You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This means we can make our own JWTs with a forged signature created using the public key and the HS256 algorithm to bypass the authentication completely. Since the JWT was already signed using the public key, the signature verification by the application is successful leading to a successful key confusion attack.
66
66
67
-
> **_NOTE:_** In cases where the public key isn't readily available, you may still be able to test for algorithm confusion by deriving the key from a pair of existing JWTs. This process is relatively simple using tools such as [jwt_forgery.py](https://github.com/silentsignal/rsa_sign2n/tree/release/standalone).
67
+
!!!info Note
68
+
In cases where the public key isn't readily available, you may still be able to test for algorithm confusion by deriving the key from a pair of existing JWTs. This process is relatively simple using tools such as [jwt_forgery.py](https://github.com/silentsignal/rsa_sign2n/tree/release/standalone).
69
+
!!!
68
70
69
71
### JWT header parameter injection
70
72
Although only the `alg` parameter is mandatory, in practice the header often contain other parameters:
@@ -124,20 +126,23 @@ Of course you can make the parameter point to any file, but the `/dev/null` file
124
126
125
127
## JSON Web Token Toolkit
126
128
The [jwt_tool.py](https://github.com/ticarpi/jwt_tool) is a very useful toolkit for validating, forging, scanning and tampering with JSON Web Tokens. It can test for a variety of known exploits such as the RS/HS256 public key mismatch vulnerability discussed in this article. Let's look at an example that leverages the key confusion attack on a JWT token when we have access to the public key. The `-X k` flag can be used for the key confusion attack.
127
-
```bash
128
-
python3 jwt_tool.py <JWT_TOKEN> -X k -pk public.pem
129
+
130
+
```console
131
+
$ python3 jwt_tool.py <JWT_TOKEN> -X k -pk public.pem
129
132
```
133
+
130
134
Using this tool we can even inject SQL queries in certain payload fields that we are interested in. We can do this using the `-I` flag, specifying the claim `-pc` and value `-pv` of the payload to tamper. In this example we are changing the current username to be 'admin'.
If certain functions on the web application are vulnerable to SQL injection, we can even modify the JWT token to include an injection payload of our choice.
137
-
```bash
138
-
python3 jwt_tool.py <JWT_TOKEN> -I -pc username -pv "' AND 1 = 0 UNION ALL SELECT 1,group_concat(sql),3 FROM sqlite_master--" -X k -pk public.pem
142
+
```console
143
+
$ python3 jwt_tool.py <JWT_TOKEN> -I -pc username -pv "' AND 1 = 0 UNION ALL SELECT 1,group_concat(sql),3 FROM sqlite_master--" -X k -pk public.pem
139
144
```
140
145
We can then use the newly generated fake token and set it as our session cookie:
Copy file name to clipboardExpand all lines: blog/proxmox-homelab-part1.md
+29-23Lines changed: 29 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,16 +13,17 @@ In this post, I'll walk you through setting up my personal homelab - a project t
13
13
# Network Setup
14
14
The backbone of this homelab is a segmented network architecture that isolates various virtual machines (VMs) from my home network using a firewall. We'll use pfSense as our firewall solution and Proxmox for managing the VMs. I’ll keep the initial setup straightforward, focusing on getting the basic system up and running. Here’s a schematic overview of the homelab architecture:
We’ll establish three distinct networks behind the pfSense firewall:
19
19
20
20
-**Internal Network**: For regular machines (`172.16.0.1/24`)
21
21
-**Cyber LAB**: A playground for experimenting with vulnerable machines and data (`172.16.100.1/24`)
22
22
-**Active Directory LAB**: A dedicated Windows-only AD environment (`172.16.200.1/24`)
23
23
24
+
!!!info
24
25
pfSense will act as the gateway (router) and firewall for our homelab, so it should always be the first thing you boot up when using the lab.
25
-
{: .notice--info}
26
+
!!!
26
27
27
28
Later on in this series, we will also add our own Intrusion Detection System (IDS) with Suricata. This will be a host that captures all traffic from your networks of choice and alerts for suspicious events.
