Back-Flip

WPS - BTA vulnerability - reaver

2011-12-30T22:28:00.000Z

WPS - Wifi Protected Setup - PIN BTA vulnerability

link to read:
https://code.google.com/p/reaver-wps/wiki/README

"...Reaver targets the external registrar functionality mandated by the WiFi Protected Setup specification.
Access points will provide authenticated registrars with their current wireless configuration (including the WPA PSK), and also accept a new configuration from the registrar."

nice =)

http://dshield.org/diary.html?storyid=12292

win7 - Activate Netlogon debugging

2011-11-14T17:27:00.001Z

Sometimes we need to see exactly what's happening on a host logon, to do this on a Win7 Box:

1. Start the Regedt32 program.

2. Delete the Reg_SZ value of the following registry entry, create a REG_DWORD value with the same name, and then add the 2080FFFF hexadecimal value.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag

3. At a command prompt, type net stop netlogon, and then type net start netlogon. This enables debug logging.

After this a new file is created on %windir%\debug\netlogon.log

Happy reading...

A nice app to facilitate the reading of this debug log it's: Policy Reporter (hxxp://www.sysprosoft.com/policyreporter.shtml)

.

Easter Egg for Win7 - Local DoS for Win2008 / O.o

2011-11-13T22:39:00.005Z

Special folder : "God mode" on Win7

Create a folder with any name, than add this extension:

.{ED7BA470-8E54-465E-825C-99712043E01C}

Tchan tchan ;)

(it doesn't give you any new "privileges" but it as a lot of nice config stuff)

However if you do this on a Win2008 desktop you'll have problems !!
! Local denial of service O.o

(if you did it on win2008, and are getting an "explorer error" you should access the remote admin share c$ and rename the folder)

http://it-audit.sans.org/blog/2011/08/22/windows-7-feature-windows-2008-local-denial-of-service/

Enable debug GPOs

2011-10-27T14:46:00.000+01:00

If you like the userenvlog from Windows XP, you may want to know how to get more information from the GPSVR service in Windows 2008/Visa/Win 7. If so then try this:

How to enable logging in the Gpsvc.log file To enable logging in the Gpsvc.log file, follow these steps. Click Start, click Run, type regedit, and then click OK.

Make sure that you have the folder %windir%\debug\usermode, if the usermode folder is not there, then manually create it.
Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
On the Edit menu, point to New, and then click Key.
Type Diagnostics, and then press ENTER.
Right-click the Diagnostics subkey, point to New, and then click DWORD Value.
Type GPSvcDebugLevel, and then press ENTER.
Right-click GPSvcDebugLevel, and then click Modify.
In the Value data box, type 0x30002, and then click OK.
Exit Registry Editor.
At a command prompt, type the following command, and then press ENTER: gpupdate /force
. View the Gpsvc.log file in the following folder: %windir%\debug\usermode

Tip, Verifying Windows Box state, before and after installing a software

2011-10-25T14:06:00.003+01:00

Monitor an Install Program Without Using Any (Expensive) Tools

Finding out what files have been copied/updated by another install program is very easy when you know how.

   1. First of all, take a 'clean' machine, i.e. one that has only got an operating system on it.

   2. Make a dump of the file list. This can be done by typing
      DIR c:\*.* /s/one >c:\before.txt
   3. Open REGEDIT.EXE and go to Registry->Export Registry File and save the registry as   c:\before.reg
   4. Install the product that you want to monitor

   5. Make another dump of the file list by typing
      DIR c:\*.* /s/one >c:\after.txt

   6. Open REGEDIT.EXE and go to Registry->Export Registry File, as before, and save the registry as c:\after.reg

You now have all the information required to find out everything about the program that you installed
---------------------------------------- ---------------------------------------- ----------------------------------------

Troubleshooting group policy win7 / win2008r2 gpo

2011-10-25T14:04:00.002+01:00

tips:

http://www.grouppolicy.biz/archives/tutorials/

http://social.technet.microsoft.com/wiki/contents/articles/1456.aspx

http://technet.microsoft.com/en-us/library/cc749336%28WS.10%29.aspx

in "Microsoft Technet"

GPLogView

Often times, it is easier to read text files for troubleshooting instead of using the Event Viewer. In fact, exporting event logs into text files may be the only solution when troubleshooting computers in remote locations. GPLogView is a utility you can download and use to export Group Policy event data from the system and operational log into a text, html, or xml file. You can download GPLogView from the Microsoft Download Center (http://go.microsoft.com/fwlink/?LinkId=75004). The following examples show the syntax of commonly used options for GPLogView.

