Anonymous SSH Sessions With TOR

Fonte:http://www.howtoforge.com/anonymous-ssh-sessions-with-tor

OpenSSH is a great means to protect your connection from being sniffed by others. However, this isn’t always enough. Simply proving that you connected to a server is enough to get incriminated. Unfortunately, SSH doesn’t provide a native way to obfuscate to whom it connects. Instead, a proxy server can be set up. And this is where TOR comes to play. This howto covers installing TOR on a Debian based system and setting up SSH to use TOR.

Installing TOR

First you should to add the TOR repository to your system. It’s only necessary if there’s no package in the default repositories.

Add the following line to your /etc/apt/sources.list file. You have to replace lenny with your distribution.

deb http://mirror.noreply.org/pub/tor lenny main

To use this repository without problems, you have to add the PGP key to your system.

apt-key adv –recv-keys –keyserver subkeys.pgp.net 0x94C09C7F

Update your repositories and install TOR.

apt-get update && apt-get install -y tor

If you want to use TOR with OpenSSH, you have to install another program called connect-proxy.

apt-get install -y connect-proxy

Setup OpenSSH to use TOR for all connections

However, this is not recommended, but here is how it works.

Add the following block to the top of your ~/.ssh/config file.

Host *
CheckHostIP no
Compression yes
Protocol 2
ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p

The command line syntax won’t change at all.

Set up OpenSSH to use TOR for a specific connection

I recommend using TOR only for a specific connection. All other connections won’t be affected.

Add this block to your ~/.ssh/config. You have to replace mydomain with the host domain name or IP address and myaccount with your user name.

Host mydomain
HostName mydomain.com
User myaccount
CheckHostIP no
Compression yes
Protocol 2
ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p

Set up OpenSSH to use TOR for a bunch of connections

Instead of setting up TOR for every single connections, you can do this for a bunch of connections at once. Following example shows how it works.

Host anon_*
CheckHostIP no
Compression yes
Protocol 2
ProxyCommand connect -4 -S localhost:9050 $(tor-resolve %h localhost:9050) %p
Host anon_mydomain
HostName mydomain.com
User myaccount
Host anon_mydomain2
HostName mydomain2.com
User myaccount
Port 980

This way you know exactly if you’re using TOR or not.

Conclusion

It is very simple to anonymize your SSH sessions if you know what you’re doing. I’ve written this tutorial for legal purposes only. Using this is your own risk.

Antimeter Tool – Anti Meterpreter (Metasploit) for Windows – Uma ferramenta defensiva contra o Meterpreter do Metasploit

Uma ferramenta defensiva contra o Meterpreter do Metasploit

Link: http://www.mertsarica.com/codes/antimeter2.zip

USO

Code:

antimeter.exe [argumentos]

Argumentos Opcionais:
-t [intervalo de tempo] Varre a memória em cada intervalo de tempo especificado (Padrão intervalo de tempo é um (1) minuto)
-a Automaticamente mata o processo Meterpreter (desativado por padrão)
-d Apenas detecta o processo Meterpreter (desativado por padrão)
-e Adiciona processo para a lista de exclusão (por exemplo, uma “blacklist”)

EXEMPLOS
Varre a memória em cada 5 minutos, mata o processo Meterpreter automaticamente e é habilitado o modo verbose:

Code:

antimeter.exe -t 5 -a -v

Varre a memória em cada minuto e só detecta o processo Meterpreter:

Code:

antimeter.exe -n

Varre a memória em cada minuto, sendo os processos “explorer e winlogon” são excluídos da análise:

Code:

antimeter.exe -e explorer.exe,winlogon.exe

Ai a pergunta? Porque usar uma ferramenta dessas, sendo que eu uso Linux ou Mac, por exemplo?

A resposta é “PORQUE SIM!!!”, deixando as zoeira de lado, quando você tem ambientes heterogênios e grandes, há uma grande tendência para ter servers e desktops Windows.

Então se for o caso está ai uma solução, para um SO tão fraco quanto Windows (no caso ele mesmo!)

@firebitsbr

OBS: Já existe script no metasploit, que é anti-antimeterpreter, mas…deixa pra lá;)