Wolf's questions

It works with ubuntu image

wolf@linux:~$ docker run -it ubuntu /bin/bash
root@00e6296d31d8:/# 

However, when I try it with different image such as vulnerables/web-dvwa, it doesn't work anymore

wolf@linux:~$ docker run -it vulnerables/web-dvwa /bin/bash
[+] Starting mysql...
[ ok ] Starting MariaDB database server: mysqld.
[+] Starting apache
[....] Starting Apache httpd web server: apache2AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.2. Set the 'ServerName' directive globally to suppress this message
. ok 
==> /var/log/apache2/access.log <==

==> /var/log/apache2/error.log <==
[Sat Apr 03 11:54:24.321232 2021] [mpm_prefork:notice] [pid 307] AH00163: Apache/2.4.25 (Debian) configured -- resuming normal operations
[Sat Apr 03 11:54:24.321280 2021] [core:notice] [pid 307] AH00094: Command line: '/usr/sbin/apache2'

==> /var/log/apache2/other_vhosts_access.log <==

id
whoami

There is no bash shell in this container

wolf@linux:~$ docker ps
CONTAINER ID   IMAGE                  COMMAND                CREATED          STATUS          PORTS     NAMES
820d3a292b2c   vulnerables/web-dvwa   "/main.sh /bin/bash"   11 seconds ago   Up 11 seconds   80/tcp    upbeat_visvesvaraya
wolf@linux:~$ 

This is the command I use in host OS, unfortunately guest OS still can't get the DHCP ip.

Both OS are running in Linux.

wolf@linux:~$ vboxmanage dhcpserver add --network=malfoy --server-ip=10.38.1.1 --lower-ip=10.38.1.110 --upper-ip=10.38.1.120 --netmask=255.255.255.0 --enable
wolf@linux:~$ 

Verification

wolf@linux:~$ vboxmanage list dhcpservers
NetworkName:    malfoy
Dhcpd IP:       10.38.1.1
LowerIPAddress: 10.38.1.110
UpperIPAddress: 10.38.1.120
NetworkMask:    255.255.255.0
Enabled:        Yes
Global Configuration:
    minLeaseTime:     default
    defaultLeaseTime: default
    maxLeaseTime:     default
    Forced options:   None
    Suppressed opts.: None
        1/legacy: 255.255.255.0
Groups:               None
Individual Configs:   None
wolf@linux:~$ 

Guest OS

guestOS$ ip a s enp0s3
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:aa:aa:aa brd ff:ff:ff:ff:ff:ff
guestOS$ 

guestOS$ sudo dhclient enp0s3 -v
Internet Systems Consortium DHCP Client 4.4.1
Copyright 2004-2018 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on LPF/enp0s3/08:00:27:aa:aa:aa
Sending on   LPF/enp0s3/08:00:27:aa:aa:aa
Sending on   Socket/fallback
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 3 (xid=0xc1337)
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 7 (xid=0xc1337)
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 10 (xid=0xc1337)
...
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 8 (xid=0xc1337)
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 11 (xid=0xc1337)
DHCPDISCOVER on enp0s3 to 255.255.255.255 port 67 interval 14 (xid=0xc1337)
No DHCPOFFERS received.
No working leases in persistent database - sleeping.
guestOS$ 

Reference:

https://progmar.net.pl/en/knowledge-base/virtualbox-adding-dhcp-server

https://www.youtube.com/watch?v=mvsiuLzpx2E

How do I troubleshoot this issue?

I've just installed pfSense and noticed that it only log "blocked" traffic.

*Image taken from https://docs.netgate.com/pfsense/en/latest/monitoring/logs/firewall.html

How do I enable "allowed/permitted" traffic as well?

I've just installed docker on Ubuntu 20.04 and noticed that docker must be run as sudo.

wolf@linux:~$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json: dial unix /var/run/docker.sock: connect: permission denied
wolf@linux:~$ 

wolf@linux:~$ sudo docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
wolf@linux:~$ 

Found this tutorial and tried to follow it

Step 2 — Executing the Docker Command Without Sudo (Optional)

https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-20-04

wolf@linux:~$ sudo usermod -aG docker ${USER}
wolf@linux:~$ su - ${USER}
Password: 
wolf@linux:~$

It seems to be fine here.

wolf@linux:~$ id -nG
wolf docker
wolf@linux:~$ 

wolf@linux:~$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
wolf@linux:~$ 

However, when I open another terminal, it doesn't work anymore. I'm getting similar error as above.

I've just got started with Docker and managed to install it.

Next, I watched and followed the instruction from this video at minute 14:00

How to Get Started with Docker https://www.youtube.com/watch?v=iqqDU2crIEQ

wolf@linux:~$ docker images
REPOSITORY    TAG       IMAGE ID       CREATED         SIZE
ubuntu        latest    f643c72bc252   3 weeks ago     72.9MB
hello-world   latest    bf756fb1ae65   11 months ago   13.3kB
wolf@linux:~$ 

I tried to run it ...

wolf@linux:~$ docker run -p 8080:80 --name hello -d hello-world
007somehashhere
wolf@linux:~$ 

However, when I checked it with docker ps, it's not there.

wolf@linux:~$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
wolf@linux:~$ 

I tried to restart it, but it doesn't work too.

wolf@linux:~$ docker start hello 
hello
wolf@linux:~$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
wolf@linux:~$ 

Tried different command, but doesn't help much.

wolf@linux:~$ docker container run -d -t hello-world
007somehashhere
wolf@linux:~$ 

wolf@linux:~$ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES
wolf@linux:~$ 

What's wrong in this case and how do I make it work?

