Skip to main content

Way Forward For Duplicate LVM Names

 Avoiding duplicate lvm name issues. 

Scenario: Let's say 5-10 systems are compromised and all of those systems are spawned up from a pre-configured template i.e. AMI - amazon machine image. Using that you can launch new EC2 instance. 

Template‑এ থাকে:

OS (Linux/Windows)

Pre‑installed packages

Configuration settings

Now when you try to bring all the images of those host machines and try to mount on your analyst vm, it will refuse to work due to same lvm group name, uuid etc. We are here to fix that problem. 

First note the checksum:

host1/disk1.raw and host1/disk1.raw --> We have this directory structure where images are present. 

md5sum host*/*

e3b85cad126731e76955b2240b69f39d  host1/disk1.raw

e3b85cad126731e76955b2240b69f39d  host2/disk1.raw

You can see that the checksum is same. 

Pre-requisite necessary tool installation:

apt install xmount

Step 1 — দুইটার জন্যই xmount cache + loopback সেটআপ:

mkdir -p /mnt/host1/xmount/disk1

mkdir -p /mnt/host2/xmount/disk1

xmount --cache /mnt/host1/xmount/cache1 --in raw host1/disk1.raw /mnt/host1/xmount/disk1

xmount --cache /mnt/host2/xmount/cache1 --in raw host2/disk1.raw /mnt/host2/xmount/disk1

ls -lh /mnt/host*/xmount/*

-rw-r--r-- 1 root root 720K Aug  2 16:38 /mnt/host1/xmount/cache1

-rw-r--r-- 1 root root 720K Aug  2 16:38 /mnt/host2/xmount/cache1

/mnt/host1/xmount/disk1:

total 0

-rw-rw-rw- 1 root root 60G Jan  1  1970 disk1.dd

-r--r--r-- 1 root root 266 Jan  1  1970 disk1.info


/mnt/host2/xmount/disk1:

total 0

-rw-rw-rw- 1 root root 60G Jan  1  1970 disk1.dd

-r--r--r-- 1 root root 266 Jan  1  1970 disk1.info

xmount created the virtual disk image .dd files without touching the original .raw images. In next whatever changes we done will be saved on the cache file rather than impacting the original image, thus the cache file size will be increased. 

xmount can take input from E01, AFF - advanced forensic format and raw. But output will be always in .dd format so that we can work with loopback device or with lvm tool easily. 


Step 2 - The next step is to set up loopback devices pointing at these virtual files:

losetup -fP --show /mnt/host1/xmount/disk1/disk1.dd

/dev/loop5

losetup -fP --show /mnt/host2/xmount/disk1/disk1.dd

/dev/loop6

-P cause the losetup to automatically create sub-devices for the partitions in each disk image.

file -Ls /dev/loop[56]p*

/dev/loop5p1: Linux rev 1.0 ext4 filesystem data, UUID=13fe4d4f-9291-4c1b-b0df-14b58d2a3e87 (extents) (64bit) (large files) (huge files)

/dev/loop5p2: LVM2 PV (Linux Logical Volume Manager), UUID: v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP, size: 62423826432

/dev/loop6p1: Linux rev 1.0 ext4 filesystem data, UUID=13fe4d4f-9291-4c1b-b0df-14b58d2a3e87 (extents) (64bit) (large files) (huge files)

/dev/loop6p2: LVM2 PV (Linux Logical Volume Manager), UUID: v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP, size: 62423826432

We can see that both PV, UUID are identical means same. 

Step 3 - Physical Volume Conflicts Solving (PV UUID fix):

The problem starts when we try to access the lvm2 group by vgscan command.

vgscan

WARNING: Not using device /dev/loop6p2 for PV v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP.

WARNING: PV v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP prefers device /dev/loop5p2 because device was seen first.

Found volume group "LabVM" using metadata type lvm2

/dev/loop6p2 - error is related to this one. Because vgscan is seeing /dev/loop5p2 (lower number loop device) first thus ignoring the second one and throwing error. We need to fix this first otherwise we wound not be able to proceed further. 

So we need to change the UUID of this one /dev/loop6p2 using pvchange command but this actually fails. 

pvchange -u /dev/loop6p2

WARNING: Not using device /dev/loop6p2 for PV v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP.

WARNING: PV v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP prefers device /dev/loop5p2 because device was seen first.