Example 1: Export all Group Policy events

You can use GPLogView to export all Group Policy–related events from the system log and the operational log.

gplogview -o gpevents.txt

Example 2: Export Group Policy events with a specific Activity ID

GPLogView filters Group Policy–related events by Activity ID, which is useful when troubleshooting a specific instance of Group Policy processing.

gplogview -a 8A7C7CE5-F7D0-4d32-8700-57C650A53839 -o gpevents.txt

Example 3: Monitor Mode

You can use GPLogView to capture Group Policy events in real time. GPLogView writes all Group Policy related events to the command window, as they occur. Press CTRL+C to exit monitor mode, or press Q and ENTER.

gplogview -m

GPO preprocessing: + networking

http://technet.microsoft.com/en-us/library/cc727306%28WS.10%29.aspx

Nice feature do examine... Win7 / Win2008

2011-10-18T09:59:00.004+01:00

Redirect built into windows?

netsh interface portproxy add v4tov4 listenport=8080 connectaddress=10.1.1.1 connectport=8080 protocol=tcp
.
Could it be used to redirect traffic? probalbly ;)
.
hxxp://ipv6int.net/systems/windows_xp-ipv6.html
.
Basic IPv6 functions

Overview

I think on WinXP IPv6 is not active in a default installation. The IPv6 part has to be installed and activated manually on the command line:
netsh interface ipv6 install
Afterward IPv6 is active and ready to perform stateless autoconfiguration for local and global addresses.

Preference

Windows XP prefers IPv6 if a DNS query results in IPv4 and IPv6 addresses being sent back (A and AAAA RRs).

Privacy Extensions

Privacy addresses are enabled and used by default after the installtion of IPv6. They can be manually deactivated on the command line: netsh interface ipv6 set privacy disabled

Packet Filter/Firewall

Windows XP integrates since Service Pack 2 (SP2) a stateful IPv6 firewall into the base system firewall, called just Windows Firewall.

Tunnelling IPv4/IPv6

Configured tunnels

Windows XP supports configured tunnels with the integrated tunnel interface. Setting up a manual tunnel requires several steps on the command line.
Beforehand, you need the following information:

$host-ipv4: IPv4-address of the host
$router-ipv4: IPv4-address of the router/tunnel-server
$tunnel-v6host: (Tunnel) IPv6-address of the host
$tunnel-v6router: (Tunnel) IPv6-address of the router

Create the tunnel interface:
netsh interface ipv6 add v6v4tunnel "tunnel name" $host-ipv4 $router-ipv4

Add IPv6 address:
netsh interface ipv6 add address "tunnel name" $tunnel-v6host

Put IPv6 default route on the tunnel router:
netsh interface ipv6 add route ::/0 "tunnel name" $tunnel-v6router

6to4

When IPv6 is active and the system has a public IPv4 address, Windows XP automatically activates 6to4 if the interface does not have a global IPv6 address.

In our tests, the configuration of the public 6to4 anycast address was necessary:
netsh interface ipv6 6to4 set relay 192.88.99.1

Other tunnels

As per the documentation, Windows XP SP2 supports several other tunnelling mechanisms:

Automatic tunnels: Deactivated by default
ISATAP: Activated by default
6over4: Deactivated by default
Teredo: Deactivated by default
PortProxy

tcpdump - for win :P

2011-10-13T16:32:00.004+01:00

A friend of mine (thanks Kabrinsky ;) told me that there is a tcpdump for win boxes that doesn't need's instalation.

I searched... found it, and it's very nice, here are some brief tips, for me (i really don't have a good memory, soo a write stuff...to remember):

Where to find it:

hxxp://www.microolap.com/products/network/tcpdump/

usage: 

+ find your box interfaces

   tcpdump.exe -D

+ listen to everything on interface 5

   tcpdump.exe -i 5 -nn -vv

+ listen to everything on interface 5 and save it to a file

  tcpdump.exe -i 5 -nn -vv -w tt.pcap

+ listen only to some ip's and save it to a file

  tcpdump.exe -i 5 -nn -vv -w tt.pcap host 192.168.1.254 and host 192.168.1.64

+ to save all the packet data: -s 0
  tcpdump.exe -i 5 -nn -s 0 -vv -w tt.pcap host 192.168.1.254 

that's it.

.

.

Tips for Windows Uninstalls

2011-09-24T18:26:00.000+01:00

Recently i had a problem with my laptop and Win7, and i did a little research for uninstallations here's some tips:

On the Registry here's the KEY were you can find the uninstalls strings:
HKLM\Software\microsoft\windows\currentversion\uninstall

You will find some folders and inside each the corresponding application and uninstall strings ;)

One of the applications that microsoft gives for uninsttaling drivers is "dpinst.exe"

If you need to look at the install or uninstall log, goto
c:\windows\dpinst.log

That's it, just another quick tip.
.

Tips . RegEx - intro

2011-08-04T23:58:00.001+01:00

.: Regex :.

\d = any number
\D = anything but a number
\s = any space
\S = anything but a space
\w = any char (letter)
\W = anything but a char
. = any char, number
\b = blank space betwen words
\+ = one or more chars
? = 0 or 1 repetitions
* = 0 or more repetitions
{n}= exact number -> \d{5} represents five digits in a row
{n}= \d{1,5} between one and five digits

\e = Escape
\f = form feed
\n = newline
\r = Carriage return
\t = horizontal tab

calende[ae]r = search calender or calendar

[a-z] = any lower case letters
[0-9] = all numbers
[A-F] = any capital letters from A to F

Linux - Ubuntu - 2 Media tips

2011-07-18T22:36:00.000+01:00

Two quick Linux media tips:

- Webcam - Viewer / recorder
To use my webcam i found this great peace of software:
"GUVCView"

To install it on ubuntu (simply):
# apt-get install guvcview

And that's it, you can launch it and view / record or take snapshots with your webcam.

