2009-03-24 22:15:18

Installing hping3 On OSX

Most people know that OSX is just BSD with a pretty interface. Technically... I say that because you can't just take normal BSD packages and expect them to work on OSX. There's a little bit of porting that needs to be done (less so now that Macs are Intel based).
So what does this have to do with anything? I own a Macbook Pro and decided that there is no reason this couldn't be my all-purpose security host, since it can, in fact, run all (most) standard *nix programs. I got some of the usual utilities using FinkCommander, which is just a GUI for Fink, a package management system for *nix programs.
Fink, however, didn't have hping3. A search told me that hping3 could be gotten through DarwinPorts. Awesome, right? A version of the ports system for OSX (BSD users will remember ports). Here is where the fun starts.
Grab the DMG of DarwinPorts, mount it, and install the package. The instructions tell you that all you have to do is run:
and DarwinPorts will automatically update itself and you'll be good to go. WRONG! You'd think that you could find something for DarwinPorts in your Applications folder. WRONG! Ok, maybe it's in the normal *nix locations like /bin, /usr/bin, or /usr/local/bin. WRONG! So what gives?
Today's lesson will be in examining an OSX package (.pkg file). Just like applications, packages are also directories. My goal was to find where this package installed DarwinPorts to. So my first step was to go check out what's inside the package.
If you didn't know, when you double click a DMG file a disk image gets mounted to /Volumes (exactly like what happens when you insert a USB drive, except DMGs are read-only). So after getting inside the Contents folder of the package I'm struck by the size of one file in particular. Archive.pax.gz is 348K, much larger than any other file. I'm going to guess that is where the program is contained.
Now we need extract the contents of that file. Since the current volume is read-only, let's copy it to the Desktop and see what's inside.
What did I just do? After copying the file to my desktop I used `gunzip` to decompress Archive.pax. But what kind of file is a PAX file? I asked. Using the `file` command I learned that it was a CPIO file (a close relative of TAR). I then used the `cpio` utility to restore files from the archive (-i) and keep the modification times on those files (-m).
Low and behold, we have an "opt" directory. Let's see what's inside.
There it is, the `port` program. According to how it was unpacked, I should be able to find this utility on my local system under /opt/local/bin. Let's see.
Voila! We've found it! But we still have a tiny problem; we can't execute this program in a terminal like they say in the DarwinPorts instructions because /opt/local/bin isn't in our shell's path. I'm using tcsh, so all I had to do was edit my .cshrc and re-read it.
As you can see, I already had to add /sw/bin to my path to enable programs installed with Fink to work and now /opt/local/bin is there. I then re-read my configuration with the `source` command and look at that, `port` is found.
So let's continue with the DarwinPorts instructions and update it.
Ok, so it seemed that we already had the latest version as noted by the first to last line. Now let's get to what we really wanted to do, install hping3.
Sigh. hping3 was successfully installed, but after rehashing it can't be found. It appears that it's in yet ANOTHER location that is not in my path. `port` was located in /opt/local/bin, so let's start there.
THERE IT IS! It's not in /opt/local/bin, it's in /opt/local/sbin. Fine; one more edit to my path.
Success!
Wow, that took forever. At least we learned a lot in the process: PKG files are actually directories, where DMG files are mounted, using the cpio program, editing your shell's path, etc. At the end of the day, your Mac is one step closer to being your go-to security host.

Back

6 comments

Post a comment!

Name:
Comment: