- Persistent Changes – Files saved and changes made will be kept across reboots.
- Nessus and NessusClient installed – Everybody needs Nessus
- Encryption configured (Note: This is not whole drive encryption)
Tools and Supplies
- A USB thumbdrive – minimum capacity 4GB
- A Backtrack 3 CDROM, Backtrack 4 DVD or an additional USB thumbdrive (minimum 2GB) – Used to partition the thumbdrive.
- Optional: UNetbootin – A tool to transfer an iso image to a USB drive.
dmesg | egrep hd.|sd.
- The first partition needs to be a primary partition of at least 1.5 GB and set to type vfat. Also remember to make this partition active when you are creating it. Otherwise you might have some boot problems.
- The second Partition can be the rest of the thumb drive.
fdisk /dev/sda # use the appropriate drive letter for your system
# delete existing partitions. There may be more than one.
Command (m for help): d
Partition number (1-4): 1
# create the first partition
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-522, default 1):
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-522, default 522): +1500M
#create the second partition
Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 2
First cylinder (193-522, default 193):
Using default value 193
Last cylinder, +cylinders or +size{K,M,G} (193-522, default 522):
Using default value 522
# Setting the partition type for the first partition to vfat/fat32
Command (m for help): t
Partition number (1-4): 1
Hex code (type L to list codes): b
Changed system type of partition 1 to b (W95 FAT32)
# Setting the partition type for the second partition to Linux
Command (m for help): t
Partition number (1-4): 2
Hex code (type L to list codes): 83
# Setting the first partition active
Command (m for help): a
Partition number (1-4): 1
Command (m for help): w
# now it is time to format the partitions
mkfs.vfat /dev/sdb1
mkfs.ext3 -b 4096 -L casper-rw /dev/sdb2
- Mount the first partition.
- Copy the Backtrack files to it.
- Install grub.
Following are the commands to execute. Again, ‘#’ denote comments and user typed commands are in bold.
# mount the first partition, sda1 in my case.
mkdir /mnt/sda1
mount /dev/sda1 /mnt/sda1
# copy the files, you will need to find where the ISO is mounted on your system.
cd /mnt/sda1
rsync -r /media/cdrom0/* .
# install grub
grub-install –no-floppy –root-directory=/mnt/sda1 /dev/sda
- Change the default boot selection to persistent.
- Set the resolution for our gui.
To do so, do the following. Again, ‘#’ …comment….user typed…blah blah.
cd /mnt/sda1/boot/grub
vi menu.lst# change the default line below to ‘default 4′ and append ‘vga=0×317′ (that’s a zero) to the kernel line to set the resolution to 1024×768# By default, boot the first entry.
default 4
.
.
.
title Start Persistent Live CD
kernel /boot/vmlinuz BOOT=casper boot=casper persistent rw quiet vga=0×317
initrd /boot/initrd.gz:wq
# By default, boot the first entry.
default 4
# Boot automatically after 30 secs.
timeout 30
splashimage=/boot/grub/bt4.xpm.gz
title Start BackTrack FrameBuffer (1024×768)
kernel /boot/vmlinuz BOOT=casper boot=casper nopersistent rw quiet vga=0×317
initrd /boot/initrd.gz
title Start BackTrack FrameBuffer (800×600)
kernel /boot/vmlinuz BOOT=casper boot=casper nopersistent rw quiet vga=0×314
initrd /boot/initrd800.gz
title Start BackTrack Forensics (no swap)
kernel /boot/vmlinuz BOOT=casper boot=casper nopersistent rw vga=0×317
initrd /boot/initrdfr.gz
title Start BackTrack in Safe Graphical Mode
kernel /boot/vmlinuz BOOT=casper boot=casper xforcevesa rw quiet
initrd /boot/initrd.gz
title Start Persistent Live CD
kernel /boot/vmlinuz BOOT=casper boot=casper persistent rw quiet vga=0×317
initrd /boot/initrd.gz
title Start BackTrack in Text Mode
kernel /boot/vmlinuz BOOT=casper boot=casper nopersistent textonly rw quiet
initrd /boot/initrd.gz
title Start BackTrack Graphical Mode from RAM
kernel /boot/vmlinuz BOOT=casper boot=casper toram nopersistent rw quiet
initrd /boot/initrd.gz
title Memory Test
kernel /boot/memtest86+.bin
title Boot the First Hard Disk
root (hd0)
chainloader +1
dpkg –install Nessus-4.0.2-ubuntu810_i386.deb
dpkg –install NessusClient-4.0.2-ubuntu810_i386.deb
#create server certificate
/opt/nessus/sbin/nessus-mkcert
This script will now ask you the relevant information to create the SSL
certificate of Nessus. Note that this information will *NOT* be sent to
anybody (everything stays local), but anyone with the ability to connect to your
Nessus daemon will be able to retrieve this information.