- ffmpeg - great tool to encode and transform your videos, avi, mpeg, mov...etc.
# apt-get install ffmpeg
and use it:
$ ffmpeg -formats
$ ffmpeg -i yourfile.ext -vcodec wmv2 -sameq -acodec wmav2 -f avi outfile.avi

I run into some trouble with the xvid codecs, but found the solution here:
https://wiki.ubuntu.com/ffmpeg

That's it.

Socat - nifty tool ;)

2011-05-19T22:25:00.004+01:00

Here's some tips to test "socat"

: connect to port 80
> socat - tcp4-connect:192.168.1.1:80
-----------------------------------------------------------

: connect to port 80 + verbose
> socat -d -d - tcp4-connect:192.168.1.1:80
-----------------------------------------------------------

: listen to port 80
> socat -d -d - tcp4-listen:80
-----------------------------------------------------------

: Port forward : listen on port 443 -> send to 80 of the host
> socat -d -d tcp4-listen:443 tcp4:192.168.1.1:80
-----------------------------------------------------------

There's lot's more, try socat -h
.

examples:
http://technostuff.blogspot.com/2008/10/some-useful-socat-commands.html

Bash - simple "for loop"...

2011-03-29T23:20:00.002+01:00

This may be usefull, it's a simple loop in BASH

#!/bin/bash
for hostname in $(cat text.txt); do
host $hostname
done

Just substitute the "text.txt" with a file containing the hosts.

.
.

Windows - Create file to test filesystem - utility

2010-08-19T11:20:00.000+01:00

To create a file filled with zero's on windows;

fsutil file createnew name-of-file.txt 2000 (this is the length in bytes)

This will create a new file with 2000 bytes.

This can usefull for copy / perfomance disk testing.

.
.

Varnish - cache "invention" - Load balacing squid's

2010-08-11T16:21:00.004+01:00

I tested load balacing squid proxys with HAproxy, and it was nice, then i had a crazy thought;

"what if i used varnish, and load-balance "and" cache at the same time...?"

Varnish its a great software for reverse-caching webservers... i'm not using it for what it was created, but i had this crazy idea...:P

Well, i took varnish and started "inventing" a way...

This is my setup to load-balance and cache, with varnish, 3 squid's :P (yep, crazy i know):

Request---> varnishd:8080 --> refered has "webfarm"
            /    |    \
   / | \
       proxy1 proxy2 proxy3

config file: default.vcl

backend proxy1 {
     .host = "10.30.1.171";
     .port = "8080";
}

backend proxy2 {
     .host = "10.30.1.172";
     .port = "8080";
}

backend proxy3 {
     .host = "10.30.1.173";
     .port = "8080";
}

director webfarm round-robin {
{
.backend = proxy1;
}
{
.backend = proxy2;
}
{
.backend = proxy3;
}
}

sub vcl_recv {
if (client.ip == "10.1.5.10" )
   { set req.backend = webfarm; }
}.

Well it worked...but i'm not very sure about the perfomance...varnish was not created for this :P

HAproxy - LoadBalancer - balancing 3 squid's

2010-08-11T11:44:00.004+01:00

Trying to loadbalance requests across 3 squid-cache proxys, very nice, i'm enjoiyng HAproxy a lot, great software.

Here it goes:

Client request <-----> HAproxy <---> squid1 \  

                               <---> squid2  -- web

                               <---> squid3 /

Config file: haproxy.cfg

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        #log loghost    local0 info
        maxconn 4096
        #nbproc 2
        #chroot /usr/share/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet

defaults
        log     global
        mode    http
        option httplog
        option dontlognull
        retries 3
        option redispatch
        maxconn 2000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000

# reverse proxy-squid
listen webfarm 0.0.0.0:8000
        mode http
        cookie SERVERID insert indirect nocache
        balance roundrobin
        option httpclose
        option forwardfor header X-Client
        server squid1 10.30.1.171:8080 check inter 2000 rise 2 fall 5
        server squid2 10.30.1.172:8080 check inter 2000 rise 2 fall 5
        server squid3 10.30.1.173:8080 check inter 2000 rise 2 fall 5

listen admin_stats 0.0.0.0:81
        mode http
        stats uri       /stats
        stats realm     Global\ statistics
        stats auth      username:password

        #errorloc       502     http://192.168.114.58/error502.html
        #errorfile      503     /etc/haproxy/errors/503.http
        errorfile       400     /etc/haproxy/errors/400.http
        errorfile       403     /etc/haproxy/errors/403.http
        errorfile       408     /etc/haproxy/errors/408.http
        errorfile       500     /etc/haproxy/errors/500.http
        errorfile       502     /etc/haproxy/errors/502.http
        errorfile       503     /etc/haproxy/errors/503.http
        errorfile       504     /etc/haproxy/errors/504.http

------------------------------ EOF ------------------------------------

.

