branch whilst the fixbug branch is also edited you encounter a conflict when you try and merge them

Set Up github Account

https://github.com/
Sign up – usual process

Create Cloud Repo

Create a new repository
Give it a name
Public/Private – depends on who you are working with
Create repository

Push Existing Repo

We already have a repository on our local computer. github gives it the commands for pushing it to the cloud.

git remote add origin https://github.com/ChronikDog/Repo_1.git

git branch -M main

git push -u origin main

go to github and see the files synced to the cloud.

Creaete A Simple ASCII Converter

Don’t Get Locked Out

Planning a Virtualisation Lab – The Infrastructure

December 13, 2022 / Tim Nott / 0 Comments

Brief

I want to gain experience of creating and managing an enterprise level IT network. So far I have studied and gained CompTIA A+, N+ and am in the process of getting my S+ but apart from managing the LAN at home I have no experience of commercial networks and IT infrastructure.

I am not interested in the cost and hassle of buying and setting up old/legacy networking equipment that has been discarded by enterprise. Surely a very inefficient way of learning in this day and age.

So the decision moving forward comes down to new modern workstation capable of virtualising an enterprise network set up or moving to a cloud environment.

Options

A virtualisation workstation for my home office and building VMs and virtual networks. Although this is appealing in that it’s always nice to buy new equipment and it’s something tangible and lasting to show for the money spent, is it really the best option?
Wouldn’t it be wiser to do all of this in the cloud? For a start it would create much less of an impact on my energy bills. On top of that it would be cheaper in the short term and most importantly it will give valuable experience in the cloud.

Cost

Virtualisation Workstation – with 150w power draw @35p per kWh

Intel Core i9 – £350
Motherboard – £175
Ram (64GB) – £185
Case – £120
PSU (650W) – £120
SSD (M.2 2TB) – £220
Liquid cooler – £120
Windows 11 – £120
Total – £1410

Cloud – usage per day – 1p per VM per hr. Enterprise set up ~ 7p per hr. Maybe 50p per day, £2.50 a week, £10 per month. £120 per year. (This is a very generous provision of cloud compute. An instance on Linode can be $0.05 per hour.)

Thin Client – £300 A new thin client would make sense in that it would be far more energy efficient and it would run Windows 11. (This option can be taken up at any time).
Power draw from a device like this is a fraction of a workstation. This is very hard to assess accurately but an Intel i9 will be using around 250W when it’s operating 5 or more VMs. A thin client could be using 20 to 30W as it’s only controlling and monitoring the cloud VMs. At 5 hours a day and 5 days a week that compares as 37.5 kWh to 187.5 kWh for the whole year.
At current UK prices that is £13 compared with £100.

So roughly speaking you are looking at 10 years of VM usage compared with buying a workstation.

Pros and Cons

Physical		Virtual
Pros	Cons	Pros	Cons
Will last for a long time	High initial cost	Experience in Cloud	Nothing to show for it at the end of the day
Nice thing to have	High energy usage	Much cheaper in the long run	No modern PC for everyday usage
Modern PC for all work	Noisy?	Can be accessed anywhere/device	Overspend possible
Experience in building	Impact on environment	On demand, elastic.	Supporting huge corporation. (Linode?)
Experience in using	Stuck with config once bought	Low impact on environment	Requires decent connection
		Clearly the way of the future	Not as direct and ‘snappy’ as physical system
		Will ‘last’ forever	Cost of modern thin client

Conclusion

While both options are appealing the deciding factors in favour of the cloud are manifold:

Cheaper
Far more flexible
Experience in the future of IT
The workstation option can always be taken up if the cloud isn’t working out

Expanding on the last point – I will be needing a modern Windows 11 machine in my office at some point and knowledge and experience gained from the cloud will point me in the right direction for what sort of machine that needs to be.

