Conky para PenTesters

4

He estado trabajando en una configuración de conky para ayudarme a administrar las pruebas de penetración, pero después de mucha investigación, no puedo encontrar a nadie más hablando de sus configuraciones de cualquier otra manera que no sea la ostentación.

Actualmente, tengo:

  • carga de CPU
  • carga de memoria
  • procesos principales
  • resumen de redes
  • panel de control de servicios en ejecución preseleccionados (ftp, tftp, www, p0f, wireshark, ettercap)

Lo que realmente quiero es monitorear todas las conexiones entrantes, pero localhost sigue interfiriendo (metasploit conectándose a postgres, msfrpcd, etc.). ¿Alguien sabe cómo filtrar localhost desde tcp_monitor?

¿Alguien tiene una configuración de conky personalizada para realizar pruebas o conoce una fuente de ideas?

Editar:

He probado un if_match contra la "ip remota" y "addr (lo)", pero arroja errores con IPv6.

    
pregunta schroeder 19.07.2012 - 18:53
fuente

4 respuestas

1

Terminé usando 'execp' para ejecutar netstat grepping out localhost y añadí algo de awk para dar formato a la salida.

Haciéndolo de esa manera, también pude dividir los puertos de LISTENing y establecí.

Como ejemplo básico, que dividí en varias formas:

${execp netstat -upant | grep "tcp\|udp" | grep -v "127.0.0.1\|::1" | awk '{split($4, a, ":"); print "%s %s\n", a[1], a[2] }' }
    
respondido por el schroeder 24.07.2012 - 22:01
fuente
1

Puedes buscar todos los paquetes TCP entrantes con el indicador syn usando tcpdump:

tcpdump "tcp[tcpflags] & tcp-syn != 0"

Pero va a ser muy ruidoso. Los probadores de gran penetración también son grandes programadores, y con frecuencia tienen que escribir o modificar sus propias herramientas.

    
respondido por el rook 19.07.2012 - 21:21
fuente
1

iftop (que usa ncurses) sería genial tenerlo en una ventana de Conky.

Otros en los que puedo pensar: tcptrace , captcp

    
respondido por el atdre 20.07.2012 - 21:12
fuente
-5

configúrelo en sí si desea que Conky se bifurque en segundo plano

background yes

cpu_avg_samples 2
net_avg_samples 2

out_to_console no

# X font when Xft is disabled, you can pick one with program xfontsel
#font 7x12
#font 6x10
#font 7x13
#font 8x13
#font 7x12
#font *mintsmild.se*
#font -*-*-*-*-*-*-34-*-*-*-*-*-*-*
#font -artwiz-snap-normal-r-normal-*-*-100-*-*-p-*-iso8859-1

# Use Xft?
use_xft yes

# Xft font when Xft is enabled
xftfont Bitstream Vera Sans Mono:size=6

own_window_transparent yes
#own_window_colour hotpink
# Text alpha when using Xft
xftalpha 0.8

# mail spool
mail_spool $MAIL

# Update interval in seconds
update_interval 1
# Create own window instead of using desktop (required in nautilus)
own_window yes
own_window_transparent yes
own_window_argb_visual no
own_window_argb_value 0
own_window_hints undecorated,sticky,below,skip_taskbar
own_window_type override

# Use double buffering (reduces flicker, may not work for everyone)
double_buffer yes

# Minimum size of text area
minimum_size 300 5
maximum_width 650

# Draw shades?
draw_shades no

# Draw outlines?
draw_outline no

# Draw borders around text
draw_borders no

# Stippled borders?
stippled_borders no

# border margins
border_margin 10

# border width
border_width 2

# Default colors and also border colors
default_color white
default_shade_color white
default_outline_color white

# Text alignment, other possible values are commented
#alignment top_left
#minimum_size 10 10
gap_x 5
gap_y 35
alignment top_right
#alignment bottom_left
#alignment bottom_right

