Introduction
All security guides recommend you shoshould have a security audit toolkit (or forensic toolkit or recovery toolkit ). this toolkit is constituted by a set of static-linked binaries (grep, w, netstat, ls, nc, strace, ps... Etc). The problem it that these security guides tell you to build this toolkit but never show you how to do it (they just tell it can be really difficult ...). In this article I will explain why we need this toolkit then I will show how to build it.
Note:The "build the toolkit" part of this article uses
Apt-getPackage installer (for Debian-like distribs). I tested this code with success on Ubuntu, and with Debian (however some package are different and the described method may not always work ).
Why a recovery toolkit?
If an attacker had gain a superuser access into your system, he cocould have install a malware iike a trojan or a rootkit. Therefore you cannot trust anything on your system.SuOrLoginBinaries cocould have been replaced by his own tool to grab your passwords. Other trojan can directly attack shared library meaning that even newly compiled code may be dangerous.
The other use of this toolkit is to "repair after an accident". A single wrong command is enough to damage important binaries or shared libraries (for exampleRm-rOn the wrong folder ...).
This toolkit must be mounted on a read-only file-system and cocould be used by rootkit hunting tools suchChkrootkit.
It is also important to notice this toolkit is constituted of statically linked binaries. We cannot rely on the system shared libraries if the system is already upted.
Build the toolkit.
Note:The total size of the binaries + sources is about 500 Mo. The binaries size alone is less then 50 Mo.
Prerequisite:Create a folder where you will install your toolkit.
mkdir -p audit/src
mkdir -p audit/bin
You need to install the dpkg dev package.
apt-get install dpkg-dev
The core binaries:
- Apt-get source coreutils audit/src
- Cd audit/src/coreutils-x.x # replace x by the package version
- ./Configure
- Make CC = "gcc-static-std = gnu99 ″
- Cp src/cat "../bin"
- Cp src/chmod "../bin"
- Cp src/chown "../bin"
- Cp src/cp "../bin"
- Cp src/cut "../bin"
- Cp src/dd "../bin"
- Cp src/df "../bin"
- Cp src/du "../bin"
- Cp src/echo "../bin"
- Cp src/head "../bin"
- Cp src/id "../bin"
- Cp src/ln "../bin"
- Cp src/ls "../bin"
- Cp src/md5sum "../bin"
- Cp src/mkdir "../bin"
- Cp src/mknod "../bin"
- Cp src/mv "../bin"
- Cp src/pwd "../bin"
- Cp src/readlink "../bin"
- Cp src/rm "../bin"
- Cp src/stat "../bin"
- Cp src/sha512sum "../bin"
- Cp src/su "../bin"
- Cp src/tail "../bin"
- Cp src/touch "../bin"
- Cp src/uname "../bin"
- Cp src/wc "../bin"
- Cp src/who "../bin"
- # These are essenessenbut there are more in the src folder
The proc binaries:
- Apt-get install libncurses-dev # required to build top
- Apt-get source procps audit/src
- Cd audit/src/procps-xxx # replace xxxx by the package version
- Make SHARED = 0 CC = 'gcc-static'
- Cp "free" "../bin"
- Cp "kill" "../bin"
- Cp "ps/ps" "../bin"
- Cp "top" "../bin"
- Cp "uptime" "../bin"
- Cp "vmstat" "../bin"
- Cp "w" "../bin"
The net-tools binaries:
- Apt-get source net-tools audit/src
- Cd audit/src/net-tools-xxx # replace xxxx by the package version
- Sed-I's @ default: @ & \ n break; @ 'lib/inet_sr.c
- Make config # Keep default config by answering [enter] to all prompts
- Sed-I's | # define HAVE_AFX25 1 | # define HAVE_HWX25 0 | 'config. h # you probably do not need X.25 protocol support
- Sed-I's | # define HAVE_HWX25 1 | # define HAVE_HWX25 0 | 'config. h
- # We needed to change to 0 values for HAVE_AFX25 and HAVE_HWX25 so it will compile on ubuntu
- # To avoid x25_sr.c: 80: error: 'x25 _ address 'undeclared (first use in this function)
- # If someone has found a better way do not hesitate to comment this article!
- Make CC = "gcc-static" ifconfig netstat arp route
- Cp "arp" "THYLACINE_OUTPUT_PATH/../bin "#
- Cp "ifconfig" "../bin"
- Cp "netstat" "../bin"
- Cp "route" "../bin"
The gawk binaries:
- Apt-get source gawk audit/src
- Cd audit/src/gawk-xxx # replace xxxx by the package version
- LDFLAGS = "-static" sh./configure # Static compiling is not always easy...
- Make LDFLAGS = "-static"
- Cp "gawk" "../bin"
- Ln-s "../bin/gawk" "../bin/awk"
The grep binaries:
- Apt-get source grep audit/src
- Cd audit/src/grep-xxx # replace xxxx by the package version
- ./Configure
- Make CC = "gcc-static"
- Cp "src/grep" "../bin"
- Cp "src/egrep" "../bin"
The lsof binary:
- Apt-get source lsof audit/src
- Cd audit/src/lsof-xxx # replace xxxx by the package version
- ./Configure-n linux
- Make CC = "gcc-static"
- Cp "lsof" "../bin"
The strace binary:
- Apt-get source strace audit/src
- Cd audit/src/strace-xxx # replace xxxx by the package version
- ./Configure
- Make CC = "gcc-static"
- Cp "strace" "../bin"
The sed binarie:
- Apt-get source sed audit/src
- Cd audit/src/sed-xxx # replace xxxx by the package version
- ./Configure
- Make CC = "gcc-static"
- Cp "sed/sed" "../bin"
The netcat binary:
- Apt-get source netcat audit/src
- Cd audit/src/netcat-xxx # replace xxxx by the package version
- Sed-I 1i "# include \" resolv. h \ "" netcat. c # Why is it always so difficult to compile source code...
- Make linux
- Cp "nc" "../bin"
The binutils binaries:
- Apt-get source binutils audit/src
- Cd audit/src/binutils-xxx # replace xxxx by the package version
- ./Configure
- Make LDFLAGS = "-all-static" &> make. log # CC = "gcc-static" does not work here
- Cp "binutils/strings" "../bin"
- # More binaries in there, pick the ones you want
The findutils binaries:
- Apt-get source findutils audit/src
- Cd audit/src/findutils-xxx # replace xxxx by the package version
- ./Configure
- Make CC = "gcc-static"
- Cp "find/find" "../bin"
- Cp "locate/locate" "../bin"
- Cp "xargs/xargs" "../bin"
Finally
We finished building our toolkit. Remember you shoshould keep this toolkit (at least the bin folder) on a separate read-only file-system (like a CD ).
You may want to verify that your binaries are really static. UseLddCommand for that.
ldd audit/bin/*
Shocould echo that all tools aren't dynamic binaries
