ESXi無償版でGPUパススルーVMを作成する際に nvidia-smi が No devices were found になる問題
症状
nvidia-smi
No devices were found
dmesg
NVRM: GPU 0000:02:02.0: RmInitAdapter failed! (0x62:0x65:2584) NVRM: rm_init_adapter failed, device minor number 0
ゲストOS (Ubuntu 22.04) では lspci に NVIDIA デバイスが見えるが、ドライバ初期化に失敗。
原因
ESXi 側の VM 設定問題
- svga.present = "TRUE" のまま → 仮想GPUと物理GPUが衝突
- .romFile 指定なし → vBIOS がゲストに見えず初期化失敗
- useVGA が有効 → VGA Arbitration 競合
ゲスト側 (Ubuntu/NVIDIA ドライバ) 問題
- efifb (EFI Framebuffer) が GPU を掴んでしまい、ドライバ初期化前にリソース競合
- nvidia-drm.modeset=1 が効いていると DRM/KMS で衝突
- 一部 initramfs に古い設定が残っていた
実施したワークアラウンド
ESXi 側
vBIOS を抽出＆配置 (Asus.RTX3070.8192.210308_3.rom) VGA Bios Collection | TechPowerUp
.vmx に以下を追記：
[root@localhost:~] cat /vmfs/volumes/datastore1/llm-01/llm-01.vmx pciPassthru0.id = "00000:001:00.0" pciPassthru0.deviceId = "0x2484" pciPassthru0.vendorId = "0x10de" pciPassthru0.systemId = "685d9429-dbcc-5daf-ed4e-a8a1595698f3" pciPassthru0.present = "TRUE" pciPassthru0.pciSlotNumber = "34" # 追記 pciPassthru0.msiEnabled = "FALSE" pciPassthru0.useVGA = "FALSE" pciPassthru0.use64bitMMIO = "TRUE" pciPassthru0.romFile = "Asus.RTX3070.8192.210308_3.rom" pciPassthru1.id = "00000:001:00.1" pciPassthru1.deviceId = "0x228b" pciPassthru1.vendorId = "0x10de" pciPassthru1.systemId = "685d9429-dbcc-5daf-ed4e-a8a1595698f3" pciPassthru1.present = "TRUE" pciPassthru1.pciSlotNumber = "35" # 追記 pciPassthru1.msiEnabled = "FALSE" pciPassthru1.use64bitMMIO = "TRUE" svga.present = "FALSE" svga.autodetect = "TRUE" svga.guestBackedPrimaryAware = "TRUE" svga.vramSize = "16777216"
Ubuntu 側
- efifb を無効化：
sudo sed -i 's/^GRUB_CMDLINE_LINUX_DEFAULT=.*/GRUB_CMDLINE_LINUX_DEFAULT="quiet splash video=efifb:off"/' /etc/default/grub sudo update-grub
- KMS を無効化：
echo 'options nvidia-drm modeset=0' | sudo tee /etc/modprobe.d/nvidia-kms.conf sudo update-initramfs -u
- nvidia-persistenced は手動起動で十分（systemd enable 不要）
結果
まとめ
原因:
ワークアラウンド:
- VMX設定で svga.present = "FALSE", useVGA=FALSE, vBIOS指定
- efifb/KMS を無効化
- initramfs 更新して反映
Splunkでsysmonログを取ろうとしてハマった時
背景
- Splunkでsysmonログを取ろうとしてハマった
- ログはCIM化する
- その時にやったトラシューをメモに残す
indexer側
/opt/splunk/etc/system/local/inputs.conf
[http] disabled = false enableSSL = true [splunktcp://9997] index = main connection_host = ip
sudo ss -tuln | grep 9997
/opt/splunk/etc/deployment-apps/windows/local/inputs.conf
[WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = 1 index = main source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
/opt/splunk/etc/apps/Splunk_TA_microsoft_sysmon/local/props.conf
[xmlwineventlog] KV_MODE = xml AUTO_KV_JSON = false
Universal Forwarder側
Install時の注意点
- Domain Adminでログインしてインストールしたが、インスト時の設定ミスで権限問題にぶち当たった
- Local Adminでインストールする、などしておいたほうが無難っぽそう
- 検証用途なので、深く考えず以下を実行して切り抜けた
sc.exe config SplunkForwarder "obj=LocalSystem" "password=***"
C:\Program Files\SplunkUniversalForwarder\etc\system\local\outputs.conf
- たぶんこれはデフォルトのまま。
[tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = INDEXERのFQDN:9997 [tcpout-server://INDEXERのFQDN:9997]
C:\Program Files\SplunkUniversalForwarder\etc\system\local\server.conf
- たぶんこれはデフォルトのまま。
[general] serverName = SV01 pass4SymmKey = *** [sslConfig] sslPassword = *** [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder peers = * quota = MAX stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free peers = * quota = MAX stack_id = free
トラシューするときに役立つ諸々
C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.log
Test-NetConnection -ComputerName 192.168.11.211 -Port 9997
Get-Service | Where-Object { $_.Name -like "*splunk*" }
net stop splunkforwarder
net start splunkforwarder
Ref
SplunkのAPI通信のHTTPS化
構築環境
- Ubuntu 22.04.5 LTS - Splunk Enterprise 9.4.3
Install
sudo apt update && sudo apt upgrade -y sudo apt install wget dpkg sudo timedatectl set-timezone Asia/Tokyo timedatectl cd /tmp wget -O splunk-latest.deb 'https://download.splunk.com/products/splunk/releases/9.4.3/linux/splunk-9.4.3-237ebbd22314-linux-amd64.deb' sudo dpkg -i /tmp/splunk-latest.deb sudo /opt/splunk/bin/splunk start --accept-license sudo /opt/splunk/bin/splunk enable boot-start sudo /opt/splunk/bin/splunk restart sudo /opt/splunk/bin/splunk status sudo ss -ltnp | grep 8089
Get Cert
sudo apt install certbot sudo vi getcert.sh
#!/bin/bash # getcert.sh # "HOSTNAME"、"DOMAINNAME" は自分の環境に合わせて書き換え # ====== prep ====== export HOSTNAME_Token="***" DOMAIN="HOSTNAME.DOMAINNAME" SPLUNK_CERT_DIR="/opt/splunk/etc/auth" RELOAD_CMD="/opt/splunk/bin/splunk restart" # ====== acme.sh ====== curl https://get.acme.sh | sh source ~/.bashrc # ====== Get Cert by HOSTNAME DNS Auth ====== ~/.acme.sh/acme.sh --issue --dns dns_HOSTNAME -d "$DOMAIN" # ====== Put Cert into cert dir ====== ~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" \ --key-file "$SPLUNK_CERT_DIR/splunk-web.key" \ --fullchain-file "$SPLUNK_CERT_DIR/splunk-web.pem" \ --reloadcmd "$RELOAD_CMD"
sudo chmod +x getcert.sh ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt sudo ./getcert.sh sudo ls -l /opt/splunk/etc/auth/splunk-web.* ls -la /opt/splunk/etc/auth ls -la ~/.acme.sh/HOSTNAME.DOMAINNAME_ecc
Server Cert
cat /home/USERNAME/.acme.sh/HOSTNAME.DOMAINNAME_ecc/fullchain.cer \
/home/USERNAME/.acme.sh/HOSTNAME.DOMAINNAME_ecc/HOSTNAME.DOMAINNAME.key \
> /opt/splunk/etc/auth/splunk-combined.pem
Root CA
curl -s https://letsencrypt.org/certs/isrgrootx1.pem.txt -o /tmp/isrgrootx1.pem cat ~/.acme.sh/HOSTNAME.DOMAINNAME.org_ecc/ca.cer /tmp/isrgrootx1.pem | sudo tee /opt/splunk/etc/auth/cacert.pem > /dev/null chmod 600 /opt/splunk/etc/auth/cacert.pem chown USERNAME:USERNAME /opt/splunk/etc/auth/cacert.pem ls -la /opt/splunk/etc/auth/ openssl crl2pkcs7 -nocrl -certfile /opt/splunk/etc/auth/cacert.pem | openssl pkcs7 -print_certs -text -noout grep "BEGIN CERTIFICATE" /opt/splunk/etc/auth/cacert.pem -----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
Setup related config
