Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I have been working on a conky configuration to help me manage penetration tests, but after much research, I cannot find anyone else speaking of their configs in any way other than the glitz.

Currently, I have:

  • CPU load
  • Memory load
  • top processes
  • networking summary
  • dashboard of pre-selected running services (ftp, tftp, www, p0f, wireshark, ettercap)

What I really want is to monitor all incoming connections, but localhost keeps getting in the way (metasploit connecting to postgres, msfrpcd, etc). Does anyone know how to filter out localhost from tcp_monitor?

Does anyone have a custom conky config for pentesting or know of a source for ideas?

Edit:

I have tried an if_match against the "remote ip" and "addr(lo)", but it throws errors with IPv6.

share|improve this question
    
schroeder, I realise that this was some time ago but I see you are still active. Did you come up with a workable solution? If so, mind sharing? I'd also be interested to read your section on "dashboard of pre-selected running services (ftp, tftp, www, p0f, wireshark, ettercap)" Regards, Adz –  Adz Feb 14 at 21:46

4 Answers 4

You could look for all incoming tcp packets with the syn flag using tcpdump:

tcpdump "tcp[tcpflags] & tcp-syn != 0"

But is going to be very noisy. Great Penetration testers are also great programmers, and they often have to write or modify their own tools.

share|improve this answer
    
Why should it be noisy to run a sniff on your own box? –  sfx Jul 19 '12 at 22:38
    
@sfx Run the command during a pen test and you tell me. –  rook Jul 19 '12 at 22:39
    
it's your own box, so they can only detect it by the network traffic. Your command puts the interface into promisc mode, but you can disable this behavior. But even if you don't, they have to send packets to detect it. And you should have a firewall to prevent this detection anyway. –  sfx Jul 19 '12 at 22:59
    
@Rook Your idea has potential. Would filtering on outgoing ACKs reduce the noise? It would save me from being in promisc mode, and I am more interested on established connections than other traffic. –  schroeder Jul 19 '12 at 23:21

iftop (which uses ncurses) would be cool to have in a Conky window.

Others I can think of: tcptrace

share|improve this answer
up vote 1 down vote accepted

I ended up using 'execp' to run netstat grepping out localhost and added some awk goodness to format the output.

Doing it that way, I was also able to split out LISTENing ports and established.

As the basic example, which I split out in various forms:

${execp netstat -upant | grep "tcp\|udp" | grep -v "127.0.0.1\|::1" | awk '{split($4, a, ":"); print "%s %s\n", a[1], a[2] }' }
share|improve this answer
    
I am still stumped why there are not more conky scripts for pen testers. The quick and dirty one I have has been so helpful! –  schroeder Jul 24 '12 at 20:02
    
I hadn't actually heard of Conky before. Generally bash scripts have always done it for me:) –  Rory Alsop Jul 24 '12 at 21:44
    
I am finding it useful as a constant monitor on the desktop. I can run several things at once, and the monitor can keep track of what's going on. Including, as my script now allows, checking to see if reverse shells have connected, and if I have remembered to set up listeners or servers, and which ones are active. I also have the normal dynamic monitors of CPU and RAM, as well as interface traffic and settings. It makes it easier to multitask in an engagement. –  schroeder Jul 24 '12 at 22:12

set to yes if you want Conky to be forked in the background

background yes

cpu_avg_samples 2
net_avg_samples 2

out_to_console no

# X font when Xft is disabled, you can pick one with program xfontsel
#font 7x12
#font 6x10
#font 7x13
#font 8x13
#font 7x12
#font *mintsmild.se*
#font -*-*-*-*-*-*-34-*-*-*-*-*-*-*
#font -artwiz-snap-normal-r-normal-*-*-100-*-*-p-*-iso8859-1

# Use Xft?
use_xft yes

# Xft font when Xft is enabled
xftfont Bitstream Vera Sans Mono:size=6

own_window_transparent yes
#own_window_colour hotpink
# Text alpha when using Xft
xftalpha 0.8