# Gap between borders of screen and text

# Add spaces to keep things from moving about?  This only affects certain object
s.
use_spacer none

# Subtract file system buffers from used memory?
no_buffers yes

# set to yes if you want all text to be in uppercase
uppercase no

# boinc (seti) dir
# seti_dir /opt/seti

# Possible variables to be used:
#
#      Variable         Arguments                  Description                
#  acpiacadapter                     ACPI ac adapter state.                   
#  acpifan                           ACPI fan state                           
#  acpitemp                          ACPI temperature.                        
#  adt746xcpu                        CPU temperature from therm_adt746x       
#  adt746xfan                        Fan speed from therm_adt746x             
#  battery           (num)           Remaining capasity in ACPI or APM        
#                                    battery. ACPI battery number can be      
#                                    given as argument (default is BAT0).     
#  buffers                           Amount of memory buffered                
#  cached                            Amount of memory cached                  
#  color             (color)         Change drawing color to color            
#  cpu                               CPU usage in percents                    
#  cpubar            (height)        Bar that shows CPU usage, height is      
#                                    bar's height in pixels                   
#  downspeed         net             Download speed in kilobytes              
#  downspeedf        net             Download speed in kilobytes with one     
#                                    decimal                                  
#  exec              shell command   Executes a shell command and displays    
#                                    the output in torsmo. warning: this      
#                                    takes a lot more resources than other    
#                                    variables. I'd recommend coding wanted   
#                                    behaviour in C and posting a patch :-).  
#  execi             interval, shell Same as exec but with specific interval. 
#                    command         Interval can't be less than              
#                                    update_interval in configuration.        
#  fs_bar            (height), (fs)  Bar that shows how much space is used on 
#                                    a file system. height is the height in   
#                                    pixels. fs is any file on that file      
#                                    system.                                  
#  fs_free           (fs)            Free space on a file system available    
#                                    for users.                               
#  fs_free_perc      (fs)            Free percentage of space on a file       
#                                    system available for users.              
#  fs_size           (fs)            File system size                         
#  fs_used           (fs)            File system used space                   
#  hr                (height)        Horizontal line, height is the height in 
#                                    pixels                                   
#  i2c               (dev), type, n  I2C sensor from sysfs (Linux 2.6). dev   
#                                    may be omitted if you have only one I2C  
#                                    device. type is either in (or vol)       
#                                    meaning voltage, fan meaning fan or temp 
#                                    meaning temperature. n is number of the  
#                                    sensor. See /sys/bus/i2c/devices/ on     
#                                    your local computer.                     
#  kernel                            Kernel version                           
#  loadavg           (1), (2), (3)   System load average, 1 is for past 1     
#                                    minute, 2 for past 5 minutes and 3 for   
#                                    past 15 minutes.                         
#  machine                           Machine, i686 for example                
#  mails                             Mail count in mail spool. You can use    
#                                    program like fetchmail to get mails from 
#                                    some server using your favourite         
#                                    protocol. See also new_mails.            
#  mem                               Amount of memory in use                  
#  membar            (height)        Bar that shows amount of memory in use   
#  memmax                            Total amount of memory                   
#  memperc                           Percentage of memory in use              
#  new_mails                         Unread mail count in mail spool.         
#  nodename                          Hostname                                 
#  outlinecolor      (color)         Change outline color                     
#  pre_exec          shell command   Executes a shell command one time before 
#                                    torsmo displays anything and puts output 
#                                    as text.                                 
#  processes                         Total processes (sleeping and running)   
#  running_processes                 Running processes (not sleeping),        
#                                    requires Linux 2.6                       
#  shadecolor        (color)         Change shading color                     
#  stippled_hr       (space),        Stippled (dashed) horizontal line        
#                    (height)        
#  swapbar           (height)        Bar that shows amount of swap in use     
#  swap                              Amount of swap in use                    
#  swapmax                           Total amount of swap                     
#  swapperc                          Percentage of swap in use                
#  sysname                           System name, Linux for example           
#  time              (format)        Local time, see man strftime to get more 
#                                    information about format                 
#  totaldown         net             Total download, overflows at 4 GB on     
#                                    Linux with 32-bit arch and there doesn't 
#                                    seem to be a way to know how many times  
#                                    it has already done that before torsmo   
#                                    has started.                             
#  totalup           net             Total upload, this one too, may overflow 
#  updates                           Number of updates (for debugging)        
#  upspeed           net             Upload speed in kilobytes                
#  upspeedf          net             Upload speed in kilobytes with one       
#                                    decimal                                  
#  uptime                            Uptime                                   
#  uptime_short                      Uptime in a shorter format               
#
#  seti_prog                         Seti@home current progress
#  seti_progbar      (height)        Seti@home current progress bar
#  seti_credit                       Seti@hoome total user credit


# variable is given either in format $variable or in ${variable}. Latter
# allows characters right after the variable and must be used in network
# stuff because of an argument
#${font Dungeon:style=Bold:pixelsize=10}I can change the font as well
#${font Verdana:size=10}as many times as I choose
#${font Perry:size=10}Including UTF-8,
# stuff after 'TEXT' will be formatted on screen
#${font Grunge:size=12}${time %a  %b  %d}${alignr -25}${time %k:%M}