0 physical volumes changed / 0 physical volumes not changed

As both the loopback devices exists so it will not work. We need to first detach the loop6 first. 

losetup -d /dev/loop6

pvdisplay

--- Physical volume ---

PV Name               /dev/loop5p2

VG Name               LabVM

[...]

PV UUID               v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP

Now only loop5 active so now we can change the UUID of loop5.

pvchange -u /dev/loop5p2

Physical volume "/dev/loop5p2" changed

1 physical volume changed / 0 physical volumes not changed

pvdisplay

--- Physical volume ---

PV Name               /dev/loop5p2

VG Name               LabVM

[...]

PV UUID               0FNYGG-WUYv-wTDe-OBVt-G1Xq-KygF-4bSxDy

We can see that loop5 UUID is changed now. 

Step 4 - Logical Volume Conflicts Solving (Fixing host1 vgname and UUID): 

We have changed the PV UUID but remember, we still have vg name same (LabVM) on both the host.

losetup -fP --show /mnt/host2/xmount/disk1/disk1.dd

/dev/loop6

vgscan

WARNING: ignoring metadata seqno 4 on /dev/loop6p2 for seqno 5 on /dev/loop5p2 for VG LabVM.

WARNING: Inconsistent metadata found for VG LabVM.

See vgck --updatemetadata to correct inconsistency.

WARNING: outdated PV /dev/loop6p2 seqno 4 has been removed in current VG LabVM seqno 5.

See vgck --updatemetadata to clear outdated metadata.

Found volume group "LabVM" using metadata type lvm2

Previously we solved the problem of physical volume UUID. Now issue is volume group name is a conflict. Again we need to fix this. So tear down the /dev/loop6 so we can make additional changes.

losetup -d /dev/loop6

vgrename LabVM vg1 (change volume group name)

Volume group "LabVM" successfully renamed to "vg1"

vgchange -u vg1 (change volume group uuid)

Volume group "vg1" successfully changed.

vgdisplay vg1

--- Volume group ---

VG Name               vg1

[...]

VG UUID               3lprSv-oRnK-FxdG-t2ns-Bcog-j1H3-HlJWuV

Now host1 have unique vg name and unique vg uuid. 


Unfortunately this is not the end of our troubles. File system also has the UUID. We need to fix them too. Duplication here will also prevent linux from mounting the file system from lvm group.

Step 5 - Fixing host1 file system UUID

First we need to activate the file system from our lvm group. 

vgchange -a y vg1

3 logical volume(s) in volume group "vg1" now active.

Now how to check them?

file -Ls /dev/vg1/* (Using this command we can check them)

/dev/vg1/home: Linux rev 1.0 ext4 filesystem data, UUID=d19118ff-f5d5-40a0-970a-d4b310934f46 (extents) (64bit) (large files) (huge files)

/dev/vg1/root: Linux rev 1.0 ext4 filesystem data, UUID=ee7fb811-d8f1-4584-8657-69e1298fe122 (extents) (64bit) (large files) (huge files)

/dev/vg1/var:  Linux rev 1.0 ext4 filesystem data, UUID=df99460c-b71c-435f-8410-ef0e1ecaac91 (extents) (64bit) (large files) (huge files)

file command shows us the 3 file system and their respective uuid. To change the uuid of ext4 file system, use “tune2fs -U random” (for XFS, “xfs_admin -U generate“). But we will face another issue. Let's see. 

tune2fs -U random /dev/vg1/root

tune2fs 1.47.2 (1-Jan-2025)

This operation requires a freshly checked filesystem.

Please run e2fsck -f on the filesystem. The xmount cache file system has not been recently checked for filesystem. We need to do that first. 

e2fsck -f /dev/vg1/root

e2fsck 1.47.2 (1-Jan-2025)

Pass 1: Checking inodes, blocks, and sizes

Pass 2: Checking directory structure

Pass 3: Checking directory connectivity

Pass 4: Checking reference counts

Pass 5: Checking group summary information

/dev/vg1/root: 389899/1831424 files (0.1% non-contiguous), 4405452/7323648 blocks

tune2fs -U random /dev/vg1/root

tune2fs 1.47.2 (1-Jan-2025)

Setting the UUID on this filesystem could take some time.

