TryHackMe on QubesOS Kali AppVM

unman has provided templates for Kali-enthusiasts to QubesOS (v. 4.1 only) and you need to enable the repository in /etc/qubes/repo-templates/qubes-templates.repo. The mentioned command using “enable-repo …” mentioned in the forum did not work for me, so I had to edit the 1 directly in the file 🙂

Edit the repo-file:

Install the template:

Then I created an AppVM based on the Kali template and vupti, everything works perfectly.

That is except for reverse shell 🙂

I had an issue with reverse shell’s not working on Qubes Kali AppVM, due to firewall restrictions even though I disabled the firewall following these instructions(Spoiler:NOT working in Qubes AppVM).

I got no SYN-ACK to my SYN’s, and with the firewall “disabled” I tried searching elsewhere for answers. It turned out that disabling the local firewall in Kali is not enough and I am afraid to mess up security by following the guides incorrectly.

To resolve the issue, clean out the firewall rules on the local AppVM (or template VM for persistance):

└─# iptables -P INPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

└─# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         


This can be done in a more optimal way opening up only for the specific endpoints/IP-range’s from TryHackMe, but this just gets your reverse shells working right now.

The other, safer way, that works (if there is no inbound firewall on target host), is to change the payload in metasploit from reverse_tcp to bind_tcp with a sample:

set PAYLOAD payload/linux/x86/meterpreter/bind_tcp


Qubes 4.1rc3 on Intel NUC10i7FNK

BXNUCi7FNK2 with 1TB NVMe, 64GB memory and 4K monitor support

I did this once before on Qubes 4.0 with help From Frédéric Pierret, but left Qubes on my NUC for Xubuntu due to too many issues with hardware. Intel NUC is not overly Linux friendly friendly. Microsoft is their primary focus.

Then today(of all days) I snuck an install of the promising Qubes 4.1rc3 on the box, and if started with a single error during final install [Start failed: internal error: Unable to reset PCI device 0000:00:1f.6: no FLR, PM reset or bus reset available, see /var/log/libvirt/libxl/libxl-driver.log for details”:

No networking was available upon startup. Disabling the PCI device in question [00:1f.6 Ethernet Controller….] in sys-net, made booting of sys-net possible and luckily wifi worked out-of-the-box.

Hope the above solution might help others in same situation.

Hardening websites with .htaccess

Always use latest php available from your hosting provider:

AddType application/x-httpd-php-latest .php

Using mod_rewrite:

<IfModule mod_rewrite.c>

RewriteEngine On

#Redirect HTTP to HTTPS:
RewriteCond %{HTTPS} off

RewriteRule (.) https://%{HTTP_HOST}%{REQUEST_URI}

#Disable compression:

RewriteRule ^(.)$ $1 [NS,E=no-gzip:1,E=dont-vary:1]


Strict HSTS, CSP, XSFR headers:

<IfModule mod_headers.c>

Header set Content-Security-Policy "upgrade-insecure-requests"

Header set Referrer-Policy "strict-origin-when-cross-origin"

Header set Strict-Transport-Security "max-age=15811200"

Header set X-Frame-Options "DENY"


Xubuntu and KeePassXC with no browserintegration (snap crap)

Having trouble connecting from browser on a freshly installed Xubuntu. My browser extensions in Firefox acted up. All because of snap is crap (in this regard anyways)

KeePassXC when installed in Xubuntu, uses “snap” and therefore the browser integration does not work. It has to go.

Remove the snap
Install the real thing. (Either by PPA for newest versions or normally with standard repositories.
The browser selection window is not visible in the snap version… but they are here. Enjoy.

Skype for Linux – unsigned – breaking template updates

Package skypeforlinux_8.62.0.83-1.x86_64.rpm is not signed

My daily patching of my Qubes fedora-32 template failed, and I just found our that Skype might be the reason. I tried starting skype, and found it to be requiring of an update:

Update, pretty please…

This proved faulty, since Microsoft might have given up on Skype, their last update was unsigned and broke updates on one of my fedora-32 templates.

Has the trainee Linux enthusiast been responsible for the full delivery?

Then I tried forcing the install, since I trusted the package origin, but I saw that the quality of the package might be below par(it does work, though), so I chose to part with Skype for now:

Updating / installing…
1:skypeforlinux- ################################# [100%]
Redirecting to /bin/systemctl start atd.service
Failed to start atd.service: Unit atd.service not found.