vi /opt/splunk/etc/system/local/server.conf
[sslConfig] enableSplunkdSSL = true serverCert = /opt/splunk/etc/auth/splunk-combined.pem sslRootCAPath = /opt/splunk/etc/auth/cacert.pem cliVerifyServerName = false sslPassword = ***
Cert Update Automation
vi update-splunk-cert.sh
#!/bin/bash CERT_DIR="/opt/splunk/etc/auth" ACME_DIR="$HOME/.acme.sh/HOSTNAME.DOMAINNAME" RELOAD_CMD="/opt/splunk/bin/splunk restart" ROOT_CA_TMP="/tmp/isrgrootx1.pem" ~/.acme.sh/acme.sh --install-cert -d HOSTNAME.DOMAINNAME \ --key-file "$CERT_DIR/splunk-web.key" \ --fullchain-file "$CERT_DIR/splunk-web.pem" \ --ca-file "$CERT_DIR/cacert.pem.tmp" \ --reloadcmd "cat '$CERT_DIR/cacert.pem.tmp' '$ROOT_CA_TMP' > '$CERT_DIR/cacert.pem' && $RELOAD_CMD"
crontab -e
15 13 * * * "/home/USERNAME/.acme.sh"/acme.sh --cron --home "/home/USERNAME/.acme.sh" > /dev/null 30 3 1 * * /home/USERNAME/update-splunk-cert.sh >> /var/log/update-splunk-cert.log 2>&1
/opt/splunk/bin/splunk restart /opt/splunk/bin/splunk show kvstore-status
自分用メモ
- これらの設定に加えて、ARVA側でHostsの設定が必要だった。
getcert.sh FINAL EDITION
- 動作確認していないが、以下のスクリプトで、すこし楽ができるかも。
sudo vi getcert.sh
#!/bin/bash
set -e
# ====== prep ======
# "HOSTNAME"、"DOMAINNAME"、"USERNAME" は自分の環境に合わせて書き換え
export HOSTNAME_Token="***"
DOMAIN="HOSTNAME.DOMAINNAME"
USERNAME="USERNAME"
SPLUNK_CERT_DIR="/opt/splunk/etc/auth"
RELOAD_CMD="/opt/splunk/bin/splunk restart"
ROOT_CA_TMP="/tmp/isrgrootx1.pem"
SERVER_CONF="/opt/splunk/etc/system/local/server.conf"
# ====== acme.sh install ======
if [ ! -d "$HOME/.acme.sh" ]; then
curl https://get.acme.sh | sh
source ~/.bashrc
fi
# ====== use Let's Encrypt CA ======
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
# ====== DNS Auth Cert Issue ======
~/.acme.sh/acme.sh --issue --dns dns_HOSTNAME -d "$DOMAIN"
# ====== Install certs ======
~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" \
--key-file "$SPLUNK_CERT_DIR/splunk-web.key" \
--fullchain-file "$SPLUNK_CERT_DIR/splunk-web.pem" \
--reloadcmd "$RELOAD_CMD"
# ====== Create splunk-combined.pem ======
cat "$HOME/.acme.sh/${DOMAIN}_ecc/fullchain.cer" \
"$HOME/.acme.sh/${DOMAIN}_ecc/${DOMAIN}.key" \
> "$SPLUNK_CERT_DIR/splunk-combined.pem"
chmod 600 "$SPLUNK_CERT_DIR/splunk-combined.pem"
chown "$USERNAME:$USERNAME" "$SPLUNK_CERT_DIR/splunk-combined.pem"
# ====== Create cacert.pem with ISRG Root ======
curl -s https://letsencrypt.org/certs/isrgrootx1.pem.txt -o "$ROOT_CA_TMP"
cat "$HOME/.acme.sh/${DOMAIN}_ecc/ca.cer" "$ROOT_CA_TMP" \
| sudo tee "$SPLUNK_CERT_DIR/cacert.pem" > /dev/null
chmod 600 "$SPLUNK_CERT_DIR/cacert.pem"
chown "$USERNAME:$USERNAME" "$SPLUNK_CERT_DIR/cacert.pem"
# ====== Update server.conf ======
sudo tee "$SERVER_CONF" > /dev/null <<EOF
[sslConfig]
enableSplunkdSSL = true
serverCert = $SPLUNK_CERT_DIR/splunk-combined.pem
sslRootCAPath = $SPLUNK_CERT_DIR/cacert.pem
cliVerifyServerName = false
EOF
# ====== Done ======
echo "Certificate installation and Splunk configuration completed."