CA certificate life time in days [1460]:
Server certificate life time in days [365]:
Your country (two letter code) [FR]:US
Your state or province name [none]:Confused
Your location (e.g. town) [Paris]:Somewhere In Time
Your organization [Nessus Users United]:
.
.
.
Congratulations. Your server certificate was properly created.
.
.
# add user
/opt/nessus/sbin/nessus-adduser
Login :Me
Authentication (pass/cert) : [pass]
Login password :
Login password (again) :
Do you want this user to be a Nessus ‘admin’ user ? (can upload plugins, etc…) (y/n) [n]:y
User rules
———-
nessusd has a rules system which allows you to restrict the hosts
that Me has the right to test. For instance, you may want
him to be able to scan his own host only.
Please see the nessus-adduser manual for the rules syntax
Enter the rules for this user, and enter a BLANK LINE once you are done :
(the user can have an empty rules set)
Login : Me
Password : ***********
This user will have ‘admin’ privileges within the Nessus server
Rules :
Is that ok ? (y/n) [y]y
User added
/usr/sbin/update-rc.d -f nessusd remove
This command does not remove the Nessus start scripts. It only removes the links that cause Nessus to start at boot time.
/opt/nessus/bin/nessus-fetch –register [your feed code here]
/etc/init.d/nessusd start
/opt/nessus/bin/NessusClient
truecrypt -t -k ” –protect-hidden=no /my_secret_stuff /media/truecrypt1
mount
cd /media/truecrypt1
df .
This will show that the volume is mounted and the amount of disk space you have left. Our next step is to have this volume mounted when we log in. We do this by editing the root user’s .profile file. Add the truecrypt command above to root’s .profile so it looks like this:
# ~/.profile: executed by Bourne-compatible login shells.
if [ "$BASH" ]; then
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
fi
truecrypt -t -k '' --protect-hidden=no /my_secret_stuff /media/truecrypt1
mesg n
The next time you reboot you will be asked for the password for the volume and it will be mounted for you.
Now it is time to tweak a few tings
Tweak a few things
The first thing we are going to do is go ahead and configure networking to start at boot time. It’s convenient and easy to disable if we need to. All we have to do is execute the following command.
/usr/sbin/update-rc.d networking defaults
Next thing we want to do is make sure all our tools and the system itself is up-to-date. First execute the following:
apt-get update
This is update the software repository information. Next, execute the this command:
apt-get upgrade
The system will determine if there is anything that needs to be updated and then prompt you to continue. Individual packages can be updated by including the package name after upgrade.
This next bit is interesting and I was surprised it worked. We are going to reset the root user’s home directory during the login process to the mounted truecrypt volume. This will ensure that anything written to the home directory will be encrypted. The following commands will set this up for us:
cd /media/truecrypt1
rsync -r –links /root/ .
# add the bold lines below
vi /root/.profile# ~/.profile: executed by Bourne-compatible login shells.
if [ "$BASH" ]; then
if [ -f ~/.bashrc ]; then
. ~/.bashrc
fi
fi
truecrypt -t -k '' --protect-hidden=no /my_secret_stuff /media/truecrypt1
export HOME=/media/truecrypt1
export HISTFILE=/media/truecrypt1/.bash_history
cd
mesg n:wq
The next time you reboot, when you are finally in the system, your home directory will be /media/truecrypt1.
There is one last thing we want to do. We want to change nessus to log to the encrypted volume. This is very easy. The file that controls this is /opt/nessus/etc/nessus/nessusd.conf. We need to create a place for the log files to go. So execute the following
cd /media/truecrypt1
mkdir -p nessus/logs
Once you have done that, edit the /opt/nessus/etc/nessus/nessusd.conf file and change this:
.
.
.
# Log file :
logfile = /opt/nessus/var/nessus/logs/nessusd.messages
# Shall we log every details of the attack ? (disk intensive)
log_whole_attack = no
# Dump file for debugging output
dumpfile = /opt/nessus/var/nessus/logs/nessusd.dump
.
.
.
to this:
.
.
.
# Log file :
logfile = /media/truecrypt1/nessus/logs/nessusd.messages
# Shall we log every details of the attack ? (disk intensive)
log_whole_attack = no
# Dump file for debugging output
dumpfile = /media/truecrypt1/nessus/logs/nessusd.dump
.
.
.
That’s it. You are all done now.
- BackTrack 4 Beta Hard Disk Install
- HowTo: Crack WPA with Backtrack 3
- HowTo: Crack WEP with BackTrack 3
- How To Install Backtrack4 Using Grub On Ubuntu
- How to install BT4 dualboot xp on your HDD without vmware or dvd disks
- How to make Backtrack 4 boot from USB
- Installing Backtrack 3 to a harddrive
- HowTo: Backtrack 4 (Pre Release) Hard Drive Installation
- Installing Backtrack 3 to a harddrive
- BT4 Install: Simplest way to install BackTrack4