To access the haproxy stats, use: (the "uri" defined)
http://webfarm:81/stats

Well it works, very nice, and it does backend servers check, and statistics NICE !

Active Directory Database - Files

2010-07-26T12:01:00.000+01:00

Important files of Active Directory.

Active Directory Database is stored in %systemroot%\NTDS\
the DB file is ntds.dit

The files in this directory, and what they do;
1:ntds.dit : this is the main database file for active directory.
2:edb.log : When a transaction is performed to AD database, it will be stored to this file, and then after it will be sent to the Database
3:res1.log : Used as a reserved free space, in case of disk low space, default size is 10MB.
4:res2.log : Same of the above.
5:edb.chk : Records transactions committed to the AD database. During shutdown, "shutdown statement" is written to this file, if it is not found during system startup the AD database checks the edb.log for updated information.

Ntdsutil: tool that can verify database integrity

.

Linux - Tools to view disk activity

2010-06-29T14:09:00.001+01:00

Here are some tools to find out what process is "eating" your resources:

iotop
vmstat
lsof
atop
strace -e trace=open "aplication"

HAproxy - LoadBalancer - Simple config

2010-06-25T13:50:00.006+01:00

I'm testing HAproxy, here is my first simple configuration:
- 1 haproxy server -> Serving 2 backend webservers

Request ---> haproxy:80  ---refered as "webfarm"

|

/ \

            moss1 moss2

Config file: haproxy.cfg

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        #log loghost    local0 info
        maxconn 4096
        #nbproc 2
        #chroot /usr/share/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet

defaults
        log     global
        mode    http
        option httplog
        option dontlognull
        retries 3
        option redispatch
        maxconn 2000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000

listen webfarm 0.0.0.0:80
        cookie SERVERID insert indirect nocache
        balance roundrobin
        server moss1 10.30.1.61:80 cookie check inter 2000 rise 2 fall 5
        server moss2 10.30.1.62:80 cookie check inter 2000 rise 2 fall 5

listen admin_stats 0.0.0.0:81
        mode http
        stats uri       /my_stats
        stats realm     Global\ statistics
        stats auth      username:password

        #errorloc       502     http://192.168.114.58/error502.html
        #errorfile      503     /etc/haproxy/errors/503.http
        errorfile       400     /etc/haproxy/errors/400.http
        errorfile       403     /etc/haproxy/errors/403.http
        errorfile       408     /etc/haproxy/errors/408.http
        errorfile       500     /etc/haproxy/errors/500.http
        errorfile       502     /etc/haproxy/errors/502.http
        errorfile       503     /etc/haproxy/errors/503.http
        errorfile       504     /etc/haproxy/errors/504.http

To access haproxy stats:
http://webfarm:81/my_stats

It's working nice, i have to continue tests and try more configuration settings.

.

Ubuntu 10.04 - tips - boot in graphic mode

2010-06-02T14:23:00.000+01:00

I'm trying Ubuntu (finaly...i wasn't a big fan...but it's growing :)

I installed Lucid Lynx, desktop version, but i'm using it as my second workstation, so i wanted to "tweak it" a little bit.

To boot in text mode, i did some search and found that Ubuntu desktop is configured to work in graphic mode in almost every runlevel

So we can config grub to boot in text mode:

edit /etc/default/grub

GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

add "text"

to the options.

And i also stopped some services:

/etc/rc2.d/

# mv S70bluetooth K70bluetooth

I must confess that the package management of debian based systems is the best (in my humble opinion)

I'm very impressed with "apt-get" ;)

Logging in Apache - don't log favicon.ico

2010-06-01T11:09:00.008+01:00

Apache logs a lot of info, but it can be configured.

Here is a brief description of what i've done to apache config, so that it would not log some hits, for example "favicon.ico", here it goes:

First i altered /etc/apache2/apache2.conf (other systems can be httpd.conf)

I don't want to log agents...
In these lines:

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined

LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined

I modified to look like this:

LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O" vhost_combined

A lot less info about agent's ;)

Now for the sites, in the file /etc/apache2/sites-available/default i added this:

SetEnvIf Request_URI "^/favicon\.ico$" dontlog

then on the line that has the CustomLog entry:

CustomLog /var/log/apache2/access.log combined env=!dontlog

After this the favicon.ico continues to log in the error.log, so i created a zero size file in /var/www/
# cat /dev/null > favicon.ico

I know it's not the best for debugging but i like it better like this, i think it's better for reading ;)
.

Roll Back Windows Patch - KB

2010-03-06T23:22:00.000Z

On a Windows box, regulary we should patch and update, on any box, on any operating system updates are important.

But what if after a patch or KB.exe on your pc/server you receive a "blue screen" error?

There is a way of "rolling-back"!

1. Boot from your Windows XP CD or DVD and start the recovery console.

Once you are in the Repair Screen..

2. Type this command: CHDIR $NtUninstallKB977165$\spuninst

3. Type this command: BATCH spuninst.txt

4. Type this command: systemroot

5. When complete, type this command: exit

This should do it.

Problem with Squid - signal 6

2010-03-02T16:46:00.005Z

Squid-cache on a linux machine, was crashing repeatedly with the error:

$ exited due to signal 6

After lots of logs reading and net hunting i found out that this error was corrected on a newer version of squid.

The error was on the following version:

Squid Cache: Version 2.5.STABLE6

I upgraded to:
Squid Cache: Version 2.5.STABLE11
So i upgraded and .... no more crashes.

Some tips and commands that helped on troubleshooting:
Read squid logs:
- /var/log/squid
     - cache.log

Verify squid cache directory:
- /var/spool/squid

Verify message logging:
- /var/log/messages

Commands:
to rebuild cache: squid -z

to start with debug: squid -d 3 -F -N -X
-d 3 --- more debug level
-F     --- don't service any request until cache is rebuild
-N    --- no daemon level
-X     --- force full debug

Compile - NginX under Linux

2009-10-13T00:45:00.002+01:00

== Tips for compiling NginX ==

After downloading nginx tarball you also need:
- zlib.tar.gz
- openssl.tar.gz

1 - make and install zlib
2 - uncompress openssl tarball
3 - Configure nginx script:
   - ./configure \
      --with-http_ssl_module --with-openssl=../openssl-uncompress-dir \
      --prefix=/srv/your-dir
4 - make
5 - make install

That should give a working nginX server ;)

Linux - diags commands, Get hard / soft Info

2009-09-10T12:15:00.006+01:00

Here are some commands that we can use to obtain info from a Linux host:

# dmesg      -- show bootup messages / detected hardware

# top                -- show cpu/mem/swap usage and running processes
# mii-tool           -- show nic infos
# du -xh | sort      -- show disk usage

# ps -exfcl          -- show processes running - list
# rpm -qa            -- show packages.version installed - (redhat/fedora)
# cat /etc/fstab     -- show filesystem table

# cat /proc/cpuinfo -- show cpu information
# cat /proc/devices -- show devices ( /proc "filesystem" shows lots of info)
# cat /proc/meminfo -- show memory

The list continues...i will add some more later

Cisco ios image search - for labs

2009-09-09T23:53:00.001+01:00

Quick tip to find ios images

On google search use:
: intitle:index.of ios .bin -site:cisco.com

It should give some nice results

Which User loged on what workstation - "short tips" - Windows2003 domain

2009-08-31T14:47:00.009+01:00

A short tip ;)

To find out were "someuser "is logged on what "workstation"

We go to the domain PDC ( check "netdom query fsmo")

->eventvwr -> security -> filter by

-> "event source":security

-> search the user you are looking for on field - user:

john

That's it.

Linux Basics - 1

2009-08-20T12:45:00.020+01:00

== Linux basic commands ==

The kernel: Monolithic or Modular

A monolithic kernel is one which has support for all hardware, network, and filesystem compiled into a single image file.

A modular kernel is one which has some drivers compiled as object files, which the kernel can load and remove on demand. Loadable modules are kept in /lib/modules.

-------Commands that can help --------------------

# lsmod - list currently loaded modules# rmmod - remove a single module# insmod  - insert a single module# depmod - create the database of module dependencies modules.dep# modprobe  -insert a module and dependencies listed in     modules.dep# modinfo - list information about the author, license type and  module     parameters

Diagnostics on Win2003 AD

2009-08-17T14:45:00.004+01:00

Some commands for diagnostics on Windows Domain Controler

==== Diags Commands ====
Check - c:\windows\NTDS - ntds.dit / edb.xxx
c:\windows\SYSVOL\sysvol\domain.local --- subfolders
share - NETLOGON -> c:\windows\SYSVOL\sysvol\domain.local\SCRIPTS
share - SYSVOL -> c:\windows\SYSVOL\sysvol
Check - DNS console - SRV records - _msdcs.domain.local
= nslookup
nslookup gc._msdcs

= dcdiag /test: replications
dcdiag /test: topology, cutoffserver, netlogons, fsmocheck, DNS, frssysvol, frsevent, kccevent, systemlog, RegisterInDNS,
= repadmin /replsum
= repadmin /showrepl
== repadmin /replicate destDC courceDC NamingContext /force
= repadmin /showconn
= repadmin /showreps

= netdom query FSMO == netdom /verify DSTBDC /domain:domain.local
= netdom query DC

= nltest /DSGETDC:domain.local

= dnslint /ad /s localhost /v
= dnslint /d domain.local /s 10.x.x.x /v
explore
= dcdiag
= netdiag

= w32tm /config /syncfromflags:manual /manualpeerlist:10.x.x.x
= w32tm /config /update
= w32tm /dumpreg /subkey:parameters
= w32tm /monitor

-----Test------------ exchange "Service Principal Names" - LDAP --------------------
setspn -L "servername"
setspn -?

Find Host that respond pings

2009-01-13T15:10:00.001Z

Easy script to find hosts that respond to pings:

FOR /L %%V in (1,1,100) DO ping -w 30 -n 1 10.1.1.%%V |findstr /I Reply >> up.txt

Put this in a batch file.