Website Under Attack

Intel i350 T4

AbilityNet

October 14, 2022 / Tim Nott / 0 Comments

I am now a volunteer in my local area for AbilityNet. We help elderly and disabled people with their IT issues. From the website:

“A digital world accessible to all

AbilityNet is a pioneering UK charity with a global perspective. We believe the power of digital technology should be available to everyone, regardless of ability or age. Our free online resources and a network of over 300 community-based volunteers help individuals with any disability, of any age, to use all kinds of digital technology.

Our teams of experts help organisations of all types and sizes to become more inclusive and to build accessible digital products and services. We are founder members of the global accessibility profession, work closely with some of the biggest businesses on the planet and organise TechShare Pro, Europe’s largest accessibility gathering.”

Issues we face range from helping someone with their first online grocery shop to more technical fault fixing done remotely via TeamViewer.

For my part, it is all experience and actually, you get a good feeling from helping someone in need.

CompTIA Troubleshoot Model

August 14, 2022 / Tim Nott / 0 Comments

Using the CompTIA troubleshooting model to fix a simple problem.

Troubleshoot – Kali Install on Macbook unable to use Wireless Adapter.

1. Identify the problem

After installing Kali Linux on my old (2011) Macbook Pro laptop everything seems to be working good except there is no option to enable WiFi.
lspci command shows that there is an entry for Network Controller:
- Broadcom Inc. BCM4331 802.11a/b/g/n
The Network Settings feature does allow setting for a wireless connection to be set up but so far this has had no effect on creating an actual Wireless connection.

2. Establish a theory of probably cause

The install of Kali somehow didn’t include the necessary software/drivers to operate the adapter.
Kali linux isn’t compatible with the adapter.
The manual set up of a wireless connection in Kali has not been done correctly.
In the Network Connections edit dialogue box the options available for Band are a, b and g. There is no option for n or ac. The router that we are trying to connect to is transmitting on b, g, and n however.
Disable DHCP and setting a manual IP address has no effect.

3. Test theory

Find and install driver for the adapter
- Some googling found: sudo apt install firmware-b43-installer
- This worked. After a restart the laptop connected to the Cisco48530 AP.

4. Establish a plan to resolve the problem

Use – sudo apt install firmware-b43-installer
Restart the laptop

5. Implement this solution

6. Verify full system functionality

Setting this command produced a flurry of activity in the command window.
Finishing with no errors or fail notices
After restarting the computer the WiFi was fully functional.

7. Document

So this was a simple driver missing or update that was required after the installation of Kali.
Presumably because I was installing Kali into a 11 year old machine and a Mac as well the wireless adapter was not in the list of drivers included in the Kali installation.
A simple install of the correct driver fixed the problem.

Rooting Android

Understanding NAT

CompTIA. ITProTV vs Professor Messer

August 10, 2022 / Tim Nott / 0 Comments

Currently I am approaching the time to book a CompTIA Network+ N10-008 exam. Having previously completed ITF and A+ using the video courses from ITProTV. I was using other sources to supplement my learning , such as Mike Meyers A+ Complete Guide, but ITProTV was my main source.

However after completing a few practice exams for the Network+ certificate I wasn’t getting good scores. So I started looking around for more insight in how to study. I found Professor Messer and quickly realised that his approach is very much based on the CompTIA Objectives, something that I had admittedly paid little attention to up to this point.

So after downloading Messer’s notes and comparing them to the objectives I saw that they correlated directly. Section 2.3 related exactly to section 2.3 in the objectives for example

ITProTV don’t do this. Consequently it’s harder to know if you have learned everything that they might ask you in the exam. I would say however that ITProTV will give you useful insights into the IT industry and how it works. It’s a more encompassing approach. Messer delivers the exact material that you need to learn to pass the exam.

Yes, you always need to have more than one source of tutoring when studying for an exam, something which ITProTV point out at the start of their courses, but if you haven’t already I would recommend looking in to Professor Messer. His videos are free and the extensive and well laid out notes are $25. He also does live study groups on his YouTube channel.

