Friday, September 25, 2020

Eve-ng systemd-udevd: Could not generate persistent MAC address


In:

 /lib/systemd/network/99-default.link


Change:

MACAddressPolicy=persistent

To:

MACAddressPolicy=none

Wednesday, May 23, 2018

pfSense: Enabling or disabling firewall rules from a script.

Thought I'd post a quick and dirty script I put together to allow me to enable/disable firewall groups from any network connected device, including my phone.


Sunday, January 17, 2016

Ninja Hackjob router killer

Are you tired of fighting with people putting home routers on your network to create hotspots?

Is it messing with your existing infrastructure?

Do you have zero budget?

You need...

The Ninja HackJob Router Killer.




So, the plan is simple, pass traffic through a box and decrement TTLs to one.  A router or "misconfigured" Macbook will decrement the TTLs as they pass through and the packets will be discarded by the client.  It's enough to discourage 99% of the population.

So, the build of materials is simple:  One PC with two NICS, and a Linux distro.  This was done on RHEL6.

Step 1.  Make the system actually forward traffic.
In /etc/sysctl.conf, find the following lines:
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0
net.ipv4.ip_forward=0
Set all values to 1

Step 2.  Make a startup script containing the following:

#!/bin/sh

brctl addbr br0
brctl addif br0 eth0
brctl addif br1 eth1

ifconfig eth1 0.0.0.0
ifconfig eth0 0.0.0.0

ifconfig eth1 up
ifconfig eth0 up
ifconfig br0 up

iptables -F FORWARD
iptables -t mangle -A FORWARD -m physdev --physdev-in eth0 -j TTL --ttl-set 1

The last line is the killer.  Take all packets coming in from eth0, mangle the TTL down to 1 then forward them.

All packets passing through the box towards eth1 should get TTL decrement to 1.  My tests were also successful with VLAN tagged packets.

Friday, January 2, 2015

How to make a Cisco 7940 register with Sipsorcery.com

The goal was simple.  Get a Cisco phone talking to Google Voice via Sipsorcery.com  It can be done, but it's not easy.  I would advise the squeamish amongst us to just drop the $70 and get an off-the-shelf SIP phone.  For this post, the scope will be getting the phone registered to Sipsorcery.com.

First, acquire the phone.  They're about $20 on ebay.  

Initially, I tried this with a 7911, but gave up after reading that they are incapable of authenticating with a SIP proxy.  My own efforts reflected similar issues.  

That said, strap in.

The targeted phone should resemble something like this.  


First issue is power.  Here, we have options.

1.  Already own a Cisco POE switch.
2.  Purchase a 48v power compatible supply and plug directly into the phone.
3.  Use a power injector to inject 48v POE to multiple devices.

I used the latter, it looks something like this:



For most devices, your power woes end here.  However, these old 7940s were built before the 802.3af standard was established.  But, we're not cooked.  They can still take the POE, we just have to present it to them differently.  We'll need a patch cable with the following pinouts:





I'll admit I did not perform my due diligence to find out why this worked, but I can confirm that it worked for me.  

At this point, you need to find the SIP firmware for your phone.  I can't help you except to advise that you practice your Google-fu.  There are enough resources on how to do a factory reset.  I won't cover that here.  


With the power issues solved, we can move on to the next step, the TFTP server.  Unless you need a TFTP server daily, I'd just suggest getting TFTP64

Modify your DHCP server to point option 150 at your TFTP server's IP, power on your phone and wait.


If everything's configured correctly, we'll see this in the logs.  We're worried about 2 files here:  SIP0034EBC7634D.cnf and SIPDefault.cnf.  Your phone will be looking for SIP<macofthephone>.cnf  My working files look like this:


SIP<mac>.cnf


# phone-specific configuration file sample
line1_name : "$authname"
line1_authname : "$authname"
line1_password : "$authpassword"
line1_shortname : "Sipsorcery"
line1_displayname : "sipsorcery"
proxy1_address: "sipsorcery.com" ; Can be dotted IP or FQDN
proxy1_port: 5060

line2_name : asterisk
line2_shortname : "Asterisk"
line2_displayname : "Asterisk"
proxy2_address: "192.168.10.7" ; Can be dotted IP or FQDN
proxy2_port: 5060

####### New Parameters added in Release 2.0 #######
# Phone Label (Text desired to be displayed in upper right corner)
phone_label: "VoIP/Sorcery " ; Has no effect on SIP messaging
# Line 1 Display Name (Display name to use for SIP messaging)
line1_displayname: "Sipsorcery"
line2_displayname: "Unused"