# mail spool
mail_spool $MAIL

# Update interval in seconds
update_interval 1
# Create own window instead of using desktop (required in nautilus)
own_window yes
own_window_transparent yes
own_window_argb_visual no
own_window_argb_value 0
own_window_hints undecorated,sticky,below,skip_taskbar
own_window_type override

# Use double buffering (reduces flicker, may not work for everyone)
double_buffer yes

# Minimum size of text area
minimum_size 300 5
maximum_width 650

# Draw shades?
draw_shades no

# Draw outlines?
draw_outline no

# Draw borders around text
draw_borders no

# Stippled borders?
stippled_borders no

# border margins
border_margin 10

# border width
border_width 2

# Default colors and also border colors
default_color white
default_shade_color white
default_outline_color white

# Text alignment, other possible values are commented
#alignment top_left
#minimum_size 10 10
gap_x 5
gap_y 35
alignment top_right
#alignment bottom_left
#alignment bottom_right

# Gap between borders of screen and text

# Add spaces to keep things from moving about?  This only affects certain object
s.
use_spacer none

# Subtract file system buffers from used memory?
no_buffers yes

# set to yes if you want all text to be in uppercase
uppercase no

# boinc (seti) dir
# seti_dir /opt/seti

# Possible variables to be used:
#
#      Variable         Arguments                  Description                
#  acpiacadapter                     ACPI ac adapter state.                   
#  acpifan                           ACPI fan state                           
#  acpitemp                          ACPI temperature.                        
#  adt746xcpu                        CPU temperature from therm_adt746x       
#  adt746xfan                        Fan speed from therm_adt746x             
#  battery           (num)           Remaining capasity in ACPI or APM        
#                                    battery. ACPI battery number can be      
#                                    given as argument (default is BAT0).     
#  buffers                           Amount of memory buffered                
#  cached                            Amount of memory cached                  
#  color             (color)         Change drawing color to color            
#  cpu                               CPU usage in percents                    
#  cpubar            (height)        Bar that shows CPU usage, height is      
#                                    bar's height in pixels                   
#  downspeed         net             Download speed in kilobytes              
#  downspeedf        net             Download speed in kilobytes with one     
#                                    decimal                                  
#  exec              shell command   Executes a shell command and displays    
#                                    the output in torsmo. warning: this      
#                                    takes a lot more resources than other    
#                                    variables. I'd recommend coding wanted   
#                                    behaviour in C and posting a patch :-).  
#  execi             interval, shell Same as exec but with specific interval. 
#                    command         Interval can't be less than              
#                                    update_interval in configuration.        
#  fs_bar            (height), (fs)  Bar that shows how much space is used on 
#                                    a file system. height is the height in   
#                                    pixels. fs is any file on that file      
#                                    system.                                  
#  fs_free           (fs)            Free space on a file system available    
#                                    for users.                               
#  fs_free_perc      (fs)            Free percentage of space on a file       
#                                    system available for users.              
#  fs_size           (fs)            File system size                         
#  fs_used           (fs)            File system used space                   
#  hr                (height)        Horizontal line, height is the height in 
#                                    pixels                                   
#  i2c               (dev), type, n  I2C sensor from sysfs (Linux 2.6). dev   
#                                    may be omitted if you have only one I2C  
#                                    device. type is either in (or vol)       
#                                    meaning voltage, fan meaning fan or temp 
#                                    meaning temperature. n is number of the  
#                                    sensor. See /sys/bus/i2c/devices/ on     
#                                    your local computer.                     
#  kernel                            Kernel version                           
#  loadavg           (1), (2), (3)   System load average, 1 is for past 1     
#                                    minute, 2 for past 5 minutes and 3 for   
#                                    past 15 minutes.                         
#  machine                           Machine, i686 for example                
#  mails                             Mail count in mail spool. You can use    
#                                    program like fetchmail to get mails from 
#                                    some server using your favourite         
#                                    protocol. See also new_mails.            
#  mem                               Amount of memory in use                  
#  membar            (height)        Bar that shows amount of memory in use   
#  memmax                            Total amount of memory                   
#  memperc                           Percentage of memory in use              
#  new_mails                         Unread mail count in mail spool.         
#  nodename                          Hostname                                 
#  outlinecolor      (color)         Change outline color                     
#  pre_exec          shell command   Executes a shell command one time before 
#                                    torsmo displays anything and puts output 
#                                    as text.                                 
#  processes                         Total processes (sleeping and running)   
#  running_processes                 Running processes (not sleeping),        
#                                    requires Linux 2.6                       
#  shadecolor        (color)         Change shading color                     
#  stippled_hr       (space),        Stippled (dashed) horizontal line        
#                    (height)        
#  swapbar           (height)        Bar that shows amount of swap in use     
#  swap                              Amount of swap in use                    
#  swapmax                           Total amount of swap                     
#  swapperc                          Percentage of swap in use                
#  sysname                           System name, Linux for example           
#  time              (format)        Local time, see man strftime to get more 
#                                    information about format                 
#  totaldown         net             Total download, overflows at 4 GB on     
#                                    Linux with 32-bit arch and there doesn't 
#                                    seem to be a way to know how many times  
#                                    it has already done that before torsmo   
#                                    has started.                             
#  totalup           net             Total upload, this one too, may overflow 
#  updates                           Number of updates (for debugging)        
#  upspeed           net             Upload speed in kilobytes                
#  upspeedf          net             Upload speed in kilobytes with one       
#                                    decimal                                  
#  uptime                            Uptime                                   
#  uptime_short                      Uptime in a shorter format               
#
#  seti_prog                         Seti@home current progress
#  seti_progbar      (height)        Seti@home current progress bar
#  seti_credit                       Seti@hoome total user credit