Goodbye Skype. Maybe we will meet again some day out of nostalgia alone.

Remember to remove the repo also, if you really mean it 🙂


CCSP/SSCP cram link recommendation:

CCSP SP 800-145, The NIST Definition of Cloud Computing | CSRCNIST Cloud Computing Standards Roadmap – NIST.SP.500-291r2.pdfThe NIST definition of cloud computing – nistspecialpublication800-145.pdfNIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization | NISTGuidelines for Media Sanitization – NIST.SP.800-88r1.pdfSP 800-37 Rev. 2, RMF: A System Life Cycle Approach for Security and Privacy | CSRCSTAR | Cloud Security AllianceTop Threats to Cloud Computing: Egregious | Cloud Security AllianceCloud Controls Matrix | Cloud Security AllianceThe_Notorious_Nine_Cloud_Computing_Top_Threats_in_2013.pdfTreacherous-12_Cloud-Computing_Top-Threats.pdfWiley Test BanksOWASP Top 10 – 2017 – OWASP_Top_10-2017_(en).pdf.pdfCybraryHome | Cloud Security AllianceImmersive | CybraryStudy resourcesBusiness Impact Analysis WorksheetMicrosoft Threat Modeling Tool overview – Azure | Microsoft DocsDesktop as a Service (DaaS) – Cloud Desktop | CalligoData Leak PreventionTrike | octotrike.orgcloud-computing-benefits-risks-and-recommendations-for-information-securityOWASP Top Ten Web Application Security Risks | OWASP

SSCP SSCP Cert Prep: The Basics SSCP Cert Prep: 1 Access Controls SSCP Cert Prep: 2 Security Operations and Administration SSCP Cert Prep: 4 Incident Response and Recovery SSCP Cert Prep: 3 Risk Identification, Monitoring, and Analysis SSCP Cert Prep: 5 Cryptography SSCP Cert Prep: 6 Networks and Communications Security SSCP Cert Prep: 7 Systems and Application Security AES Crypt – GUI (Linux 64-bit)

KeePassXC risk analysis based setup on fedora-30

Goal: If a new security vulnerability is found in KeePassXC(eg. 0-day), I would like to ensure the fastest possible update, risking the possibility of not being able to use the application.

By updating from an unstable repository, this can, of course, also introduce vulnerabilities, that has just not been detected yet.

I have decided to rather patch known vulnerabilities, using software with potential unknown vulnerabilities, rather than having unpatched known vulnerabilities. That is basically my risk analysis.

Also, if the application fails and is unusable, it might still be better using “forgot password” features, than using a piece of known insecure software. Depends on who you are, and what level you are comfortable with. Every decision needs to be risk based and subjective to the risk taker.

So, lets solely, enable KeePassXC packages, getting updates from a more unstable branch. Put this in your fedora-30 /etc/yum.repos.d/fedora-updates-testing.repo end of first paragraph:

adding “includepkgs=keepassxc”

This should be called the frog/rabbit method, since we are litterally jumping ahead of ourselves, just as the remark from Quentin Tarantino in “Four Rooms” movie, states.

And I need ALL testing packages, that actually works, ending up in stable. That’s a premise.

UPDATE: As Samuel Sieb described, it is important to have “–disableexcludes” on the commandline, every time you need to update a package from the testing repository. I just experienced, I could not update the 0-day emergency patch from mozilla to firefox, due to this.

SOLUTION: [user@fedora-30 yum.repos.d]$ sudo dnf upgrade –enablerepo=updates-testing –disableexcludes=updates-testing –advisory=FEDORA-2020-2713adc57f

KeepassXC 2.4.2 on fedora-30

UPDATE: 2.4.2 is in stable now, so this post is not needed anymore…

When QubesOS announced that fedora-30 now is supported by Qubes-OS, I went for it straight away and upgraded my fedora-29 template. All went smooth.