####### New Parameters added in Release 3.0 ######
# Phone Prompt (The prompt that will be displayed on console and telnet)
phone_prompt: "SIP_7940: " ; Limited to 15 characters (Default - SIP Phone)

# Phone Password (Password to be used for console or telnet login)
phone_password: "cisco" ; Limited to 31 characters (Default - cisco)

# User classifcation used when Registering [ none(default), phone, ip ]
user_info: none

SIPDefault.cnf
 
# sip default configuration file
# Image Version for upgrade
image_version: P0S3-8-12-00 
;image_version: P0S3-08-6-00 ;
;image_version: P0S3-07-5-00 ;
# Proxy server address
# Proxy Registration (0-disable (default), 1-enable)
proxy_register: 1

proxy1_address: "sipsorcery.com" ; Can be dotted IP or FQDN
proxy2_address: "192.168.10.7" ; Can be dotted IP or FQDN


# Phone Registration Expiration [1-3932100 sec] (Default - 3600)
timer_register_expires: 600
# Codec for media stream (g711ulaw (default), g711alaw, g729a)
preferred_codec: g711ulaw
# TOS bits in media stream [0-5] (Default - 5) ?changed to dscp
# tos_media: 5
dscpForAudio: 184
# Inband DTMF Settings (0-disable, 1-enable (default))
dtmf_inband: 1
# Out of band DTMF Settings (none-disable, avt-avt enable (default), avt_always - always avt )
dtmf_outofband: avt
# DTMF dB Level Settings (1-6dB down, 2-3db down, 3-nominal (default), 4-3db up, 5-6dB up)
dtmf_db_level: 3
# SIP Timers
timer_t1: 500 ; Default 500 msec
timer_t2: 4000 ; Default 4 sec
sip_retx: 10 ; Default 10
sip_invite_retx: 6 ; Default 6
timer_invite_expires: 180 ; Default 180 sec
# Dialplan template (.xml format file relative to the TFTP root directory)
dial_template: dialplan
# TFTP Phone Specific Configuration File Directory
tftp_cfg_dir: "" ; Example: ./sip_phone/
# Time Server (There are multiple values and configurations refer to Admin Guide for Specifics)
# sntp_server: "194.81.227.227" ; SNTP Server IP Address (this is ntp1.ja.net)
sntp_server: "17.254.0.49" ; SNTP Server IP Address (this is ntp2.usno.navy.mil)
sntp_mode: directedbroadcast ; unicast, multicast, anycast, or directedbroadcast (default)
time_zone: EST ; Time Zone Phone is in
dst_offset: 1 ; Offset from Phone's time when DST is in effect
dst_start_month: "March" ; Month in which DST starts
dst_start_day: 0 ; Day of month in which DST starts
dst_start_day_of_week: "Sun" ; Day of week in which DST starts
dst_start_week_of_month: 2 ; Week of month in which DST starts
dst_start_time: 02 ; Time of day in which DST starts
dst_stop_month: "Nov" ; Month in which DST stops
dst_stop_day: 0 ; Day of month in which DST stops
dst_stop_day_of_week: "Sun" ; Day of week in which DST stops
dst_stop_week_of_month: 1 ; Week of month in which DST stops 8=last week of month
dst_stop_time: 2 ; Time of day in which DST stops
dst_auto_adjust: 1 ; Enable(1-Default)/Disable(0) DST automatic adjustment
time_format_24hr: 0 ; Enable(1 - 24Hr Default)/Disable(0 - 12Hr)
dnd_control: 0 ; Default 0 (Do Not Disturb feature is off)
callerid_blocking: 0 ; Default 0 (Disable sending all calls as anonymous)
anonymous_call_block: 0 ; Default 0 (Disable blocking of anonymous calls)
dtmf_avt_payload: 101 ; Default 101
# Sync value of the phone used for remote reset
sync: 1 ; Default 1
proxy_backup: "" ; Dotted IP of Backup Proxy
proxy_backup_port: 5060 ; Backup Proxy port (default is 5060)
proxy_emergency: "" ; Dotted IP of Emergency Proxy
proxy_emergency_port: 5060 ; Emergency Proxy port (default is 5060)
# Configurable VAD option
enable_vad: 0 ; VAD setting 0-disable (Default), 1-enable
nat_enable: 1 ; 0-Disabled (default), 1-Enabled
nat_address: "$my.no-ip.org.address" ; WAN IP address of NAT box (dotted IP or DNS A record only)
voip_control_port: 5060 ; UDP port used for SIP messages (default - 5060)
start_media_port: 16384 ; Start RTP range for media (default - 16384)
end_media_port: 32766 ; End RTP range for media (default - 32766)
nat_received_processing: 1 ; 0-Disabled (default), 1-Enabled
# outbound_proxy: "206.165.50.116" ; restricted to dotted IP or DNS A record only (this is fwdnat.pulver.com)
outbound_proxy_port: 5060 ; default is 5060
# Allow for the bridge on a 3way call to join remaining parties upon hangup
cnf_join_enable : 1 ; 0-Disabled, 1-Enabled (default)
# Allow Transfer to be completed while target phone is still ringing
semi_attended_transfer: 1 ; 0-Disabled, 1-Enabled (default)
# Telnet Level (enable or disable the ability to telnet into the phone)
telnet_level: 2 ; 0-Disabled (default), 1-Enabled, 2-Privileged
# XML URLs
services_url: "http://phone-xml.berbee.com/menu.xml" ; URL for external Phone Services
# services_url: "http://www.ip-phone-services.com/bt/" ;bt services
# services_url: "http://your.site/services.xml" ; URL for external Phone Services
# services_url: "http://193.113.58.136/bt/" ;bt services