For more info on the command "for" type : for /? in a cmd.exe box ;)

Linux - Find BIG files

2008-12-18T21:17:00.003Z

A little tip for linux:

To find large files on a system we can do:

$ find / -type f -size +20000k -exec ls -lh {} \;

We can use other filesystem like /home or /tmp

win2003 AD cheat sheet =D

2008-09-22T14:28:00.002+01:00

Some diags i like to run on Win2003 AD:

Dnslint - Utility

2008-07-11T11:36:00.004+01:00

The dnslint (windows 2003) utility tests various dns options.

To use it we can try the following:

> dnslint /d "domain.name" /s 10.1.1.1 /c

Explanation of the flags used:
- /d set's the domain to test
- /s flag it's used to bypass the Internic whois lookup, and use 10.1.1.1 dns
- /c flag is for testing mail servers

It can be used to test a lot more, with /ad flag it will do requests to active directory.

There is a lot more flags, do a simple
> dnslint /? |more

to see the options

Nessus commands

2008-07-01T14:24:00.003+01:00

EXAMPLE
To perform a command-line scan against 192.168.0.0/24, do the following:
echo 192.168.0.0/24 > targets.txt

nessus -xq localhost 1241 yourLogin yourPassword targets.txt report.txt

Sql Server - Truncate Log Files

2008-07-01T10:35:00.003+01:00

SQL Server:

“Clean LOG Files”

Examples:

backup log BizTalkMsgBoxDb with truncate_only

DBCC SHRINKFILE (BizTalkMsgBoxDb_log, 200)

Fazer também na Base de Dados “BizTalkDTADb”

backup log BizTalkDTADb with truncate_only

DBCC SHRINKFILE (BizTalkDTADb_log, 200)

Fazer também na Base de Dados “BizTalkMgmtDb”

use BizTalkMgmtDb

backup log BizTalkMgmtDb with truncate_only

DBCC SHRINKFILE (BizTalkMgmtDb_log, 100)

...

Etc

Examples of commands that can "help":

use BizTalkMgmtDb

backup log BizTalkMgmtDb with truncate_only

DBCC SHRINKFILE (BizTalkMgmtDb_log, 100)

use RNT_EXCEPTION;

backup log RNT_EXCEPTION with truncate_only

DBCC SHRINKFILE (DotNetNuke_log, 100)

use master;

select * from sysfiles;

select * from sysdatabases;

EXEC sp_databases;

EXEC sp_helpdb;

SQL inject - test

2008-06-30T23:12:00.008+01:00

Sample PHP code for authenticating a user during login

$sql = "SELECT * FROM accounts WHERE username='".$_GET['username']."' and password = '".md5($_GET['password'])."'";

If I enter admin for both the username and password the resulting sql statement would be as follows
SELECT * FROM accounts WHERE username='admin' and password = '21232f297a57a5a743894a0e4a801fc3'

If there is a record in accounts with both username and password as admin, then I will get logged in, otherwise the login will fail.

Thats all well and good, but there is a very critical problem.
The problem here resides in the fact that there is no validation on what the user inputs, but the input is used to create a SQL statement.

Lets take a look at the following SQL statement

SELECT * FROM accounts WHERE username='admin' /* and password = '21232f297a57a5a743894a0e4a801fc3 '

What would this statement result in?
First thing to notice is the /*

This is a comment delimiter in MySQL, which means anything following it is considered a comment and is ignored.
Another way to think about it is that the SQL Statement ends at this point.

So if there statement ends at the /* then the effective SQL statement is
SELECT * FROM accounts WHERE username='admin'

So when will this generate a valid result?

It will be valid if the username exists in the database, and if it does, then it will return that record.
This means it will log me in as the admin without need for discovering/guessing the password!!

Sounds good, how would I make the SQL statement look like that. Well try entering in this as your username
admin' /*
If you look again at the orignal SQL statement and insert this as the username you will see how it alters the SQL statement in a way that the statement is still valid in syntax but the symantic meaning has been altered to suit your needs. Here is what it will look like
SELECT * FROM accounts WHERE username='admin' /* ' and password = '21232f297a57a5a743894a0e4a801fc3'
Now isnt this cool?

Alright, now look at the source code. Theres a link to the source on the main page.

Notice that its displaying the username from the database query result.

This means we can see data from the database. So lets try using a UNION query to get arbitrary data from the database.
When using UNION queries there is a requirement that both sets of data share the exact same number of columns.
Since you dont know how many columns are being returned, we have to discover this information using this technique

How to solve over/under column problems

Start with one field using NULL as its value
admin' UNION SELECT NULL FROM accounts LIMIT 1,1 /*

This will result in an error â€œThe used SELECT statements have a different number of columnsâ€.
This is telling us that the two data sets do not having matching number of columns.

Add another NULL
admin' UNION SELECT NULL, NULL FROM accounts LIMIT 1,1 /*

Same error

and Add another NULL
admin' UNION SELECT NULL, NULL, NULL FROM accounts LIMIT 1,1 /*

No more error.