28
29
@@ -34,20 +35,20 @@ To ensure smooth operation, here’s what you’ll need:
34
35
- A bootable Proxmox VE drive (ISO)
35
36
36
37
# Proxmox Setup
37
-
Installing Proxmox is relatively simple, so I’ll skip the step-by-step details. After a successful installation, you should be able to access the login portal via the IP address you specified.
38
+
Installing Proxmox is relatively simple, so I’ll skip the step-by-step details but you can go ahead and follow their official [Getting Started](https://www.proxmox.com/en/products/proxmox-virtual-environment/get-started). After a successful installation, you should be able to access the login portal via the IP address you specified.
Once logged in, we’ll create one new OVS bridged interfaces alongside the default `vmbr0` Linux bridge interface. Your CIDR and gateway might vary depending on your network configuration.
42
+
Once logged in, we’ll create two new OVS bridged interfaces alongside the default `vmbr0` Linux bridge interface. Your CIDR and gateway might vary depending on your network configuration.
For better organization, consider creating new pools for your networks. This can be done by navigating to `Datacenter > Permissions > Pools > Create`. When you start creating VMs, you can assign them to one of these pools.
46
47
47
48
To upload ISOs to Proxmox go to `lab > local (lab) > ISO Images > Upload`.
48
49
49
50
## Setting Up PfSense
50
-
To begin, create a new VM in Proxmox by clicking the blue box in the top right corner. Select the uploaded pfSense ISO and proceed with the default settings.
51
+
Download the [latest stable ISO](https://www.pfsense.org/download/) of pfSense and create a new VM in Proxmox by clicking the blue box in the top right corner. Select the uploaded pfSense ISO and proceed with the default settings.
51
52
52
53
After creating the VM, assign it to our previously created bridge interfaces by going to `Hardware > Add Network Device` and selecting `vmbr1`. Repeat this process for `vmbr2` and `vmbr3`.
53
54
@@ -60,14 +61,18 @@ Complete the pfSense installation and reboot the system. During the initial setu
60
61
61
62
Select option 2 and WAN:
62
63
- Configure IPv4 address WAN interface via DHCP?: `n`
63
-
- Enter the new WAN IPv4 address: `your_local_ip_of_choice`
64
-
- Enter the new WAN IPv4 subnet bit count: `your_subnet_bits`
65
-
- Enter the new WAN IPv4 upstream gateway address: `your_default_gateway`
64
+
- Enter the new WAN IPv4 address: `192.168.129.52`
65
+
- Enter the new WAN IPv4 subnet bit count: `23`
66
+
- Enter the new WAN IPv4 upstream gateway address: `192.168.128.1`
66
67
- Configure IPv6 address WAN interface via DHCP6?: `n`
67
68
- Enter the new WAN IPv6 address: `Enter`
68
69
- Do you want to enable the DHCP server on WAN?: `n`
69
70
- Do you want to revert to HTTP as the webConfigurator protocol?: `n`
70
71
72
+
!!!info
73
+
Change the above settings according to your network setup (yours might be different).
74
+
!!!
75
+
71
76
Select option 2 and LAN:
72
77
- Configure IPv4 address LAN interface via DHCP?: `n`
73
78
- Enter the new LAN IPv4 address: `172.16.0.1`
@@ -100,10 +105,11 @@ Select option 2 and OPT2:
100
105
- Do you want to enable the DHCP server on OPT2?: `n`
101
106
- Do you want to revert to HTTP as the webConfigurator protocol?: `n`
102
107
108
+
!!!info
103
109
We do not setup DHCP as we will let the Domain Controller handle this for us later on.
After setting up pfSense, you can create new hosts and assign them the `vmbr1` NIC on the LAN. From any host on the `172.16.0.1/24` network, you can access the pfSense web interface for further configuration.