---
sudo chmod +x getcert.sh sudo ./getcert.sh
Ref
MITRE CALDERA on Raspberry pi
起動方法
cd caldera python3 -m venv venv source venv/bin/activate python3 server.py --insecure --build
アクセス方法
http://localhost:8888/
Username: red Password: admin
破壊方法
deactivate rm -rf caldera/
使い方
サイバーセキュリティ・フレームワーク「MITRE CALDERA」紹介、機能概要・動作環境構築編 #Python - Qiita
本体インストール方法
MITRE CALDERA v5.0.0 インストール手順 #Security - Qiita
# 1) Install git, python, pip, npm sudo apt update && sudo apt upgrade -y && sudo apt install python3-venv npm git -y # 2) Update Node & NPM (※Kaliの場合は手順が異なる;以降参照) curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash source ~/.bashrc nvm install stable # 3) Download Caldera git clone https://github.com/mitre/caldera.git --recursive # 4) Create environment & activate cd caldera python3 -m venv venv source venv/bin/activate # 5) Install requirements pip install -r requirements.txt # 6) Install Go & add to path (※ラズパイの場合はarm64指定) wget https://go.dev/dl/go1.22.0.linux-amd64.tar.gz && sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.22.0.linux-amd64.tar.gz && export PATH=$PATH:/usr/local/go/bin go version # 7) Run caldera python3 server.py --insecure --build
ラズパイの場合
wget https://go.dev/dl/go1.22.0.linux-amd64.tar.gz && sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.22.0.linux-amd64.tar.gz && export PATH=$PATH:/usr/local/go/bin
↓
wget https://go.dev/dl/go1.23.5.linux-arm64.tar.gz && sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.23.5.linux-arm64.tar.gz && export PATH=$PATH:/usr/local/go/bin
nvmインストール時の注意点（Kali Linux）
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/master/install.sh | bash echo 'export NVM_DIR="$HOME/.nvm" [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion" # This loads nvm bash_completion' >> ~/.zshrc source ~/.zshrc
emuプラグインインストール方法
confファイルに追記
┌──(kali㉿kali-raspberrypi)-[~]
└─$ cd /caldera/conf
┌──(kali㉿kali-raspberrypi)-[~/caldera/conf]
└─$ sudo vi default.yml
# 中略
plugins:
- access
- atomic
- compass
- debrief
- emu # 追記
- fieldmanual
- manx
- response
- sandcat
- stockpile
- training
Additional setup
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/plugins/emu]
└─$ sudo apt-get install zlib1g
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/plugins/emu]
└─$ pip3 install -r requirements.txt
Caldera起動後に再停止してペイロード追加ダウンロード
一度、ここまでの段階で、Calderaを起動して、emuがロードされて、ペイロード不足のWARNINGが出ることを確認する。そのうえで、再度Calderaを停止して以下の手順を実行する。
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/plugins/emu]
└─$ cd /caldera/plugins/emu
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/plugins/emu]
└─$ ./download_payloads.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 856k 100 856k 0 0 3560 0 0:04:06 0:04:06 --:--:-- 5441
ダウンロード中
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/plugins/emu]
└─$ ./download_payloads.sh
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 856k 100 856k 0 0 3560 0 0:04:06 0:04:06 --:--:-- 5441
Archive: payloads/AdFind.zip
inflating: payloads/adcsv.pl
[payloads/AdFind.zip] AdFind.exe password:
# パスワードは入力せずに、そのままEnter押下[*1]と指示する記事もあるが、```NotMalware```を入力した。
skipping: AdFind.exe incorrect password
extracting: payloads/password.txt
cp: cannot stat 'payloads/AdFind.exe': No such file or directory
Archive: payloads/NetSess.zip
inflating: payloads/NetSess.exe
Archive: payloads/wce_v1_41beta_universal.zip
inflating: payloads/Changelog
inflating: payloads/LICENSE.txt
inflating: payloads/README
inflating: payloads/wce.exe
Archive: payloads/PSTools.zip
inflating: payloads/PSTools/psfile.exe
inflating: payloads/PSTools/psfile64.exe
inflating: payloads/PSTools/pskill.exe
inflating: payloads/PSTools/pskill64.exe
inflating: payloads/PSTools/pslist.exe
inflating: payloads/PSTools/pslist64.exe
inflating: payloads/PSTools/PsLoggedon.exe
inflating: payloads/PSTools/PsLoggedon64.exe
inflating: payloads/PSTools/PsService.exe
inflating: payloads/PSTools/PsService64.exe
inflating: payloads/PSTools/pssuspend.exe
inflating: payloads/PSTools/pssuspend64.exe
inflating: payloads/PSTools/psping.exe
inflating: payloads/PSTools/psping64.exe
inflating: payloads/PSTools/PsInfo.exe
inflating: payloads/PSTools/PsInfo64.exe
inflating: payloads/PSTools/pspasswd.exe
inflating: payloads/PSTools/pspasswd64.exe
inflating: payloads/PSTools/PsGetsid.exe
inflating: payloads/PSTools/PsGetsid64.exe
inflating: payloads/PSTools/psloglist.exe
inflating: payloads/PSTools/psloglist64.exe
inflating: payloads/PSTools/psshutdown.exe
inflating: payloads/PSTools/psshutdown64.exe
inflating: payloads/PSTools/PsExec.exe
inflating: payloads/PSTools/PsExec64.exe
inflating: payloads/PSTools/psversion.txt
inflating: payloads/PSTools/Pstools.chm
inflating: payloads/PSTools/Eula.txt
PsExec64.exe v2.4 copied to Turla payloads directory
Pscp.exe copied to Turla payloads directory
Plink.exe copied to Turla payloads directory
*1: AdFind.zip from payloads requires a password · Issue #41 · mitre/emu · GitHub
再起動すると...