# variable is given either in format $variable or in ${variable}. Latter
# allows characters right after the variable and must be used in network
# stuff because of an argument
#${font Dungeon:style=Bold:pixelsize=10}I can change the font as well
#${font Verdana:size=10}as many times as I choose
#${font Perry:size=10}Including UTF-8,
# stuff after 'TEXT' will be formatted on screen
#${font Grunge:size=12}${time %a  %b  %d}${alignr -25}${time %k:%M}

TEXT
${color #00F6FF}$sysname $kernel $machine - $nodename 
${color #00F6FF}Today is ${color lightgrey}${time %A, %d %B %Y}
${color #00F6FF}The Time is ${color lightgrey}${time %H:%M.%S}${alignr}${color #
00F6FF}Uptime:${color lightgrey} $uptime
Updates: ${alignr}${font Ubuntu:style=Bold:size=8}${color2}${execi 360 aptitude 
search "~U" | wc -l | tail}${color}${font} ${color2}Packages${color}
${color #00F6FF}CPU_FREQ: ${color lightgrey}${freq_g cpu=0}
${color #00F6FF}Load-Average: ${color lightgrey}${cpu cpu0}% ${color #FCFF00}${c
pubar cpu0}
${color #00F6FF}${cpugraph cpu0 000000 FCFF00}
${color #00F6FF}Core-1: ${color lightgrey}${cpu cpu1}% ${color #FCFF00}${cpubar 
cpu1}
${color #00F6FF}${cpugraph cpu1 000000 FCFF00}
${color #00F6FF}Core-2: ${color lightgrey}${cpu cpu2}% ${color #FCFF00}${cpubar 
cpu2}
${color #00F6FF}${cpugraph cpu2 000000 FCFF00}
${color #00F6FF}Core-3: ${color lightgrey}${cpu cpu3}% ${color #FCFF00}${cpubar 
cpu3}
${color #00F6FF}${cpugraph cpu3 000000 FCFF00}
${color #00F6FF}Core-4: ${color lightgrey}${cpu cpu4}% ${color #FCFF00}${cpubar 
cpu4}
${color #00F6FF}${cpugraph cpu4 000000 FCFF00}

