--win 7 -- (still..) "good usage" for utilman.exe and sethc.exe

Physical access -> bootcd -> change .exe -> 0wned

If you have access to a Win 7 Box, you can still replace the binary c:\windows\system32\sethc.exe by cmd.exe (or meterpreter) and trigger it pressing 5 times the shift key on the login screen. 


This also works by replacing c:\windows\system32\utilman.exe, and pressing WINKEY-U in the login screen. (boot from CD to change the files)

....

You can also achieve same results by setting executable of your choice as Debugger to sethc.exe under Image File Execution options in registry. So in a priv command shell, it would be

REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe"

Same goes for Utilman.exe
....

Tip, Verifying Windows Box state, before and after installing a software

Monitor an Install Program Without Using Any (Expensive) Tools

Finding out what files have been copied/updated by another install program is very easy when you know how.

   1. First of all, take a 'clean' machine, i.e. one that has only got an operating system on it.

   2. Make a dump of the file list.  This can be done by typing
      DIR c:\*.* /s/one >c:\before.txt
   3. Open REGEDIT.EXE and go to Registry->Export Registry File and save the registry as   c:\before.reg
   4. Install the product that you want to monitor

   5. Make another dump of the file list by typing
      DIR c:\*.* /s/one >c:\after.txt

   6. Open REGEDIT.EXE and go to Registry->Export Registry File, as before, and save the registry as c:\after.reg

You now have all the information required to find out everything about the program that you installed 
---------------------------------------- ---------------------------------------- ----------------------------------------

Tips for Windows Uninstalls

Recently i had a problem with my laptop and Win7, and i did a little research for uninstallations here's some tips:


On the Registry here's the KEY were you can find the uninstalls strings:
HKLM\Software\microsoft\windows\currentversion\uninstall


You will find some folders and inside each the corresponding application and uninstall strings ;)


One of the applications that microsoft gives for uninsttaling drivers is "dpinst.exe"


If you need to look at the install or uninstall log, goto 
c:\windows\dpinst.log


That's it, just another quick tip.
.

Socat - nifty tool ;)

Here's some tips to test "socat"

: connect to port 80
> socat - tcp4-connect:192.168.1.1:80
-----------------------------------------------------------

: connect to port 80 + verbose
> socat -d -d - tcp4-connect:192.168.1.1:80
-----------------------------------------------------------

: listen to port 80
> socat -d -d - tcp4-listen:80
-----------------------------------------------------------

: Port forward : listen on port 443 -> send to 80 of the host
> socat -d -d tcp4-listen:443 tcp4:192.168.1.1:80
-----------------------------------------------------------

There's lot's more, try socat -h
.

examples:
http://technostuff.blogspot.com/2008/10/some-useful-socat-commands.html

Windows - Create file to test filesystem - utility

To create a file filled with zero's on windows;

fsutil file createnew name-of-file.txt 2000 (this is the length in bytes)

This will create a new file with 2000 bytes.

This can usefull for copy / perfomance disk testing.

.
.

Active Directory Database - Files

Important files of Active Directory.

Active Directory Database is stored in %systemroot%\NTDS\
the DB file is ntds.dit

The files in this directory, and what they do;
1:ntds.dit : this is the main database file for active directory.
2:edb.log  : When a transaction is performed to AD database, it will be stored to this file, and then after it will be sent to the Database
3:res1.log : Used as a reserved free space, in case of disk low space, default size is 10MB.
4:res2.log : Same of the above.
5:edb.chk  : Records transactions committed to the AD database. During shutdown, "shutdown statement" is written to this file, if it is not found during system startup the AD database checks the edb.log for updated information.

Ntdsutil: tool that can verify database integrity

.

Roll Back Windows Patch - KB

On a Windows box, regulary we should patch and update, on any box, on any operating system updates are important.


But what if after a patch or KB.exe on your pc/server you receive a "blue screen" error?


There is a way of "rolling-back"!

1. Boot from your Windows XP CD or DVD and start the recovery console.

Once you are in the Repair Screen..

2. Type this command: CHDIR $NtUninstallKB977165$\spuninst

3. Type this command: BATCH spuninst.txt

4. Type this command: systemroot

5. When complete, type this command: exit


This should do it.

Which User loged on what workstation - "short tips" - Windows2003 domain

A short tip ;)

To find out were "someuser "is logged on what "workstation"

We go to the domain PDC ( check "netdom query fsmo")

->eventvwr -> security -> filter by

-> "event source":security

-> search the user you are looking for on field - user:

john

That's it.