109
115
@@ -114,9 +120,9 @@ Let’s set up some basic firewall rules to control traffic between our networks
114
120
115
121
Complete the remaining steps by filling out your preferred configuration settings. We can also rename our interfaces that were created by pfSense on the interface tab.
116
122
117
-
It is useful to assign a static IPv4 address for our attacker VM. This will make it easier for us to apply firewall rules to interfaces that should only be able to reach this VM. To do this go to `Status -> DHCP Leases` and click on the `+` icon to assign a static IP to the Attacker VM. Note that this IP address should be inside the internal LAN address space.
123
+
It is useful to assign a static IPv4 address for our attacker VM. This will make it easier for us to apply firewall rules to interfaces that should only be able to reach this VM. To do this go to `Status > DHCP Leases` and click on the `+` icon to assign a static IP to the Attacker VM. Note that this IP address should be inside the internal LAN address space.
118
124
119
-
Next go to `Firewall -> Aliases` and make a new alias with the following options:
125
+
Next go to `Firewall > Aliases` and make a new alias with the following options:
120
126
- Name: `RFC1918`
121
127
- Description: `Private IPv4 Address Space`
122
128
- Type: `Network(s)`
@@ -127,7 +133,7 @@ Next go to `Firewall -> Aliases` and make a new alias with the following options
127
133
- Network 5: `127.0.0.0/8`
128
134
129
135
### WAN Rules
130
-
Go to `Firewall -> Rules -> WAN -> Add` and make a new rule with the following options:
136
+
Go to `Firewall > Rules > WAN > Add` and make a new rule with the following options:
131
137
- Action: `Pass`
132
138
- Address Family: `Ipv4`
133
139
- Protocol: `TCP`
@@ -138,7 +144,7 @@ Go to `Firewall -> Rules -> WAN -> Add` and make a new rule with the following o
138
144
Replace the `<pfSense IP>` field with the real internal IP address of the pfSense VM (in my case `192.168.129.52`). This can be viewed at the start menu on the pfSense VM.
139
145
140
146
### LAN Rules
141
-
Go to `Firewall -> Rules -> LAN -> Add` and make a new rule with the following options:
147
+
Go to `Firewall > Rules > LAN > Add` and make a new rule with the following options:
142
148
- Action: `Block`
143
149
- Address Family: `Ipv4+IPv6`
144
150
- Protocol: `Any`
@@ -148,12 +154,12 @@ Go to `Firewall -> Rules -> LAN -> Add` and make a new rule with the following o
148
154
149
155
The final LAN configuration will look something like this:
150
156
151
-
157
+
152
158
153
159
This makes sure that the internal networks behind the WAN cannot reach our home network. If you want to connect from a device on your home network, you can add another allow rule at the top for that specific IP.
154
160
155
-
### Cyber LAB Rules
156
-
Go to `Firewall -> Rules -> Cyber Lab -> Add rule to end`:
161
+
### Cyber Lab Rules
162
+
Go to `Firewall > Rules > Cyber Lab > Add rule to end`:
157
163
- Address Family: `IPv4+IPv6`
158
164
- Protocol: `Any`
159
165
- Source: `Cyber Lab subnets`
@@ -180,12 +186,12 @@ Add another rule to end:
180
186
181
187
The final Cyber LAB configuration will look something like this:
This setup ensures that devices within the Active Directory domain can communicate freely with each other, while remaining isolated from other networks.
Copy file name to clipboardExpand all lines: blog/proxmox-homelab-part2.md
+10-9Lines changed: 10 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,44 +16,45 @@ To get started with setting up your Windows VMs and creating the AD Lab, make su
16
16
-[Windows Server 2022 ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022): For setting up the Domain Controller.
17
17
-[Windows 10 Enterprise Evaluation ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise): For joining a client machine to the domain.
18
18
19
-
**Note:** The ISOs typically have a lifespan of 90 to 180 days, but they can often be extended. To be safe, consider taking a snapshot of your VMs right after installation to revert back if needed.