${color #00F6FF}Processes:${color lightgrey} $processes  ${color #00F6FF}Run:${c
olor lightgrey} $running_processes
${color #00F6FF}CPU Usage         PID     CPU%   MEM%
${color lightgrey} ${top name 1} ${top pid 1} ${top cpu 1} ${top mem 1}
${color #00F6FF} ${top name 2} ${top pid 2} ${top cpu 2} ${top mem 2}
${color #00F6FF} ${top name 3} ${top pid 3} ${top cpu 3} ${top mem 3}

${color #00F6FF}RAM:${color lightgrey} $mem/$memmax - $memperc% ${alignr}${color
 #FF8E00}${membar 5,110}
${color #00F6FF}SWP:${color lightgrey} $swap/$swapmax - $swapperc% ${alignr}${co
lor #FF8E00}${swapbar 5,110}
${color #00F6FF}Mem Usage
${color lightgrey} ${top_mem name 1} ${top_mem pid 1} ${top_mem cpu 1} ${top_mem
 mem 1}
${color #00F6FF} ${top_mem name 2} ${top_mem pid 2} ${top_mem cpu 2} ${top_mem m
em 2}
${color #00F6FF} ${top_mem name 3} ${top_mem pid 3} ${top_mem cpu 3} ${top_mem m
em 3}

${color #00F6FF}HD IO: ${color lightgrey}${diskio}
${color #00F6FF}${diskiograph 000000 00EA01}
${color #00F6FF}Hard Disks:
${color #00F6FF} Root ${color lightgrey}${fs_used /}/${fs_size /}${alignr}${colo
r #00EA01}${fs_bar 5,120 /}

${color #00F6FF}Network: ${color lightgrey}${addr eth0}${color lightgrey}  Publi
c IP: ${color lightgrey}${execi 10800 /usr/share/conkycolors/bin/conkyIp}${color
}
${color #00F6FF}Down:${color lightgrey} ${downspeed eth0} k/s $alignr${color #00
F6FF} Up:${color lightgrey} ${upspeed eth0} k/s
${color #00F6FF}${downspeedgraph eth0 27,120 000000 FF0000 180} $alignr${color #
00F6FF}${upspeedgraph eth0 27,120 000000 FF0000 25}
${color lightgrey}${totaldown eth0}           $alignr${color lightgrey}${totalup
 eth0}
${color #00F6FF}Port(s)${offset 48}Connections:
${color #00F6FF} ALL: ${color lightgrey}${alignc}${tcp_portmon 1 65535 count}
${color #00F6FF} 1 - 1024:${color lightgrey}${alignc}${tcp_portmon 1 1024 count}
${color #00F6FF} 1025 - 65535:${color lightgrey}${alignc}${tcp_portmon 1024 6553
5 count}

${color #00F6FF}Remote Address:${alignr} Local Service/Port:
${color lightgrey}${tcp_portmon 1 1024 rport 0} 
${color lightgrey}${tcp_portmon 1 65535 rhost 0}${alignr}${tcp_portmon  1 65535 
lservice 0}
${color lightgrey}${tcp_portmon 1 65535 rhost 1}${alignr}${tcp_portmon  1 65535 
lservice 1}
${color lightgrey}${tcp_portmon 1 65535 rhost 2}${alignr}${tcp_portmon  1 65535 
lservice 2}
${color lightgrey}${tcp_portmon 1 65535 rhost 3}${alignr}${tcp_portmon  1 65535 
lservice 3}
${color lightgrey}${tcp_portmon 1 65535 rhost 4}${alignr}${tcp_portmon  1 65535 
lservice 4}
${color lightgrey}${tcp_portmon 1 65535 rhost 5}${alignr}${tcp_portmon  1 65535 
lservice 5}

${color lightgrey}${execi 60 fping 192.168.1.1}${color}
#### ${color lightgrey}${execi 60 fping 192.168.1.163}${color}
share|improve this answer
1  
Dumping a config without explanation isn't really helpful. Please paste just the pieces relevant to the question, with descriptions. –  Xander Jul 26 at 23:30
    
Also please use code formatting when pasting in code text –  schroeder Jul 27 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.