In the SysAdmin Lounge

Tips, trainings and warnings for the sysadmins in IT.

• IT Hiccups of the Week - IEEE Spectrum - Being “good” in IT is really hard. Much harder than people think.
• You may be a victim of software counterfeiting (or not) - MoonPoint support blog
• Defrag Tools: #58 - Sysinternals Streams and Autoruns Example - Defrag Tools Channel 9
• Plan Your Free Online Education at Lifehacker U: Fall Semester 2013 - Lifehacker has a really great roundup and details on free online courses covering a wide range of subject matter…and not just in IT.
• free-programming-books/free-programming-books.md at master · vhf/free-programming-books · GitHub amazing collection of online books and reference materials for programmers. Spotted in this Grab Over 500 Free Programming Books from GitHub post at Lifehacker.
• Students Can Get Microsoft Office 365 For Free - MakeUseOf blog. From the post…

Starting on December 1st, Universities that license Office Education for their faculty and staff can offer students Office 365 ProPlus for free thanks to a new program called Student Advantage. For students at these institutions, that means free access to Word, PowerPoint, Excel, OneNote, Outlook, Access, Publisher, and Lync. While many cheaper alternatives to Office have sprung up, many students still rely on Redmond’s good ol’ productivity tools.

• TRAINING: Utilizing SysInternals Tools for IT Pros - Kurt Shintaku's Blog. From the post…

Microsoft’s Virtual Academy has published a training course specifically for SysInternals Tools, including Process Explorer, ProcessMonitor, PS Tools, PsTools, Autoruns, etc.

Microsoft Premier Field Engineers step through a technical deep dive on utilizing SysInternals tools. This course focuses on key administrative and diagnostic utilities and addresses key insights, and best practices.

• TRAINING: Utilizing SysInternals Tools for IT Pros
  http://www.microsoftvirtualacademy.com/training-courses/utilizing-sysinternals-tools-for-it-pros

• Tracking page file reads and writes - Clint Huffman's Windows Troubleshooting in the Field Blog
• [PowerShell Tip] Using WMIObject to Check Disk Partitions Info and Block Size - Next of Windows
• PowerTip: Use PowerShell to Obtain Disk Image Info - Hey, Scripting Guy! Blog
• The Net Command Line to List Local Users and Groups - Next of Windows
• 10 reasons for using PowerShell ISE instead of the PowerShell console - 4sysops
• Where can I find the USMT return codes and error messages for USMT 5 based migrations ? - just another windows noob ? blog
• Viewing Cached Google Pages from DuckDuckGo - MoonPoint support blog
• Cache (explained) - DuckDuckGo features page
• DuckDuckGo !Bang - DuckDuckGo feature detail page

Cheers

Claus Valca

Read More

Some Notes for a Certain Project

Just some scratch notes for a special project I am working on.

Nothing of interest for most other folks.

Remote Desktop and Automatic Login - Microsoft Visual Studio Forum

try using this
   mstsc /admin /v:ComputerName

or these
   mstsc /console /v:ComputerName

Be sure to “Log Off” rather than click the “X” to leave the session running if you aren’t coming back. Kinda like your mom telling you to shut the door behind you on the way out of the house when you were a kid. Heard it all the time…

Generally it seems you cannot use Microsoft’s Remote Desktop Connection service to establish an interactive remote control session with the logged in/active user’s desktop (session 0 ?)  unless you do it with the appropriate above arguments. However doing so may make a mess of things depending on how you exit…at least this appears to be my current understanding.

• Use command line parameters with Remote Desktop Connection - Microsoft Windows.
• Access Remote Desktop Via Commandline - TechNet Articles - TechNet Wiki
• Mstsc - Microsoft TechNet - Windows Server
• MSTSC - RDP / Terminal Server Connection - SS64.com

Just because you can doesn’t mean you should, and if you don’t log off properly…like I said you can make a mess for others coming behind you. If you find just such a mess, these tips might help clean things up.