Proceed anyway (or wait 5 seconds to proceed) ? (y,N) y

file -Ls /dev/vg1/root

/dev/vg1/root: Linux rev 1.0 ext4 filesystem data, UUID=ae23562b-2e78-42fc-a212-c34bfc6fdd0b (extents) (64bit) (large files) (huge files)

Now we can see that the uuid has changed. We need to do the same for other two file system as well. 

e2fsck -f /dev/vg1/var

tune2fs -U random /dev/vg1/var


e2fsck -f /dev/vg1/home

tune2fs -U random /dev/vg1/home


Step 6 — host1 mount

mkdir -p /mnt/host1/files

mount -o ro,noexec /dev/vg1/root /mnt/host1/files

mount -o ro,noexec /dev/vg1/var /mnt/host1/files/var

mount -o ro,noexec /dev/vg1/home /mnt/host1/files/home

ls /mnt/host1/files

bin   etc     initrd.img      lib32   lost+found  opt   run   sys  var

boot  home    initrd.img.old  lib64   media       proc  sbin  tmp  vmlinuz

dev   images  lib             libx32  mnt         root  srv   usr  vmlinuz.old

For completeness we should also mount the /boot filesystem.

mount -o ro,noexec /dev/loop5p1 /mnt/host1/files/boot

ls /mnt/host1/files/boot

System.map-5.10.0-20-amd64  grub                        vmlinuz-5.10.0-20-amd64

System.map-5.10.0-21-amd64  initrd.img-5.10.0-20-amd64  vmlinuz-5.10.0-21-amd64

config-5.10.0-20-amd64      initrd.img-5.10.0-21-amd64

config-5.10.0-21-amd64      lost+found

We can see that the file system are mounted. Now lets verify that original image is still intact. 

md5sum host1/disk1.raw

e3b85cad126731e76955b2240b69f39d  host1/disk1.raw

ls -lh /mnt/host1/xmount/*

-rw-r--r-- 1 root root 328M Aug  2 17:17 /mnt/host1/xmount/cache1

/mnt/host1/xmount/disk1:

total 0

-rw-rw-rw- 1 root root 60G Jan  1  1970 disk1.dd

-r--r--r-- 1 root root 266 Jan  1  1970 disk1.info

Cache size has increased from 720k to 328M.


Step 7 — Need to do the above things for host2

mkdir -p /mnt/host2/xmount/disk1

xmount --cache /mnt/host2/xmount/cache1 --in raw host2/disk1.raw /mnt/host2/xmount/disk1

losetup -fP --show /mnt/host2/xmount/disk1/disk1.dd

/dev/loop6

file -Ls /dev/loop6p*

/dev/loop6p1: Linux rev 1.0 ext4 filesystem data, UUID=13fe4d4f-9291-4c1b-b0df-14b58d2a3e87 (extents) (64bit) (large files) (huge files)

/dev/loop6p2: LVM2 PV (Linux Logical Volume Manager), UUID: v4T9wI-LDPP-1fJG-7Siu-LrYh-dFr3-pcAEVP, size: 62423826432


Then we fix the physical volume UUID and the volume group name and UUID:

pvchange -u /dev/loop6p2

Physical volume "/dev/loop6p2" changed

1 physical volume changed / 0 physical volumes not changed

vgscan

Found volume group "LabVM" using metadata type lvm2

Found volume group "vg1" using metadata type lvm2

vgrename LabVM vg2

Volume group "LabVM" successfully renamed to "vg2"

vgchange -u vg2

Volume group "vg2" successfully changed.


Then we can bring the volumes online and change the file system UUIDs:

vgchange -a y vg2

3 logical volume(s) in volume group "vg2" now active

file -Ls /dev/vg2/*

/dev/vg2/home: Linux rev 1.0 ext4 filesystem data, UUID=d19118ff-f5d5-40a0-970a-d4b310934f46 (extents) (64bit) (large files) (huge files)

/dev/vg2/root: Linux rev 1.0 ext4 filesystem data, UUID=ee7fb811-d8f1-4584-8657-69e1298fe122 (extents) (64bit) (large files) (huge files)

/dev/vg2/var:  Linux rev 1.0 ext4 filesystem data, UUID=df99460c-b71c-435f-8410-ef0e1ecaac91 (extents) (64bit) (large files) (huge files)

for dev in /dev/vg2/*; do 

e2fsck -f $dev

tune2fs -U random $dev

done

[...]