Now that we know how many columns we have to work with, lets concat in the data

In these we will get the account table records

admin' UNION SELECT NULL, concat(id, ' - ', username, ' - ', password) AS username, NULL FROM accounts LIMIT 1,1 /*
Notice the last field is the MD5 hash. Here is where the toolkit link to the MD5 hash database comes in handy http://www.md5decrypt.com/

Put in that md5 hash and if its a common password, you will get a result

Now lets get another user record by shifting the LIMIT to start on the next record

adminâ€™ UNION SELECT NULL, concat(id, â€˜ - â€˜, username, â€˜ - â€˜, password) AS username, NULL FROM accounts LIMIT 2,1 /*

Now lets get data from an entirely different table

admin' UNION SELECT NULL, concat(prodid, ' - ', name, ' - ', description, ' - ', price) AS username, NULL FROM inventory LIMIT 1,1 /*

admin' UNION SELECT NULL, concat(prodid, ' - ', name, ' - ', description, ' - ', price) AS username, NULL FROM inventory LIMIT 2,1 /*

As you can see, once you have a SQL injection point you can gain access to a great deal of database information.

nice link: hxxp://www.md5decrypter.com/

hxxp://www.mightyseek.com/podcasts/hands-on-series-sql-injection

Build Install Package - Free

2008-06-29T17:49:00.007+01:00

Make a install package file :)

You can just use winxp and:

1- start -> run
2- iexpress

It start's the wizard, and you can create your install package :)

I've seen this on Hak.5 great site :)

Use Calc to Surf the web

2008-06-29T17:32:00.003+01:00

We can use the "calc" program to surf the web:

Open calc:
1- Menu help - > help topics
2 - Alt+space
3 - "Jump to URL"

There, just put your url, and surf !

I've seen this on hak.5 great site :)

Windows 2003 utilitys

2008-06-26T14:12:00.011+01:00

Some commands that are very useful:
diskpart - disk partition

dnslint - dns test / report
nslookup - dns test - interactive
nltest - test - domain / trusts

netsh - net "shell" -
netsh firewall show config - show windows firewall configuration

dcdiag - test dc's
netdiag - test network / dc's

ntdsutil - ad utility

To show last replication summary - 0 errors = Good
repadmin /replsum /bysrc /bydest /sort:delta

To show AD Roles, FSMO - Flexible single master operations
netdom query FSMO

To show last replications:
repadmin /showrepl

Linux Tip - Burn cd's

2008-05-14T15:16:00.003+01:00

-- Create an .iso:

#umount /dev/cdrom
#dd if=/dev/cdrom of=filename.iso bs=1024

-- Create .iso image file form a "dir":

#mkisofs -r -J -o file.iso /location_of_folder/
-r generates Rock Ridge long names for Linux
-J generates Joliet long names for Windows

-- Mount .iso file without having to burn:
#mkdir /media/iso
#modprobe loop
#mount cdrom.iso /media/iso/ -t iso9660 -o loop

-- To "burn" an .iso to cd:

#cdrecord dev=/dev/cdrom driveropts=burnfree -v -data cd_image.iso

To burn an audio cd from wav files:

#cdrecord dev=/dev/cdrom driveropts=burnfree -v -audio [wav files...]

Replace /dev/cdrom as needed if this is not your CD-Writer

-v (verbose) lets you track the recording progress

driveropts=burnfree helps reduce the risk of a buffer under-run (most drives should support this)

Set Time - Win2003

2008-05-14T11:02:00.005+01:00

- To set the time in a Windows 2003 server you can use the w32tm command

- w32tm /?
- w32tm /config /manualpeerlist:10.1.1.1 /syncfromflags:MANUAL

- net stop w32time
- net start w32time

- w32tm /resync

And that's it, now you will have your server setting the time from the ip:10.1.1.1

Linux Tip - Get back GRUB after clone

2008-01-15T16:29:00.002Z

After cloning a Linux HDD, i've booted from the new hdd and got myself a "pretty" grub error, the screen just went:
GRUB GRUB GRUB GRUB

and it filed my screen with that.

How to recover the mbr? here is the solution that i have found on the net (google it...)

1. Boot with any live CD (I've done it with Knoppix 3.x and Ubuntu)
2. Get a root shell and make a folder (mkdir ubuntu)
3. mount the root (/) partition of ubuntu (e.g. mount /dev/hdb ubuntu if you have two disks)
4. chroot the mounted partition (chroot ubuntu)
5. grub-install /dev/hda [1]
5. Exit the shell
6. Reboot

That did the trick :)

Linux Tip - no Beeps on console

2008-01-03T16:27:00.000Z

To remove the beeps on the console, we can do this:

# setterm -blen 0

Then we can put this line on /etc/rc.d/init.d/rc.local

every time your Linux box boot it will read the above line and
this will end the beeps on linux console.

Linux Tip - Keymap

2008-01-03T12:45:00.000Z

To change console keymap in debian:

# dpkg-reconfigure console-tools

if that doesn't work, perhaps:

# apt-get install console-data console-tools debconf

and
# apt-get update

"Wait" command in Windows

2007-11-13T11:23:00.000Z

To make a basic "wait" command in windows we can do like this:

: ping 127.0.0.1 -n 5 -w 5000 > nul

this command will do a wait for 5 secs.