• How to Remotely Terminate and Disconnect Remote Desktop (Terminal Services) Connections or Sessions -My Digital Life
• How to logoff remote desktop sessions via command line tools? - ..:::: Anand ::::..
• Kill a remote user session remotely - Kode’s thoughts

In the end, RDC/RDP might be great or it might be messy.

If you are fortunate to be able to run UltraVNC services on some of your systems, you have some more options…especially if you are making a “headless” server box on a desktop OS platform. I’m personally more of a TightVNC guy myself but hey, close enough.

One of the problems might be that you want it to be a secure (AD/Domain) authenticated connection, but you don’t want someone to have to click “Allow/Disallow” on the headless system to approve that connection.

Fortunately there are options!

• Can you disable the "Accept - Reject" window? - UltraVNC Forum - Yes, yes you can..
• Install - UltraVNC
• UltraVnc Configuration - UltraVNC
• First Server Run - UltraVNC
• Rolling out UltraVNC - pre configure VNC Password - UltraVNC Forum
• ultravnc.ini - UltraVNC

And then…

• Deploying UltraVNC within an Active Directory environment using Group Policy - Virtually Impossible
• How do I setup MS Logon I or II? - UltraVNC Forum

User Redge wrote:

configure and set MS Logon I or II required only at VNC server.
a) following the doc...
http://www.uvnc.com/features/authentication.html
b) no if the UltraVNC setup was followed and exactly.
http://www.uvnc.com/install/installation.html
c) MS Logon I = Require MS Logon
http://www.uvnc.com/features/authentica ... l#mslogon1
d) MS Logon II = New MS Logon
http://www.uvnc.com/features/authentica ... l#mslogon2
Should set and required only at vnc server.
Important:
do not set vnc server as New MS Logon II on XP Home, won't work at all.

MSLogon can work, require turn OFF simple file sharing
windows XP

Open an Explorer window>Tools>Folder Options>View>The bottom check box

Headless systems are a pain…even if a modern BIOS can support booting without keyboard/mouse attached, and even if you can admin-pw lock the BIOS settings to prevent the USB ports from being active and used. Your system still may not boot if the NTLDR doesn’t see a proper video driver.

Headless System (Windows Embedded Standard 2009)  - Microsoft Developer Network post

• Creating headless systems - Windows Embedded Blog

In Windows Embedded Standard 2009 the support for headless devices starts with the availability of null-drivers for the standard MMI devices. Of course, the BIOS needs to support this kind of configuration, as well, but this should not be a problem on recent systems. The generic keyboard and mouse drivers in Standard are still present as well, when no hardware is connected, but the null driver for the VGA adapter needs to be added to the configuration. This requires the following components:

VGA Save could be left out, if there really is no VGA compatible chip on the board. This will create a dependency error, which in this case can be disregarded. Nevertheless, the benefit of having VGA Save in the image is that any time a graphics adapter card is plugged into the system VGA Save gets loaded instead of the Headless VGA driver. This enables screen output e.g. for field personnel troubleshooting the device. The VGA Boot Driver is required by NTLDR at boot time.

• Making the Server Appliance Headless - Microsoft Developer Network post
• Headless VGA Driver - Microsoft Developer Network post
• Headless Device Video Driver Processing - Microsoft Developer Network post
• Adding Support for a Headless System to your Configuration ... - Microsoft Developer Network post
• Headless VGA driver - Setting display resolution - Windows XP ... - RealGeek

One last element,

The BIOS should be configured to “re-spawn” like a good digital soldier in the event that the power is lost (even a UPS dies if power is off too long) or if someone hits the Power-off button perchance.

Likewise, if the Windows system is NOT on an AD Domain, and logging into a local workstation/workgroup account profile, then you lock it down pretty well (to the bare minimums to function, and enable the auto-login to the set profile: Tip: Auto-Login Your Windows 7 User Account | Cool Stuff | Channel 9. Pretty easy stuff for the auto-login.

