Homelab on kimobu

Monitoring Kubernetes with Security Onion

Thu, 05 Sep 2024 00:00:00 +0000

Introduction

After adding Kubernetes to my homelab, I wanted to learn how to hack and hunt for malicious activity involving containers. I found Kubernetes GOAT which provides a great way to practice hacking. To do the hunting, we need some additional work to enable telemetry on networks, containers, and Kubernetes. In this post I’ll walk through how I instrumented my Microk8s cluster to hunt for the hacking actions you can do in the GOAT.

SecurityOnion GPT

Mon, 12 Feb 2024 00:00:00 +0000

Introduction

I was recently catching up on some conference videos and saw a talk by Roberto Rodriguez on Empowering Security Teams with Generative AI: GPT models. This got me thinking about how to integrate GPT to hunting with Security Onion.

Goals:

Summarize activity found in Security Onion
Enrich activity with MITRE ATT&CK attribution
Convert English questions to Kibana Query Language to hunt

In this post, I’ll tackle goals 1 and 2. I’ll do goal 3 in a separate post. These experiments will be conducted in Jupyter lab.

Learning Kubernetes

Mon, 01 Jan 2024 00:00:00 +0000

I run a few services for the threat intelligence and hunting course that I teach, including CAPE, MISP, and Caldera. Last semester, I used a few VMs and Docker to provide these, but I wanted to learn Kubernetes. Here are some notes on migrating over.

Getting Started

I started trying Kubernetes the hard way but ultimately ended up using microk8s. The install guide was straight forward. I made 1x control plane node and 2x worker nodes. I used this blog as a starting point. I used Robert’s suggestion for nfs-subdir-external-provisioner to provide the persistent storage for my pods.

Putting phishing data into Security Onion

Thu, 20 Jul 2023 00:00:00 +0000

I wanted to add some phishing scenarios to my hunting homelab. I’m more concerned with being able to hunt on malicious emails than on stopping them, so DMARC, DKIM, and SPF are out of scope. If you have an offensive lens, you’ll want to look at something like this for an effective phishing set up.

Let’s look at two areas: external mail where phishing comes from and internal mail where phishes will be received.

Adding macOS to my security homelab

Wed, 10 May 2023 00:00:00 +0000

This post has notes on how I added a macOS machine to my security homelab.

Install macOS to Proxmox

Follow this guide to install macOS onto a Proxmox cluster. This will result in an x86 based VM. I plan on looking into an ARM node in the future. Reference this page if you don’t want to extract OSK yourself. Additional note, this installed to local-lvm, not my GlusterFS storage.

Bind macOS to Active Directory

Since the rest of the lab is a Windows Active Directory domain, I wanted to join the macOS VM to the domain so domain users could login. Follow the guide here for high level guidance. Ventura changed the look of the Directory Utility but the overall concepts are the same. In Directory Utility, tick the option to “create mobile account at login” and add the “Users” OU to allowed administration.

log4j JNDI Exploitation

Fri, 10 Dec 2021 00:00:00 +0000

Situation

A remote code execution (RCE) bug was found in log4j. CVE 2021-44228 has been assigned to it. The vulnerability lies in how log4j interprets Java Naming and Directory Interface (JNDI) URLs. JNDI lets an application look up a service. An attacker can craft a string that looks like “${jndi:proto://host/a}” where proto is ldap or rmi, and log4j will connect to the host to retrieve a, which would specify how to process the log entry. However, a can instead provide Java bytecode that log4j will execute.

Security Onion on Proxmox

Wed, 26 May 2021 00:00:00 +0000

Security Onion on Proxmox

I originally set up my homelab using Ovirt, but have since switched back to Proxmox. The reason for that is that the version of qemu that Ovirt ships with does not support the “applesmc” device that is needed to run macOS guests, whereas Proxmox does. Another benefit is that Proxmox supports running containers, while Ovirt required full virtual machines, and Proxmox is overall much faster at every day tasks like starting or migrating a VM. I kept the same infrastructure as before, including using Gluster as shared storage amongst the compute nodes.

Installing the Cuckoo Sandbox Using KVM

Thu, 23 Jan 2020 00:00:00 +0000

The Cuckoo project provides a safe environment in which to execute malware (also called “detonating”). I will be using Cuckoo as part of a malware analysis class. There are several guides that you could follow to setup Cuckoo, but almost all of the ones that I found used VirtualBox as a hypervisor. Since I have a homelab running on KVM, I wanted to install Cuckoo to use that as well. There is no groundbreaking information in this post, but it consolidates information that I had to find from several different sources while troubleshooting.