Most importantly – get and read the CompTIA Objectives as soon as you can when studying a new course.

Wireshark – MasterClass

July 21, 2022 / Tim Nott / 0 Comments

Taken from Chris Greer https://www.youtube.com/c/ChrisGreer

This is a simple posting of the notes I took from going through Chris Greer’s Wireshark beginners series. IF you haven’t already go to his channel and learn about Wireshark.

Screen layout

Preferences > Layout

Change from packet bytes to header values

Layout > Panes

Add button

Right click packet > Prepare as filter > Selected > Add Button (top right)

Colour rules

View > Colouring Rules

Custom column

Preferences > Appearance > Columns > Add

Simple display filters

tcp.flags.syn==1

How to Capture Network Traffic

To see which library WS is using to capture the packets

File > About Wireshark

To edit capture options

Snaplength

Can be set to reduce the amount of data captured in each frame
Often 64B is enough to get the header information etc

Output

Command Line

Add program path ???

The Difference between Capture Filter and Display filter

Capture Filter
- We determine the packets captured as we capture them
- simpler than display filters
- beware over doing the capture filer and then missing the packet you need to analyse
Display Filter
- filtering packets we have already captured

Right click on a packet to select filter or Conversation filter

Then you can use brackets to add an extra filter

Not filter

not arp
not (arp or ipv6 or ssdp)
useful to slowly home in on the filter you need or the packets you need.

In parameter

tcp.port in {80 443 8080}

Clear text strings

frame contains google (case sensitive)
frame matches Google (case insensitive)

Name Resolution

You can also hover over a frame and right click and choose Edit Resolved Name. Then you can name ‘gateway’ or ‘client’ etc

Time Column

You can set the time column to various options
You can right click on a frame and choose Set/Unset Time reference to reset the time to 0.00 on that frame

This is useful as it shows the time relevant to the conversation. Not just the frame above which could be from many other conversations. Set it as a column.
Then you can sort the column and look for the responses that were particularly slow.
The ones coming from the server are often pertinent.

Statistics

Don’t look at each individual packet. Use statistics!!
Statistics > Conversations

How to Extract Files from a pcap?

Frame 14 contains a .png file and this is what we want to extract.
Firstly Right-Click on TCP layer and go to
- Protocol Preferences
- Allow subdissector to reassemble TCP streams
Reassembles the TCP stream. Otherwise it treats them one packet at a time..
Then go to File > Export Objects and we can see that there are 5 types of Objects that WS can export by default

So this is how we can extract files from the pcap
Executables, binaries
Be careful with malware that you don’t execute it!
If this export feature does not work, we can look at
- Right-Click on the frame
- Choose Follow TCP steam
- Here we can see the data that comprises the file

Map IP Address Locations with Wireshark Using GeoIP

First, we need to download and extract the databases from MaxMind.

Now all we have to do is point WS at these databases

With this set we can look at the IP layer of a packet and view the GeoIP which will include the City, Country and even map coordinates

Now go to Statistics > Endpoints > Map > View In Browser

Azure Lab No 1

PicoCTF – Static Ain’t Always Noise

Author: Tim Nott (Page 3 of 4)

Getting Started With Hyper-V

Installing a VM on Hyper-V

Using Hyper-V To Your Advantage

Dismantle The Whole Laptop

Taking It Apart

Now Put It All Back Together

Creating Sockets In Python

Azure Lab No1

Git/GitHub – Basics

Planning a Virtualisation Lab – The Infrastructure

AbilityNet

“A digital world accessible to all

CompTIA Troubleshoot Model

1. Identify the problem

2. Establish a theory of probably cause

3. Test theory

4. Establish a plan to resolve the problem

5. Implement this solution

6. Verify full system functionality

7. Document

CompTIA. ITProTV vs Professor Messer

Wireshark – MasterClass

Recent Posts

Recent Comments

Archives

Categories