The challenge comes up if you want to add it to the AD Domain and use a domain-based account for security/auditing purposes.

There are a number of ways to do this, each with their nuances. Some work better than others. Some are more secure than others. Consider the risk carefully before choosing grasshopper!

[SOLVED] Windows 7 - Auto Logon With Domain Computer - Mockbox.net post.  Easy enough with this registry-based solution BUT the user account and password are stored in the registry in clear-text.  You can roll your own .REG files for deployment with this method. However this could be a big security risk!

WindowsAutoLogin - freeware - IntelliAdmin. One nice feature of this application is that you can also control the number of times it allows an auto-login to occur and then after that “X” number of logins specified, it becomes disabled. That could be handy for some unattended (but brief) service events that require multiple reboots.

Autologon - Microsoft Sysinternals - Much better and easy enough to use. Per this post Safely setting autologon for Windows from the “Confessions of a Microsoft Consultant” TechNet Blog, we learn that AutoLogin saves the account/password string in the registry as a LSA secret.  That’s better than storing it in the Registry in plain-text, but it still is “easy enough” to penetrate and capture:

• LSASecretsDump - Dump LSA secrets from the Registry - NirSoft utility
• Use PowerShell to Decrypt LSA Secrets from the Registry - Hey, Scripting Guy! Blog - Why not since we are trying to learn PowerShell here too!
• Dump Windows password hashes efficiently - Part 1 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 2 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 3 - Bernardo Damele A.G. weblog - LSA Secrets info is here.
• Dump Windows password hashes efficiently - Part 4 - Bernardo Damele A.G. weblog
• Dump Windows password hashes efficiently - Part 5 - Bernardo Damele A.G. weblog
• Late night thoughts on security: LSA Secrets - ins3cure blog “Late night thoughts on security”
• LSA Secrets - WindowsNetworking.com
• Microsoft Windows Security Fundamentals: For Windows 2003 SP1 and R2 - Page 41 - Google Books Result

Autologon - commercial product from LogonExpert . I haven’t tried this product but it says it stores the logon information encrypted in AES 256, interacting directly with the WinLogon service to ensure nothing can grab the data. It has some really, really neat features.  The author has an overview of Free Solutions like what I have outlined above, as well as a Learn More about the product. There is an active download link from the page but I’m not sure if it is a limited-trial version or what. This may be a product that can provide both the “setup” features to enable AD-based auto-login and the security-needed for implementation. I’m really intrigued by this particular product.

Use this information wisely!

--Claus Valca

Read More

PowerShell Reference Post: The Train Cometh Near…

Ever have that experience when you wake up and realize that event, or project, or whatever that you have been working hard at avoiding or denying is “Upon You”?

Very, very soon down in the coal mine, the opportunity to have Windows PowerShell natively installed on all our Windows desktop system will be realized.

I’ve been doing some old-school “BAT” files and even some very light VBS scripts for a while now to help automate some IT sysadmin functions from the CLI to avoid use of EXE based third-party tools and utilities where possible. Sometimes this has proved wildly successful. Other-times, not so much.

What I probably need to do is hunker down and pound my head into the desk and keyboard and learnz me some Ruby or Perl or Python.

However, for whatever reason, those still seem super-overwhelming to try to figure out how to tackle.

Instead (for now), what I think I really need to do is take the big-boy step of getting some basic familiarity and comfort with PowerShell usage under my belt.

Since the base PowerShell should be on all our deploying Windows 7 systems (and upgradable to what, PS 4.0 now?) that would present a great opportunity to extend system and network administration tasks and increase efficiency.  And since I’m fairly comfortable with the Windows BAT file writing/debugging process, this jump may be a bit easier to make.

So anyway, this is just a list of initial PowerShell references I’m dumping so that I can start my learning process.