PHP can be stop by stopping the web-server service.

e.g.

# /etc/init.d/apache2 stop

or

# apache2ctl stop

Would it be possible to stop PHP alone without disrupting apache2 service?

Before installation

wolf@Linux:~$ service mysql status
Unit mysql.service could not be found.
wolf@Linux:~$ 

Installation ...

wolf@Linux:~$ sudo apt install mysql-server
Reading package lists... Done

After installation

wolf@Linux:~$ service mysql status
● mysql.service - MySQL Community Server
   Loaded: loaded (/lib/systemd/system/mysql.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2020-05-29 11:33:26 +08; 10s ago
 Main PID: 4219 (mysqld)
    Tasks: 28 (limit: 1129)
   CGroup: /system.slice/mysql.service
           └─4219 /usr/sbin/mysqld --daemonize --pid-file=/run/mysqld/mysqld.pid

Mei 29 11:33:26 Linux1 systemd[1]: Starting MySQL Community Server...
Mei 29 11:33:26 Linux1 systemd[1]: Started MySQL Community Server.
wolf@Linux:~$ 

Still can't access it

wolf@Linux:~$ mysql
ERROR 1045 (28000): Access denied for user 'wolf'@'localhost' (using password: NO)
wolf@Linux:~$ 

/var/log/mysql/error.log

2020-05-29T04:29:04.188484Z 3 [Note] Access denied for user 'wolf'@'localhost' (using password: NO)

Even with root user

wolf@Linux:~$ mysql -u root
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
wolf@Linux:~$ 

wolf@Linux:~$ mysql -u root -p
Enter password: 
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
wolf@Linux:~$ 

/var/log/mysql/error.log

2020-05-29T04:30:01.312977Z 4 [Note] Access denied for user 'root'@'localhost'
2020-05-29T04:30:15.223701Z 5 [Note] Access denied for user 'root'@'localhost'

Reset the root password

wolf@Linux:~$ sudo mysqladmin -u root password NEWPASSWORD
mysqladmin: [Warning] Using a password on the command line interface can be insecure.
Warning: Since password will be sent to server in plain text, use ssl connection to ensure password safety.
wolf@Linux:~$ 

no new log at /var/log/mysql/error.log when resetting the new password

but didn't work too

wolf@Linux:~$ mysql -u root -pNEWPASSWORD
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1698 (28000): Access denied for user 'root'@'localhost'
wolf@Linux:~$ 

/var/log/mysql/error.log

2020-05-29T04:32:35.609239Z 8 [Note] Access denied for user 'root'@'localhost'

Attempt to access it without password also didn't work

wolf@Linux:~$ sudo mysqld_safe --skip-grant-tables &
[1] 5489
wolf@Linux:~$ 2020-05-30T03:43:42.913712Z mysqld_safe Logging to syslog.
2020-05-30T03:43:42.916500Z mysqld_safe Logging to '/var/log/mysql/error.log'.
2020-05-30T03:43:42.918902Z mysqld_safe Directory '/var/run/mysqld' for UNIX socket file don't exists.

[1]+  Exit 1                  sudo mysqld_safe --skip-grant-tables
wolf@Linux:~$ 

no new log at /var/log/mysql/error.log when sudo mysqld_safe --skip-grant-tables &

Update /var/log/mysql/error.log during installation

wolf@Linux:/var/log/mysql$ tail -F error.log 
2020-05-30T04:28:13.132939Z 0 [Warning] CA certificate ca.pem is self signed.
2020-05-30T04:28:13.132959Z 0 [Note] Skipping generation of RSA key pair as key files are present in data directory.
2020-05-30T04:28:13.133002Z 0 [Note] Server hostname (bind-address): '127.0.0.1'; port: 3306
2020-05-30T04:28:13.133009Z 0 [Note]   - '127.0.0.1' resolves to '127.0.0.1';
2020-05-30T04:28:13.133027Z 0 [Note] Server socket created on IP: '127.0.0.1'.
2020-05-30T04:28:13.137509Z 0 [Note] Event Scheduler: Loaded 0 events
2020-05-30T04:28:13.137601Z 0 [Note] InnoDB: Loading buffer pool(s) from /var/lib/mysql/ib_buffer_pool
2020-05-30T04:28:13.138071Z 0 [Note] InnoDB: Buffer pool(s) load completed at 200530 12:28:13
2020-05-30T04:28:13.138126Z 0 [Note] /usr/sbin/mysqld: ready for connections.
Version: '5.7.30-0ubuntu0.18.04.1'  socket: '/var/run/mysqld/mysqld.sock'  port: 3306  (Ubuntu)

What should I do next?

I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses?

I would like to get something like netdiscover output. Just IP & MAC Address only.

Nmap version 7.80

wolf@linux:~$ nmap -V
Nmap version 7.80 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu

e.g.

wolf@linux:~$ nmap -sn -oG - 10.10.10.*
# Nmap 7.80 scan initiated Wed May 20 12:38:57 2020 as: nmap -sn -oG - 10.10.10.*
Host: 10.10.10.1 () Status: Up
Host: 10.10.10.2 () Status: Up
Host: 10.10.10.3 () Status: Up
# Nmap done at Wed May 20 12:38:59 2020 -- 256 IP addresses (3 hosts up) scanned in 2.25 seconds
wolf@linux:~$