Diagnostics on Win2003 AD

Some commands for diagnostics on Windows Domain Controler


==== Diags Commands ====
Check - c:\windows\NTDS - ntds.dit / edb.xxx
c:\windows\SYSVOL\sysvol\domain.local --- subfolders
share - NETLOGON -> c:\windows\SYSVOL\sysvol\domain.local\SCRIPTS
share - SYSVOL -> c:\windows\SYSVOL\sysvol
Check - DNS console - SRV records - _msdcs.domain.local
= nslookup
nslookup gc._msdcs

= dcdiag /test: replications
dcdiag /test: topology, cutoffserver, netlogons, fsmocheck, DNS, frssysvol, frsevent, kccevent, systemlog, RegisterInDNS,
= repadmin /replsum
= repadmin /showrepl
== repadmin /replicate destDC courceDC NamingContext /force
= repadmin /showconn
= repadmin /showreps

= netdom query FSMO == netdom /verify DSTBDC /domain:domain.local
= netdom query DC

= nltest /DSGETDC:domain.local

= dnslint /ad /s localhost /v
= dnslint /d domain.local /s 10.x.x.x /v
explore
= dcdiag
= netdiag

= w32tm /config /syncfromflags:manual /manualpeerlist:10.x.x.x
= w32tm /config /update
= w32tm /dumpreg /subkey:parameters
= w32tm /monitor

-----Test------------ exchange "Service Principal Names" - LDAP --------------------
setspn -L "servername"
setspn -?

win2003 AD cheat sheet =D

Some diags i like to run on Win2003 AD:

==== Diags Commands ====
Check -  c:\windows\NTDS  – ntds.dit / edb.xxx
c:\windows\SYSVOL\sysvol\domain.local — subfolders
share – NETLOGON -> c:\windows\SYSVOL\sysvol\domain.local\SCRIPTS
share – SYSVOL -> c:\windows\SYSVOL\sysvol
Check – DNS console – SRV records – _msdcs.domain.local
= nslookup
nslookup gc._msdcs

= DCDIAG /C /V       <————– TESTES ao DC —————- > NETDIAG /v /debug > netdiag.txt
= dcdiag /test: replications
dcdiag /test: topology, cutoffserver, netlogons, fsmocheck, DNS,  frssysvol, frsevent, kccevent, systemlog, RegisterInDNS,
= repadmin /replsum
= repadmin /showrepl
= = REPADMIN /SYNCALL /A /e /d /q
= = REPADMIN /SYNCALL /A /e /d /q /P
==  repadmin /replicate TargetDC SourceDC NamingContext /force
= repadmin /showconn
= repadmin /showreps

= netdom query FSMO                           == netdom /verify DSTBDC /domain:domain.local
= netdom query DC

= nltest /DSGETDC:domain.local

= dnslint /ad /s localhost /v
= dnslint /d domain.local /s 10.30.1.217 /v
explore
= dcdiag
= netdiag

= w32tm /config /syncfromflags:manual /manualpeerlist:10.1.1.1
= w32tm /config /update
= w32tm /dumpreg /subkey:parameters
= w32tm /monitor

—–Testar———— exchange “Service Principal Names” – LDAP ——————–
setspn -L “servername”
setspn -?
Netsh -  —– http://technet.microsoft.com/en-us/library/bb491071.aspx

Dnslint - Utility

The dnslint (windows 2003) utility tests various dns options.

To use it we can try the following:

> dnslint /d "domain.name" /s 10.1.1.1 /c

Explanation of the flags used:
- /d set's the domain to test
- /s flag it's used to bypass the Internic whois lookup, and use 10.1.1.1 dns
- /c flag is for testing mail servers

It can be used to test a lot more, with /ad flag it will do requests to active directory.

There is a lot more flags, do a simple
> dnslint /? |more

to see the options

Windows 2003 utilitys

Some commands that are very useful:
diskpart - disk partition

dnslint - dns test / report
nslookup - dns test - interactive
nltest - test - domain / trusts

netsh - net "shell" -
netsh firewall show config - show windows firewall configuration

dcdiag - test dc's
netdiag - test network / dc's

ntdsutil - ad utility

To show last replication summary - 0 errors = Good
repadmin /replsum /bysrc /bydest /sort:delta

To show AD Roles, FSMO - Flexible single master operations
netdom query FSMO

To show last replications:
repadmin /showrepl

Set Time - Win2003

- To set the time in a Windows 2003 server you can use the w32tm command

- w32tm /?
- w32tm /config /manualpeerlist:10.1.1.1 /syncfromflags:MANUAL

- net stop w32time
- net start w32time

- w32tm /resync

And that's it, now you will have your server setting the time from the ip:10.1.1.1

"Wait" command in Windows

To make a basic "wait" command in windows we can do like this:

: ping 127.0.0.1 -n 5 -w 5000 > nul

this command will do a wait for 5 secs.

Could be usefull

Tips and Tricks WinXp

Command "Netsh" on Winxp
The netsh command on windowsXP can be used to do many things, some examples

To create a simple batch file for starting/stoping winxp firewall
Example:

Run: cmd.exe
c:\copy con fire.bat
netsh firewall set opmode disable | or enable ----- start or stop the firewall
^Z and enter -- saves the batch

Other examples:
Run: cmd.exe
c:\netsh firewall add portopening TCP 80 webserver ----- open port 80
c:\netsh firewall delete portopening TCP 80 ---- delete the rule