If my dear readers have any additional recommendations -- books, URL’s, on-line videos, blogs, etc. -- for helping someone get up to speed with learning PowerShell and its support for system and network administration tasks, please drop your tips into the comment jar.

Windows PowerShell - TechNet Script Center Introduction - Windows PowerShell 2.0, Windows PowerShell 3.0, Windows PowerShell 4.0

Getting Started with PowerShell 3.0 | Channel 9 - A nine-part Microsoft video series - “This Jump Start is designed to teach the busy IT Professionals about this powerful management tool. Learn how PowerShell works and how to make PowerShell work for you from the experts Jeffrey Snover, the inventor of PowerShell, together with Jason Helmick, Senior Technologist at Concentrated Technology. IT Professionals, Admins, and Help Desk persons learn how to improve your management capabilities, automate redundant tasks and manage your environment in scale.”

Advanced Tools and Scripting with PowerShell 3.0 - Windows Virtualization Team Blog - Coming August 1st - Free Microsoft Virtual Academy online presentation training event -- “Find out how to turn your real time management and automation scripts into useful reusable tools and cmdlets. You’ll learn the best patterns and practices for building and maintaining tools and you’ll pick up some special tips and tricks along the way.” I expect it will also be up on Channel 9 a week or so later.

PowerShell Script to Manage Java Browser Plug-In and Java Security Level - SANS Windows Security Blog

Download Windows PowerShell Quick Reference - Microsoft Download Center - “Quick-reference guide to commonly-used Windows PowerShell commands.”

Download Windows PowerShell 3.0 Step By Step Guide - Microsoft Download Center - “Microsoft by default has decided to display Windows PowerShell in the Windows 8.1 WinX Power Menu, although you can change it back to Command Prompt, if you wish. But for those of you who’d like to try you hand at learning Windows PowerShell 3.0, you can download these step by step guides released by Microsoft.”

The Windows PowerShell Toolbox - TechNet Script Center - Loads of links and references for using Windows PowerShell

Scripting with Windows PowerShell - TechNet Script Center - Webcast series links and references, scripts, download sources and usage guides.

Discover the Easy Way to Begin Learning Windows PowerShell - Hey, Scripting Guy! Blog

Windows PowerShell Team Blog

Download Windows Management Framework 3.0 - Microsoft Download Center - Contains Windows PowerShell 3.0 among other bits.

Download Windows Management Framework 4.0 Preview - Microsoft Download Center - Not yet ready for production release, this contains the bits for the next generation of Windows PowerShell.  Consider carefully before deployment as some big system incompatibilities haven’t yet been resolved.

Windows PowerShell 4.0 Preview - Rick Barber's Blog. From Rick’s brief summary post…

“You should note that the supported operating systems do not include Windows 8 or anything earlier than Windows 7 SP1.  Sources tell me that PowerShell 4.0 will be included with Windows 8.1 when it is released as well as Windows Server 2012 R2.

“Pay close attention to the link above as the Management Framework 4.0 Preview is not compatible with some Microsoft Server applications including all versions of Exchange server, SharePoint server, and other applications.  You really shouldn’t be installing a preview in a production environment, anyway, but rather using it locally on your workstation or laptop for testing and familiarization.“

PowerGUI.org - Free Windows Powershell Community. When we did a big rollover from Novell to Active Directory, the AD pros who were brought in had PowerGUI prominently displayed on their secondary monitor as they powered through the transitional operations.

PowerShell Pro! - website with tons of on-line tutorials for Windows PowerShell. It doesn’t look like it has been updated for a number of years, but if you are just getting started from the ground up, most of the material here should still be valuable, especially considering the rich illustrations and screen captures that accompany the primary guide texts.

PowerShell Analyzer - (now free) GUI tool to manage PowerShell scripting. Old TechNet Mag review here: Toolbox: New Products for IT Pros

PowerShell.com – PowerShell Scripts, Tips, Forums, and Resources. Community website.

learn windows powershell - YouTube search results on the terms

learn windows powershell - DuckDuckGo search results on the terms.