Could be usefull

Remove Sendmail

2007-08-01T15:46:00.000+01:00

Here's how to remove sendmail from your system.

Use it "at your on risk"

- Check for sendmail in /etc/init.d/
 # ls -la /etc/init.d
 # chmod -x /etc/init.d/sendmail - remove the execute

- Find sendmail in your boot scripts. It's usually in either /etc/rc or
  /etc/init.d/sendmail. It looks like
          sendmail -bd -q15m
  -q15m means that it should run the queue every 15 minutes; you may
  see a different number. Comment out this line.

- Kill the sendmail daemon. You should first kill -STOP the daemon; if
  any children are running, you should kill -CONT, wait, kill -STOP
  again, and repeat ad nauseam. If there aren't any children, kill
  -TERM and then kill -CONT.

- Check whether you have any messages in the sendmail queue,
  /var/spool/mqueue. If you do, you will have to try flushing them with
  sendmail.bak -q. If necessary, wait a while and run sendmail.bak -q
  again. Repeat until the queue is empty. This may take several days.
  or delete the messages :)
  # rm /var/spool/mqueue/*
  # rm /var/spool/mqueue-client/*

- Check the crons
 # ls -a /etc/cron*
 - check if there are any sendmail files
 - and rename or delete them

- Remove the setuid bit on the sendmail binary, to prevent local users
  from gaining extra privileges through sendmail's security holes. The
  binary may be at several different locations:
 # chmod 0 /usr/lib/sendmail
 # chmod 0 /usr/sbin/sendmail
 # chmod 0 /usr/lib/sendmail.mx

- Move the sendmail binary out of the way:
 # mv /usr/lib/sendmail /usr/lib/sendmail.bak
 # mv /usr/sbin/sendmail /usr/sbin/sendmail.bak

- Check and remove the users if you want:
 # more /etc/passwd  -- check for smmsp, smmta
 # userdel smmsp   -- delete the user smmsp
 # userdel smmta   -- delete the user smmta

Basics of Cisco Switch

2007-07-23T10:54:00.000+01:00

Before you can administer the switch you are going to need some basic information:

What is the switches IP address or DNS name?
What is the username/password you can use to login?
What Ethernet switch port is the device in question connected to?

One option to configure the switch might be a web-based administration interface. If this is the case, basic configurations aren’t going to be that difficult and perhaps you don’t need much more help. On the other hand, GUI interfaces aren’t always available, but on Cisco IOS switches, the Cisco IOS always is. Plus, in a GUI interface, you won’t be able to do every possible configuration. In the command-line interface you will be able to perform every possible configuration. For that reason, I encourage you to use the IOS command-line interface. I will be performing these common switch administration tasks on the Cisco IOS command-line interface.

Showing the switch configuration

Just like on a router, the most command-switch IOS command is to show the switch’s configuration. This will show you the configuration for the entire switch, including all the Ethernet ports on the switch. To see switch configuration, just type:
# show running-config

Showing interface port status

Most of the time you are going to a switch, you want to troubleshoot a switch port, or change a switch port configuration.
The quickest way to see the status of your switch ports is to use the:
# show interfaces status

This command shows each port: if the port is connected to the device, the VLAN the port is in, the port duplex, the port speed, and port type. This is an excellent quick way to see status for your switch ports.

Changing interface speed & duplex

Say that you see that interface Fa0/21 is set to auto (auto negotiate) for its speed but it needs to be set to 10Mb/sec. To change the speed of any port, you go to interface configuration mode and use the speed command, like this:

On this switch, the possible speeds for the 10/100 Ethernet ports are auto, 10, and 100. On the Gigabit Ethernet ports, you can only tell the switch to either negotiate port speed or not to negotiate port speed.

Once the speed is configured to 10Mb, you can verify it with the show interfaces fa0/21 status, like this:

As you can see, the speed is now set to 10.

To change the duplex of a port, you perform the same steps but use the duplex command. Duplex can be set to auto, full, or half.

Enabling and disabling interfaces

To enable and disable interfaces, you use the no shutdown and the shutdown command in interface configuration mode. Here is an example:

Notice how when the port was shutdown, console messages appear that told you the administrative state had changed to down, and the line protocol changed to down. When the port was enabled (no shutdown), the link went down, then the line when up, then the line protocol changed to up.

You could now do a show interfaces status to see the state of the interface.

Tips and Tricks WinXp

2007-07-22T12:48:00.000+01:00

Command "Netsh" on Winxp
The netsh command on windowsXP can be used to do many things, some examples

To create a simple batch file for starting/stoping winxp firewall
Example:

Run: cmd.exe
c:\copy con fire.bat
netsh firewall set opmode disable | or enable ----- start or stop the firewall
^Z and enter -- saves the batch

Other examples:
Run: cmd.exe
c:\netsh firewall add portopening TCP 80 webserver ----- open port 80
c:\netsh firewall delete portopening TCP 80 ---- delete the rule