directory_url: "http://your.site/directory.xml" ; URL for external Directory location
logo_url: "http://hostsvg.com/logo.bmp" ; URL for branding logo to be used on phone display
# logo_url: "http://kermit/asterisk-tux.bmp"
# HTTP Proxy Support
http_proxy_addr: "" ; Address of HTTP Proxy server
http_proxy_port: 80 ; Port of HTTP Proxy Server (80-default)
# Dynamic DNS/TFTP Support
dyn_dns_addr_1: "" ; restricted to dotted IP
dyn_dns_addr_2: "" ; restricted to dotted IP
dyn_tftp_addr: "" ; restricted to dotted IP
# Remote Party ID
remote_party_id: 1 ; 0-Disabled (default), 1-Enabled
# Call Hold Ringback (0-disabled, 1-enabled, 2-disabled no user control, 3-enabled no user control)
call_hold_ringback: 1 ; Default 0 (Disable ringback of held call)

 Before copying and pasting that, make note of the nat traversal IP.  I don't know if it matters, but there is definitely an invalid value in there currently.  

Ignore anything about Line 2 and do a search through the files for variables marked with $.  Replace with your values.

This should be enough to get your phone talking to SipSorcery.com. 

Monday, September 2, 2013

How to do a Steam "offline" install.

I've seen lots of questions on the internet on how to do this, since the Steam bootstrapper can be a nightmare on slow or inconsistent connections.  So, you'd really just like to get the install files for the Steam client and download them through a download manager.  This is possible.

In addition to Steam, you'll need Wireshark.

I'm going to be doing this on OSX with a Steam client update, but the methodology is the same for Windows with one minor change, which we'll get into later.

First, get Wireshark.  www.wireshark.org

Step two, load wireshark.  Select your interface.  On OSX, my ethernet is en0 and my wireless is en1.  On Windows, it's more verbose and looks like this:

You may have to run Wireshark as root or admin, depending on your OS.  This is normal. 

Then click Capture -> Start.



Wireshark should begin populating with packets even if you're not really doing anything.  This is normal.  

Now, we need to filter for exactly the packets we're looking for.  In the filter field, we're going to put in http.request.method == "GET"  That should filter out most of the packets.  

Now, with that open and running, launch Steam.  The screen will begin to populate.  


See those entries for public_all.zip and bins_osx.zip?  That's what we're after. 

What steam is doing here is literally just using http to download .zip files from their servers.  It's exactly the same thing your web browser does.  

Click on one and examine the hypertext part of it.  That's a regular URL to the file we need.  Do this for every packet that is a GET request for a .zip file.




If you click on the URL, it should begin downloading in a web browser.  Use your favorite download manager to stop, resume and recover.  

When the files are completed, for OSX you simply copy them into /Applications/Steam.app/Contents/MacOS/package/

For Windows, you copy them into c:\Program Files (x86)\Steam\package (or your respective package directory under your Steam folder). 

On launch, Steam should check for, then install the new files silently and your Steam client will be updated or installed.