Cheers!

Claus Valca

Read More

Greased Monkey Business

It’s no secret that one of the major ways I manage to keep up with “goings-on” in the world of Technology and culture is with the use of a RSS feed reader.

Generally it goes something like this:

• Launch Feed reader (Newsfox or Omea Reader),
• Pull down article feeds,
• Read, review and analyze,
• Open feeds to be saved for later processing in web-browser, and
• Bookmark article/link.

Later I might do some sorting of the saved bookmarks by subject or category or blog-post idea.

When it comes time to actually compose a post, I will open up Windows Live Writer on one side of my screen and my web-browser in the other.

Then I do a combo of composing the text body as well as some drag/drop action from the saved bookmark links.

That’s all well and good except for a tiny gotcha I figured out about a year ago.

See, many (but not all) of my RSS feeds actual open up to a page link that was seeded with some extra feed-tracking data code.

For instance:

This article appeared in my RSS feed list, was interesting, so I launched the full article in my browser and bookmarked it: Design and create with nanoCAD, a totally free CAD solution - freewaregenius.

However if you take a look at the actual URL provided by the RSS feed link in the browser was:

http://www.freewaregenius.com/2012/07/03/design-and-create-with-nanocad-a-totally-free-cad-solution/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Freewaregeniuscom+%28freewaregenius.com%29

…rather than the direct URL of:

http://www.freewaregenius.com/2012/07/03/design-and-create-with-nanocad-a-totally-free-cad-solution/

I added emphasis in the first link to show the extra sauce the RSS link path adds.

That’s not really a problem, but adds a bunch of extra code (and tracking data) that doesn’t really need need to be present in the blog links that everybody jumps from. I’m all for fair tracking and they get my “ding” when I view the full page the first time within my RSS feed reader.

So what I had been doing is cleaning up the link first in the bookmark properties before adding it to a post.

Only sometimes I forget.

Well, actually, many times I forget and it can be a lot of work cleaning them up.

Too bad I couldn’t automate cleaning up the bookmarks somehow.

Although I couldn’t figure a easy way to do that, I did eventually find a brilliant Greasemonkey script that did one better.

It actually intercepts the RSS feed-load in Firefox and cleans it up before loading in the tab. Sweet!

Removing UTM data from URLs automatically for cleaner bookmarks -Christian Heilmann. From his post page:

“I’ve come across lots of delicious bookmarks that still have all that campaign monitoring stuff in them, which is annoying. To work around that I’ve just written myself a tiny GreaseMonkey script:

Install un-UTM for GreaseMonkey

“If the browser now opens a link that has UTM data in it, it removes the information and reloads the page without it to make for a cleaner URL.”

Christian is clearly brilliant and his solution works perfectly. No more tracking data appending of URL’s to my saved bookmarks!

Related:

• How to convert Greasemonkey scripts to Firefox add-ons? -WEDYN
• Tampermonkey (Greasemonkey for Chrome) - Chrome Plugins
• How To Install And Use Greasemonkey Scripts In Google Chrome -pcmastero.com

Mischief managed.

--Claus V.

Read More

Baseline of Windows Files in Incident Handling?

I’ve been sitting on this one for a month or so hoping I could uncover a better solution. Unfortunately I’ve not been as successful as I would like so here it is.

Chris Pogue at SpiderLab’s Anterior blog posted Manipulating Windows File Protection and Indicators of Compromise which contained lots of goodies.

Basically it was a carry on from a previous post on Windows File Protection and malware hunting. In this post Chris shows how WFP can be “subverted” by malware and what clues are available to the incident responder for searching based on his and Harlan Carvey’s prior work.

In Chris’s post he uses an unpublished tool to temporarily disable WFP, change “code” inside a protected system file, then allow WFP to restart, reboots the system and sees if WPF leaves the modded file alone. It did. Chris then documents the changes observed.