20
-
{: .notice--info}
19
+
!!!info Note
20
+
The ISOs typically have a lifespan of 90 to 180 days, but they can often be extended. To be safe, consider taking a snapshot of your VMs right after installation to revert back if needed.
21
+
!!!
21
22
22
23
# Setting Up the AD Lab
23
24
We'll start by uploading the necessary ISOs to our Proxmox server. For this guide, we'll create two VMs: a Windows 10 machine and a Domain Controller. Since the setup for both is quite similar, we'll focus on the Domain Controller.
24
25
25
26
## Step 1: Create the Domain Controller VM
26
27
Create a new Virtual Machine and select the Windows Server 2022 ISO image you downloaded. Check the box to add an additional drive for the VirtIO drivers and select the corresponding ISO image.
It's recommended to assign at least 8GB of RAM and 2 CPU cores. Skip through the remaining settings, and ensure you select `vmbr3` as the network interface bridge (AD LAB).
Start the VM and press enter to go into the installation process. Begin the installation process by choosing the Windows Server 2022 Standard Evaluation (Desktop Experience) as the operating system. Proceed with the custom installation.
Once the OS installation is complete, install the qemu-guest-agent. Open Windows Explorer, open the CD drive, and install `Guest-agent\qemu-ga-x86_64 (64-bit)`. Next open Windows Device Manager and check for any missing drivers. If everything looks good, you're ready to move on.
39
40
40
41
The first thing to do after the first boot is to rename the computer. Go to `Settings > System > About > Rename This PC`. I renamed mine to `DC01` and chose to restart later.
41
42
42
43
Since this machine will serve as the DHCP server, it needs a static IP. Go to `Control Panel > Network and Internet > Network and Sharing Center > Change Adapter Settings`, and configure the network interface with a private IP address (e.g., `172.16.200.100`). Set the DNS server to `127.0.0.1`, since the DC will also be a DNS server.
## Step 2: Install Active Directory Domain Services
47
48
Open Server Manager and select `Add roles and features`. Accept the default settings until you're prompted with the `Server Roles` section. Select `Active Directory Domain Services` and add the necessary features. Once it has installed successfully, select `Close`. I also installed the DNS and DHCP Server Features together with Active Directory Certificate Services, but this is optional.
The next step is to promote the server to a domain controller. You will need to have the domain name you want to use in the next step. I will choose the domain name of `cicada.local`. To promote the server to a domain controller, click on the notification icon on the top section of the Server Manager program. Then select `Promote this server to a domain controller`. Select `Add a new forest` as this is a newly created AD environment. Enter the domain name in the root domain name field. Once the Windows Server has rebooted, you will see the login screen show the domain entered in the previous step.
52
53
53
54
## Step 3: Create a Domain Admin Account
54
55
After logging in, open `Active Directory Users and Computers`. As I like to keep things organized, I will create a new group for all the user accounts. Right click on your domain and select `New > Organizational Unit` and name it `Groups`. Move all group related objects from the `Users` to the `Groups` folder. Right click on the `Users` folder and select `New > User`.
Fill in the user details and set a password for the account. Disable the option `User must change password at next logon` and check the `Password never expires`. In an organization, the former should be checked so that the end user can set their own password.
59
60
@@ -66,7 +67,7 @@ Go to `Server Manager > Add roles and Features`, select DHCP Server, and complet
66
67
67
68
We then have to configure a DHCP scope. To do so, go to `Server Manager` once again. Then select `Tools > DHCP`. Expand the available options and then right click on IPv4 to create an IPv4 Scope. Set a name for the scope and give it a description if you wish to do so. Select `Next` and set the range to be somewhere inside the `172.16.200.1/24` network. I choose the starting IP to be `172.16.200.11` to give me some room in case I want to add some static IPs later. You can also exclude some IP addresses if you want to.
When prompted if you want to configure DHCP options for this scope now, choose `Yes`, then select `Next`. You will then be prompted to select the IP address for the default gateway. The IP address we gave our default gateway was `172.16.200.1`. Enter that and click on Add. Then select Next.
0 commit comments