My fedora-web-plugin, told me that my keepassxc was outdated and I needed to download a newer version:

So, checking the versions in fedora showed that fedora-30 is not up to date, unlike fedora-31, so I needed to do an upgrade in testing. Testing was in “3 karma”, whatever that means, but it seemed to be tested fine, just not pushed to stable repository yet. :

So, instead of just downloading the package from and miss any updates coming in the future, I decided to install from testing repository, and hope that the package will be sent to stable in the near future. I accept the risk that seems to be close non-existing, compared to trusting the stable/testing repo:

sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2019-99e252df7a
Do this in your qubes template, if the above install and usage of the app is successful. If you’re paranoid, you can test in a small appvm with network capture on, etc. 🙂

The above shows success and the version is as follows on fedora-30:

Enjoy your 2.4.2

And by the way, I actually got appreciation for my patreon support :). Please support it

Less than 10 days later we had the same issue, so contemplating on how it is possible to have 1 package using the “updates-testing” repository and the rest run stable (without having the below running in a cron job)

sudo dnf upgrade --enablerepo=updates-testing keepassxc

Windows 10 on Qubes OS 4.0

Sharing my experiences, installing Windows 10 Enterprise on Qubes 4.0, maybe spiced up with the infamous QWT(Qubes Windows Tools installation(Spoiler alert: NOT Working!).

Following this guide, I will try to describe the issues I’ve been encountering accompanied with screenshots. The big issue is getting the Qubes Windows tools to install properly. All my installations have failed, so even though Invisible Things Lab has worked on QWT tirelessly for years, corporate clients, understandably, is more important than a few backers and the community. The backers are apparently not contributing enough, although I might believe that backer numbers would go through the roof, if the tools would work, flawlessly on windows 10. If you want to contribute to Qubes OS, please donate either once or continuously here. And if you have the skills and tools to make QWT v., then please create an indiegogo(or similar) crowdfunding campaign. I’m sure it will be backed.

But, let’s go and take som challenges. The first one is that fedora doesn’t support exFAT (crazy as it sounds, and I wrote about this before here), and debian does. That means I have to use a debian appVM to share the ISO file to the new Windows 10 VM. unless, there is another way.

mounting usb with my debian
We begin with creating the VM and starting it with the ISO attached
Here is via the qubes manager, browsing to the usb iso, in the VM settings tab. Actually the “block device” option seems neat, too. Very neat, indeed.
It takes quite a while to get this screen, depending on the circumstances of hardware and drivers. Be patient…
Goes without saying
Select here what your license key matches or continue with your favorite flavor if on a company network with a KMS setup.
Don’t use pirated software. It’s highly likely to be infected with malware.
Fresh install is #2
Select the disc you have created at first
Wait for the copy of windows install files
Almost there…
After reboot, the install continues.
As a danish person, using a completely messed up laptop, keyboardwise, I need more than 1 keyboard layout)
And the magic continues
and continues
Change the video and timeout settings, before booting again.
If not using a cloud account(who would want that?, type in stuff, that does not exist, to get the other option
Click on “set up Windows with a local account”
Type a password
and confirm it
Annoying waste of time.
answer annoying questions
do it again
and why can’t you select “none” ?
I need to craete an unattended install.
Enough with the annoyances, already
Now, thing look promising
tadaaa, now we have a bare system with no updates and no QWT. Shut down and clone.
Install updates and activate windows! I had to download some updates manually and choose troubleshoot updates, since errors occurred. I really admire Microsoft on the troubles of updating their systems. I bet, with the Microsoft “contribution” to open source, the problems will start emerging in the linux community over time, also.
always adjust for performance on VM’s. Recommended settings are here
pagefile adjustments per instructions.
After installing all updates, reboot and clone the machine. Then we will be ready for Qubes Crash Tools for Windows.

So, due to the crash of windows 10 after installation of Qubes Windows Tools, it is recommended that you use freerdp, rdesktop or similar to connect to your Windows system, being able to copy/paste clipboard and files, etc. This is a workaround to use clipboard and filesharing, still.

Start the Windows appVM with the QWT for installation.
Doubleclick on it…
Accept the license
Allow chang
Everything but the troublesome selections are to be installed. That is the default settin
The install also demands the install of .NET framework.
The setup requires a restart, and after a restart everything works for a brief moment until next restart.

When the restart is performed, Qubes does a bunch of things, such as moving the user directory from C: to the newly created private drive of 2GB(E:). That fails horribly, btw:

So after installing qubes tools, the system won’t boot. Just like :

Hopefully QWT will be released at some point.