2025-01-22 15:12:35 INFO VueJS front-end build complete. server.py:276
ERROR go does not meet the minimum version of 1.19 app_svc.py:188
2025-01-22 15:14:05 ERROR [-] Error - Unable to import 'pyminizip'. emu_svc.py:96
ERROR [-] Verify you have installed dependencies: emu_svc.py:96
ERROR [-] See URL for more info: https://github.com/smihica/pyminizip emu_svc.py:96
ERROR None emu_svc.py:101
ERROR Error enabling plugin=emu, Command '['/home/kali/caldera/venv/bin/python3', c_plugin.py:70
'plugins/emu/data/adversary-emulation-plans/oilrig/Resources/utilities/crypt_executables.py', '-i',
'plugins/emu/data/adversary-emulation-plans/oilrig/Resources', '-p', 'malware', '--decrypt']' returned non-zero exit status 255.
ERROR Error importing plugin=builder, No module named 'docker' c_plugin.py:91
ERROR Error loading plugin=builder, 'NoneType' object has no attribute 'description' c_plugin.py:59
エラー解決のためにやったこと
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ wget https://go.dev/dl/go1.23.5.linux-arm64.tar.gz && sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.23.5.linux-arm64.tar.gz && export PATH=$PATH:/usr/local/go/bin
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ go version
go version go1.23.5 linux/arm64
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ sudo apt-get install build-essential python3-dev
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ pip install pyminizip
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ pip install docker
donut関連のWARNING解決のために実施したこと
WARNING Unable to properly load .donut for payload plugins.stockpile.app.donut.donut_handler due to failed import
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ pip install donut-shellcode
# これは失敗した
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ sudo apt-get update
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ sudo apt-get install build-essential python3-dev
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ git clone https://github.com/TheWover/donut.git
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/donut]
└─$ pip install setuptools
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera]
└─$ cd donut
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/donut]
└─$ python3 setup.py install
# これも失敗した。ARM64アーキテクチャには対応していない模様
┌──(venv)─(kali㉿kali-raspberrypi)-[~/caldera/donut]
└─$ pip install pycryptodome
# これでなぜかWARNINGは消えた。
その他のペイロードの補完
cd ~/caldera/plugins/emu/payloads wget ttps://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/***.exe cp /home/kali/caldera/plugins/emu/payloads/***.exe /home/kali/caldera/plugins/emu/data/adversary-emulation-plans/ mv /home/kali/caldera/plugins/emu/data/adversary-emulation-plans/***.exe /home/kali/caldera/plugins/emu/data/adversary-emulation-plans/***.exe # 最後のコマンドは、大文字Rを小文字rに変えている。 # Rubeus以外は諦めて空ファイルを作った... touch dumpWebBrowserCreds.exe touch m64.exe touch ryuk.exe
とりあえず最終形
まだWARNINGが残っているが、とりあえずこれで使ってみることにした
emu plugin
APT29やmenu_passなどが追加された。