Finally we mount all of the file systems:

mkdir -p /mnt/host2/files

mount -o ro,noexec /dev/vg2/root /mnt/host2/files

mount -o ro,noexec /dev/vg2/var /mnt/host2/files/var

mount -o ro,noexec /dev/vg2/home /mnt/host2/files/home

mount -o ro,noexec /dev/loop6p1 /mnt/host2/files/boot


The whole above process can be automated using the following script by the author:

https://github.com/halpomeranz/dfis/blob/master/mtt.sh

Author added “-V” and “-A” options to my mtt.sh script. “-A newvg” will set up the xmount cache, change the LVM volume group name to “newvg” (choose any name you want), and change all UUIDs:


mtt.sh -A vg1 -d /mnt/host1 host1/disk1.raw

mtt.sh -A vg2 -d /mnt/host2 host2/disk1.raw

ls /mnt/host*/files

/mnt/host1/files:

bin   etc     initrd.img      lib32   lost+found  opt   run   sys  var

boot  home    initrd.img.old  lib64   media       proc  sbin  tmp  vmlinuz

dev   images  lib             libx32  mnt         root  srv   usr  vmlinuz.old


/mnt/host2/files:

bin   etc     initrd.img      lib32   lost+found  opt   run   sys  var

boot  home    initrd.img.old  lib64   media       proc  sbin  tmp  vmlinuz

dev   images  lib             libx32  mnt         root  srv   usr  vmlinuz.old


As always, you can unmount everything with the “-U” option:


mtt.sh -U /mnt/host1

mtt.sh -U /mnt/host2

ls /mnt/host*/files

/mnt/host1/files:


/mnt/host2/files:


If you only need to change the LVM volume group name without changing any UUIDs, use “-V newvg” instead of “-A“. If you want to set up a writable xmount cache for your mounted image but don’t need to make any LVM changes, just use “-W“.




Avi

Comments

Post a Comment

Popular posts from this blog

API hacking lab setup

 Follow the commands to install and configure API hacking lab: 1. Install kali linux and update all the packages.  apt update -y apt upgrade -y or apt dist-upgrade -y or apt full-upgrade -y If you face any problem regarding update, install cloud flare warp in the host machine, then again start updating packages in your kali vm.  2. Install and configure burpsuite professional.  After that open burpsuite and go to Extensions tab. Click on BAppStore. Search for Autorize extension, It will help us to automate authorization testing. Click on Download Jython from the right side. From Jython website click on Jython standalone JAR and save it. Go to Extensios > Extensions settings >  under Core extension settings find out Python environment on the right pane. Select the jython jar file that you just downloaded. Now again go to BAppStore and re-search for Autorize extension. You will see Install option this time after selecting Autorize extension. Install it. You ...
Post a Comment
Read more

Disk acquisition and access for IR

 Goal for this lab is after we acquire the disk in .E01 format then how can we mount this to linux system for analysis.  দুইটা scenario cover করছি: (A) simple E01 + LVM (single disk), (B) E01 + Software RAID + LVM (multi-disk, যেমন disk1/disk2) From the linux analysis vm like sansforensic vm, you need to run the following commands.  We need to first create the working directories : mkdir -p /mnt/case/img /mnt/case/data E01 + LVM (single disk) - First case. Step 1 — E01 mount: ewfmount Webserver.E01 /mnt/case/img ls -lh  /mnt/case/img total 0  -r--r--r-- 1 root root 32G Feb 16 18:21 ewf1 Ewf1 is a raw disk image. It's size and main disk size are same. This is in read-only mode. See the permission. Step 2 — See the partition layout : mmls /mnt/case/img/ewf1 কোন offset-এ কোন partition আছে (boot, lvm ইত্যাদি) note করুন। RAID sign ( 0xfd ) আছে কিনা খেয়াল করুন — থাকলে Scenario B তে যান। lvscan | grep VulnOSv2-vg mount -o ro,noexec /dev/VulnOSv2-vg/root /mnt/case/dat...
Post a Comment
Read more

How to use vim efficiently

  Here every command works in command mode . And if you need to write something then you need to go to Insert mode . Pressing i will take you to the insert mode.  1. Let's say you want to search something. For example you want to find avi keyword. Then first you need to go to the command mode by typing Esc . Now type /avi  (at the bottom) and hit enter. Press small n to forward this search pattern and press Shift N to go reverse.  2. Substitute something: :%s/old string/new string/g    (g for affecting globally) 3. If you want to pick the 1st letter of word then press w and last letter of word then press e .  4. yy means copy a single line. 2yy means copy double lines.  5. Shift P is for paste.  6. Shift D to delete a line or cut a line.  7. Press o to go a new line.  8. Press Home to go to the 1st letter of a line and End to go to the last letter of a line.  9. If you want to save the file then press wq! . 10. If ...
Post a Comment
Read more