TEXT
${color #00F6FF}$sysname $kernel $machine - $nodename 
${color #00F6FF}Today is ${color lightgrey}${time %A, %d %B %Y}
${color #00F6FF}The Time is ${color lightgrey}${time %H:%M.%S}${alignr}${color #
00F6FF}Uptime:${color lightgrey} $uptime
Updates: ${alignr}${font Ubuntu:style=Bold:size=8}${color2}${execi 360 aptitude 
search "~U" | wc -l | tail}${color}${font} ${color2}Packages${color}
${color #00F6FF}CPU_FREQ: ${color lightgrey}${freq_g cpu=0}
${color #00F6FF}Load-Average: ${color lightgrey}${cpu cpu0}% ${color #FCFF00}${c
pubar cpu0}
${color #00F6FF}${cpugraph cpu0 000000 FCFF00}
${color #00F6FF}Core-1: ${color lightgrey}${cpu cpu1}% ${color #FCFF00}${cpubar 
cpu1}
${color #00F6FF}${cpugraph cpu1 000000 FCFF00}
${color #00F6FF}Core-2: ${color lightgrey}${cpu cpu2}% ${color #FCFF00}${cpubar 
cpu2}
${color #00F6FF}${cpugraph cpu2 000000 FCFF00}
${color #00F6FF}Core-3: ${color lightgrey}${cpu cpu3}% ${color #FCFF00}${cpubar 
cpu3}
${color #00F6FF}${cpugraph cpu3 000000 FCFF00}
${color #00F6FF}Core-4: ${color lightgrey}${cpu cpu4}% ${color #FCFF00}${cpubar 
cpu4}
${color #00F6FF}${cpugraph cpu4 000000 FCFF00}

${color #00F6FF}Processes:${color lightgrey} $processes  ${color #00F6FF}Run:${c
olor lightgrey} $running_processes
${color #00F6FF}CPU Usage         PID     CPU%   MEM%
${color lightgrey} ${top name 1} ${top pid 1} ${top cpu 1} ${top mem 1}
${color #00F6FF} ${top name 2} ${top pid 2} ${top cpu 2} ${top mem 2}
${color #00F6FF} ${top name 3} ${top pid 3} ${top cpu 3} ${top mem 3}

${color #00F6FF}RAM:${color lightgrey} $mem/$memmax - $memperc% ${alignr}${color
 #FF8E00}${membar 5,110}
${color #00F6FF}SWP:${color lightgrey} $swap/$swapmax - $swapperc% ${alignr}${co
lor #FF8E00}${swapbar 5,110}
${color #00F6FF}Mem Usage
${color lightgrey} ${top_mem name 1} ${top_mem pid 1} ${top_mem cpu 1} ${top_mem
 mem 1}
${color #00F6FF} ${top_mem name 2} ${top_mem pid 2} ${top_mem cpu 2} ${top_mem m
em 2}
${color #00F6FF} ${top_mem name 3} ${top_mem pid 3} ${top_mem cpu 3} ${top_mem m
em 3}

${color #00F6FF}HD IO: ${color lightgrey}${diskio}
${color #00F6FF}${diskiograph 000000 00EA01}
${color #00F6FF}Hard Disks:
${color #00F6FF} Root ${color lightgrey}${fs_used /}/${fs_size /}${alignr}${colo
r #00EA01}${fs_bar 5,120 /}

${color #00F6FF}Network: ${color lightgrey}${addr eth0}${color lightgrey}  Publi
c IP: ${color lightgrey}${execi 10800 /usr/share/conkycolors/bin/conkyIp}${color
}
${color #00F6FF}Down:${color lightgrey} ${downspeed eth0} k/s $alignr${color #00
F6FF} Up:${color lightgrey} ${upspeed eth0} k/s
${color #00F6FF}${downspeedgraph eth0 27,120 000000 FF0000 180} $alignr${color #
00F6FF}${upspeedgraph eth0 27,120 000000 FF0000 25}
${color lightgrey}${totaldown eth0}           $alignr${color lightgrey}${totalup
 eth0}
${color #00F6FF}Port(s)${offset 48}Connections:
${color #00F6FF} ALL: ${color lightgrey}${alignc}${tcp_portmon 1 65535 count}
${color #00F6FF} 1 - 1024:${color lightgrey}${alignc}${tcp_portmon 1 1024 count}
${color #00F6FF} 1025 - 65535:${color lightgrey}${alignc}${tcp_portmon 1024 6553
5 count}

${color #00F6FF}Remote Address:${alignr} Local Service/Port:
${color lightgrey}${tcp_portmon 1 1024 rport 0} 
${color lightgrey}${tcp_portmon 1 65535 rhost 0}${alignr}${tcp_portmon  1 65535 
lservice 0}
${color lightgrey}${tcp_portmon 1 65535 rhost 1}${alignr}${tcp_portmon  1 65535 
lservice 1}
${color lightgrey}${tcp_portmon 1 65535 rhost 2}${alignr}${tcp_portmon  1 65535 
lservice 2}
${color lightgrey}${tcp_portmon 1 65535 rhost 3}${alignr}${tcp_portmon  1 65535 
lservice 3}
${color lightgrey}${tcp_portmon 1 65535 rhost 4}${alignr}${tcp_portmon  1 65535 
lservice 4}
${color lightgrey}${tcp_portmon 1 65535 rhost 5}${alignr}${tcp_portmon  1 65535 
lservice 5}

${color lightgrey}${execi 60 fping 192.168.1.1}${color}
#### ${color lightgrey}${execi 60 fping 192.168.1.163}${color}
    
respondido por el Zebra21 27.07.2015 - 01:10
fuente

Lea otras preguntas en las etiquetas