cd /home/kali/caldera/plugins/emu/data/adversary-emulation-plans ls -la total 556 drwxrwxr-x 18 kali kali 4096 Jan 22 16:51 . drwxrwxr-x 7 kali kali 4096 Jan 22 16:55 .. drwxrwxr-x 6 kali kali 4096 Jan 22 15:13 apt29 drwxrwxr-x 6 kali kali 4096 Jan 22 15:13 blind_eagle drwxrwxr-x 7 kali kali 4096 Jan 22 15:13 carbanak -rw-rw-r-- 1 kali kali 1845 Jan 22 15:13 CONTRIBUTING.md drwxrwxr-x 4 kali kali 4096 Jan 22 15:13 fin6 drwxrwxr-x 7 kali kali 4096 Jan 22 15:13 fin7 drwxrwxr-x 8 kali kali 4096 Jan 22 15:14 .git drwxrwxr-x 4 kali kali 4096 Jan 22 15:13 .github -rw-rw-r-- 1 kali kali 432 Jan 22 15:13 .gitignore -rw-rw-r-- 1 kali kali 11357 Jan 22 15:13 LICENSE drwxrwxr-x 4 kali kali 4096 Jan 22 15:13 menu_pass drwxrwxr-x 4 kali kali 4096 Jan 22 15:13 micro_emulation_plans drwxrwxr-x 8 kali kali 4096 Jan 22 15:13 ocean_lotus drwxrwxr-x 9 kali kali 4096 Jan 22 15:13 oilrig -rw-rw-r-- 1 kali kali 22719 Jan 22 15:13 README.md drwxrwxr-x 2 kali kali 4096 Jan 22 15:13 resources -rw-rw-r-- 1 kali kali 446976 Jan 22 16:46 rubeus.exe drwxrwxr-x 8 kali kali 4096 Jan 22 15:13 sandworm drwxrwxr-x 2 kali kali 4096 Jan 22 15:13 structure drwxrwxr-x 8 kali kali 4096 Jan 22 15:13 turla drwxrwxr-x 8 kali kali 4096 Jan 22 15:14 wizard_spider
ラズパイでT-POTを植える
環境
- Raspberry pi 4B
- Raspberry pi OS 64bit Lite
- 有線LANを使って接続
OS設定
- 最初、有線LANがDisconnect状態で起動してくる
- NetworkManagerで管理されているので、以下のように設定
nmcli connection show nmcli connection up filename lo Wired\ connection\ 1 help path id uuid nmcli connection up Wired\ connection\ 1 # eth0で指定すると弾かれた。 # また、Wired connection 1というように、show結果を手打ちで入力しても弾かれた。 # Tab補完すると、エスケープされていた。罠。 nmcli connection modify Wired\ connection\ 1 ipv4.addresses ****/24 nmcli connection modify Wired\ connection\ 1 ipv4.gateway **** nmcli connection modify Wired\ connection\ 1 ipv4.dns 8.8.8.8 nmcli connection modify Wired\ connection\ 1 ipv4.method manual nmcli connection modify Wired\ connection\ 1 connection.autoconnect yes nmcli connection down Wired\ connection\ 1 nmcli connection up Wired\ connection\ 1 nmcli device status cd /etc/NetworkManager/system-connections/ ls -la total 12 drwxr-xr-x 2 root root 4096 Jan 3 18:57 . drwxr-xr-x 7 root root 4096 Nov 19 22:33 .. -rw------- 1 root root 288 Jan 3 18:57 'Wired connection 1.nmconnection'
ラズパイ上のKaliで有線LANのみ使いたいとき
Linuxのネットワーク管理の仕組み
Netplan
- 機能: systemd-networkdまたはNetworkManagerのいずれかをバックエンドとして選択可能。
- 設定ファイル: YAML形式で設定を記述し、/etc/netplan/ディレクトリ内に配置される
systemd-networkd
- 概要: systemdの一部として提供される軽量なネットワーク管理デーモン。
- 設定ファイル: /etc/systemd/network/ディレクトリに配置される。
- 用途: サーバーや組み込みシステムなど、リソースが限られた環境での使用が推奨される。
NetworkManager
- 概要: GUIとCLIの両方から操作可能で、ユーザーフレンドリー。
- 設定ファイル: /etc/NetworkManager/ディレクトリに配置される。
- 用途: デスクトップ環境やラップトップでの使用が一般的。
そもそも
素直にGUI上に有線LANの設定が表示されてくれば問題なかった。 表示されてこないので、以下のような設定を行った。
sudo rm /etc/netplan/*.yaml sudo vi /etc/systemd/network/eth0.network [Match] Name=eth0 [Network] Address=******/24 Gateway=*****.254 DNS=8.8.8.8 sudo systemctl restart systemd-networkd sudo ip addr flush dev eth0 sudo ifdown eth0 && sudo ifup eth0 sudo systemctl stop NetworkManager sudo systemctl disable NetworkManager sudo reboot # 名前解決がうまくいかなかったので追記 echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf sudo systemctl stop dhcpcd sudo systemctl disable dhcpcd systemctl status systemd-networkd sudo systemctl enable --now systemd-networkd sudo apt install systemd-resolved sudo systemctl enable --now systemd-resolved sudo ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf sudo systemctl restart systemd-networkd
