Vault Server#

1.创建用户#

其实不创建应该也可以，不过创建了可以省很多步骤 这里的用户名可以自定义，记得后面的操作都把用户名改掉

1
sudo useradd -r -s /usr/sbin/nologin -d /opt/hexvault -M hexvault

把压缩包文件全部放到/opt/hexvault 注意：/opt/hexvault文件夹及其子文件夹和子文件，所有者都必须是hexvault，否则服务器可能初始化不了

2.修改配置文件#

修改hexvault.conf中Data Source为hexvault用户的工作目录修改teams_server.hexlic vault_server.crt vault_server.key hexvault.conf 的权限为640

1
chmod 640 teams_server.hexlic
2
chmod 640 vault_server.*
3
chmod 640 hexvault.conf

3.创建数据库#

1
sudo -u hexvault ./vault_server --config-file hexvault.conf --vault-dir ./files --recreate-schema

4.测试服务器#

1
sudo -u hexvault ./vault_server --config-file hexvault.conf \
2
  --certchain-file vault_server.crt --privkey-file vault_server.key \
3
  --license-file teams_server.hexlic --vault-dir ./files

5.添加服务#

修改hexvault.service为自己的配置，参考：

1
# Place this file in /lib/systemd/system/
2

3
[Unit]
4
Description=Hex-Rays vault daemon
5

6
[Service]
7
Type=simple
8
Environment=INSTALL_PATH=/opt/hexvault
9
ExecStart=/opt/hexvault/vault_server -f ${INSTALL_PATH}/hexvault.conf -l ${INSTALL_PATH}/logs/vault_server.log -c ${INSTALL_PATH}/hexvault.crt -k ${INSTALL_PATH}/hexvault.key -L ${INSTALL_PATH}/hexvault.lic -d ${INSTALL_PATH}/files
10
User=hexvault
11

12
[Install]
13
WantedBy=multi-user.target

添加到系统服务并启动

1
sudo cp hexvault.service /etc/systemd/system/
2
sudo systemctl enable hexvault.service
3
sudo systemctl start hexvault.service

Vault Client#

Client默认是开启TLS的，使用crack包里自带的证书始终无法连接，自己生成的证书也无法连接，索性直接干掉client的TLS校验 hv和hvui即为Vault的Client，两者的校验相同，可以用相同方式去掉借助字符串可以找到校验位置把invalid_remote_certificate和expired_remote_certificate 的路径全部patch掉，patch掉即可连接第一个登入服务器的人会被设置为管理员

Lumina Server#

1.创建用户#

1
sudo useradd -r -s /usr/sbin/nologin -d /opt/lumina -M lumina

把压缩包文件全部放到/opt/lumina 注意：/opt/lumina文件夹及其子文件夹和子文件，所有者都必须是lumina，否则服务器可能初始化不了

2.初始化SQL数据库#

mysql和mariadb都可

1
>sudo mysql -uroot -p
2
[sudo] password for aundro:
3
Enter password:
4
Welcome to the MySQL monitor.  Commands end with ; or \g.
5
Your MySQL connection id is 14306
6
Server version: 10.1.48-MySQL-0+deb9u2 Debian 9.13
7

8
Copyright (c) 2000, 2018, Oracle, MySQL Corporation Ab and others.
9

10
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
11

12
MySQL [(none)]> create user lumina@localhost;
13
Query OK, 0 rows affected (0.00 sec)
14

15
MySQL [(none)]> set password for lumina@localhost = PASSWORD('<snipped>');
16
Query OK, 0 rows affected (0.00 sec)
17

18
MySQL [(none)]> grant all on *.* to lumina@localhost;
19
Query OK, 0 rows affected (0.00 sec)
20

21
MySQL [(none)]> ALTER USER lumina@localhost IDENTIFIED WITH mysql_native_password BY '<snipped>';
22
Query OK, 0 rows affected (0.00 sec)
23

24
MySQL [(none)]> create database lumina;
25
Query OK, 1 row affected (0.00 sec)
26

27
MySQL [(none)]> [Ctrl+C] Bye

MySQL [(none)]> set password for lumina@localhost = PASSWORD('<snipped>'); 这一步，如果是高版本mysql或者mariadb则要改为 ALTER USER 'lumina'@'127.0.0.1' IDENTIFIED BY '<snipped>';

3.修改配置文件#

需要把lumina.conf 中的数据库配置改为第二步中设置的如果要使用vault进行身份验证，则需要指定vault服务地址

1
VAULT_HOST="192.168.10.139:65433"

修改lumina_server.hexlic lumina_server.crt lumina_server.key lumina.conf 的权限为640

1
chmod 640 lumina_server.hexlic
2
chmod 640 lumina_server.*
3
chmod 640 lumina.conf

4.创建数据库#

1
sudo -u lumina ./lumina_server --config-file lumina.conf \
2
                                --certchain-file lumina_server.crt \
3
                                --privkey-file lumina_server.key \
4
                                --recreate-schema lumina

recreate-schema 指定的是身份校验模式，可以选择 lumina 和 vault 如果选择 vault 还需要对lumina 服务器进行patch，详见 Lumina和Vault的连接问题

5.测试服务器#

1
sudo -u lumina ./lumina_server --config-file lumina.conf \
2
                      --certchain-file lumina_server.crt \
3
                      --privkey-file lumina_server.key

6.添加服务#

修改hexvault.service为自己的配置，参考：

1
# This is an example systemd service definition for a default installation.
2
# Edit this file and copy it to /etc/systemd/system/lumina.service, then handle
3
# it as any systemd service.
4

5
[Unit]
6
Description=Lumina daemon
7
Wants=network-online.target
8
After=network-online.target
9
After=mysql.service
10
After=mariadb.service
11

12
[Service]
13
Type=simple
14
ExecStart=/opt/lumina/lumina_server -f /opt/lumina/lumina.conf -p 65433 -D /opt/lumina/badreqs -l /opt/lumina/logs/lumina_server.log -c /opt/lumina/lumina_server.crt -k /opt/lumina/lumina_server.key -p 4430
15
User=lumina
16

17
[Install]
18
WantedBy=multi-user.target

添加到系统服务并启动

1
sudo cp lumina.service /etc/systemd/system/
2
sudo systemctl enable lumina.service
3
sudo systemctl start lumina.service

Lumina Client#

Lumina Client是内置在ida中的，在任务栏可以看到在 Optons->General->Lumina 可以设置Lumina服务器地址和登录账户 Lumina Client同样存在TLS校验，同样patch去除同样借助字符串定位到校验位置把invalid_remote_certificate和expired_remote_certificate 的路径全部patch掉