I’m focusing on this part here:

let's take a MD5 checksum of dllhost.exe for validation that we have successfully modified our target file.

c:\Windows\System32>md5deep dllhost.exe

a63dc5c2ea944e6657203e0c8edeaf61  c:\Windows\System32\dllhost.exe

OK, next, I ran a strings against the target file so make sure there was not the same string content that I decided to use.  In this case, a series of upper case letter "A"s.

C:\test>strings c:\WINDOWS\system32\dllhost.exe | grep AAAAAAAA

Now, I am going to simply append 20 upper case "A"s to the end of the target file.

C:\test>echo AAAAAAAAAAAAAAAAAAAA >> c:\WINDOWS\system32\dllhost.exe

Let's run strings against the target file to see if the modification took.

C:\test>strings c:\WINDOWS\system32\dllhost.exe | grep AAAAA

AAAAAAAAAAAAAAAAAAAA  <-- This is the results of the grep search.

Now let's check the MD5 checksum of the target file to see if it changed...as you can see by comparing it to the value from our initial MD5, it didn.

C:\test>md5deep c:\WINDOWS\system32\dllhost.exe

6fb2c878750a84946efacfc50c8e1f59  c:\WINDOWS\system32\dllhost.exe

(Note: I think Chris has a typo in the part I have bolded above. I suspect he meant to type “it did” as clearly the MD5 is now changed from the original file MD5 hash.)

While Chris focuses on the MFT and system logs to flag the event for additional attention, I was focusing on the (relatively easier to spot?) MD5 change itself. If you can spot that the change occurred, then maybe you can drill faster into the corresponding logs/records for event clues on the change itself.

Indeed, Rmdarcher commented in the post that one could “…run the System File Checker (sfc.exe)” to look for modifications.  Chris agreed and responded,

“I think the real challenge is not in the identification of the modification, but in the detection of the single file that was modified.

“As I pointed out in the post, and what I still think is the real meat of the issue, is how to tell? How can you tell if a legitimate Windows process has become weaponized. Again, think the best way to even get the point where you can employ something like SFC, is through live analysis, and correlation of data points.”

So what go-to options does a sysadmin have to see if a system’s protected files have been compromised by malware short of combing through the MFT and system logs?

Here are the ones I have come up with so far.

As Rmdarcher commented there is the Windows System File Checker.

• System File Checker - Wikipedia
• How to Run the System File Checker (Sfc.exe) Offline in Windows 7 and Vista - The Winhelponline Blog
• Microsoft Windows XP - System File Checker (sfc) - Microsoft Windows XP Pro Product Documentation
• How to use the System File Checker tool to troubleshoot missing or corrupted system files on Windows Vista or on Windows 7 - Microsoft Support KB 929833
• Description of the System File Checker Tool (Sfc.exe) - Microsoft Support KB 185836
• Windows File Protection and Windows - WIndows Dev Center on MSDN
• Availability and description of the File Checksum Integrity Verifier utility - Microsoft Support KB 84120
• How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program generates in Windows Vista - Microsoft Support KB 928228

That was a good starting point and eventually led me next to the File Checksum Integrity Verifier from Microsoft.

Warning The Microsoft File Checksum Integrity Verifier (FCIV) utility is an unsupported command-line utility that computes MD5 or SHA1 cryptographic hashes for files. Microsoft does not provide support for this utility. Use this utility at your own risk. Microsoft Product Support Services (PSS) cannot answer questions about the File Checksum Integrity Verifier utility.

The File Checksum Integrity Verifier (FCIV) utility can generate MD5 or SHA-1 hash values for files to compare the values against a known good value. FCIV can compare hash values to make sure that the files have not been changed.

With the FCIV utility, you can also compute hashes of all your critical files and save the values in an XML file database. If you suspect that your computer may have been compromised, and important files have been changed, you can run a verification of the file system files against the XML database to determine which files have been modified.
The FCIV utility runs on Microsoft Windows 2000, Windows XP, and Windows Server 2003.

In this case you would need to generate a “baseline” on a known/good system like the one you are comparing against. I imagine you would need to be at the same patch-level as your target system otherwise you run the risk of getting lots of noise to sort through.

• Uncover File Manipulations With File Checksum Integrity Verifier [Windows] - ghacks.net
• How to use the Microsoft FCIV command-line checksum tool - Michael Cobb at SearchSecurity.co.UK
• Microsoft File Checksum Integrity Verifier (FCIV) -George Birbilis @zoomicon

In that last link above "Kirill" comments a tip that leads to another tool, FCIV for PowerShell.

http://www.sysadmins.lv/content/scripts/PSFCIV_1.0.ps1

The author, Vadims Podāns, maintains an English blog here: PowerShell Crypto Guy's weblog

Unfortunately, it doesn’t appear any of the FCIV for Powershell related posts are in English. You can hop over to the Russian pages and do some translations to get the meat of Vadims’s work here: FCIV (Russian original pages) or trust Google Translate here Google Translate versions of PowerShellFCIV tagged posts.

The tool I would probably reach for first is OSForensics by PassMark Software. This is a very strong tool in its own right, but the component we are focusing here on is the “Verify / Create Hash”.

From the OSForensics - Download Hash Sets page:

OSForensics allows you to use Hash Sets to quickly identify known safe files (such as operating system and program files) or known suspected files (such as viruses, trojans, hacker scripts) to reduce the need for further time-consuming analysis. You can download some sample hash sets below. They are individually zipped.

• Office 2007 Enterprise (Vista) hash set (1,313 KB)
• Office 2007 Enterprise (Win7) hash set (1,978 KB)
• Common Keyloggers hash set (124 KB)
• Win7 Ultimate (32-bit) hash set (18,825 KB)
• Win7 Enterprise (x64) hash set (11,670 KB)
• Vista Business (32-bit) hash set (8,475 KB)
• Vista Business (x64) hash set (8,069 KB)
• XP Professional SP3 (32-bit) hash set (1,889 KB)
• XP Professional SP2 (x64) hash set (1,456 KB)

This is a nice “baked-in” feature for looking for suspect files. And again, I’m not sure how much “noise” would need to be sifted through based on OS patching updates to the system files.

Another nice feature of OSForenics hashing support is the ability to Import NSRL hash sets from NIST.

There are a lot of great resources on the web related to use of the NSRL hash sets and similar collections.

• Hash Database - SANS Internet Storm Center
• National Software Reference Library - NSRL Project Web Site
• jessekornblum: NSRL Query Tool - Jesse Kornblum tips us to a new project NSRLQuery by Robert Hansen.

  “He's written a client/server program, NSRLQuery, which takes the output of sha1deep and compare it against the NSRL. (Why SHA-1 hashes? The NSRL contains MD5, SHA-1, and CRC32 hashes. You have to pick one...) The results are written to files hits.txt and misses.txt. The former are the files from the NSRL, the latter are those which are not.”

• Malware Hash Registry - Team Cymru
• FileAdvisor | The Best Search Engine for Identifying Software Files - Bit9

md5deep and hashdeep (now at version 4.0.0) also provides a mechanism to “…to compute, match, and audit hashsets. With traditional matching, programs report if an input file matched one in a set of knows or if the input file did not match. It's hard to get a complete sense of the state of the input files compared to the set of knowns. It's possible to have matched files, missing files, files that have moved in the set, and to find new files not in the set. Hashdeep can report all of these conditions. It can even spot hash collisions, when an input file matches a known file in one hash algorithm but not in others. The results are displayed in an audit report.”

More on md5deep/hashdeep Audit Mode.

I see that George M. Garner Jr.’s Forensic Acquisition Utilities set includes the following tool that may be of use:

FMData.exe: An original utility to collect files system metadata, to produce and verify security catalogs (cryptographic hash sets) using one or more cryptographic hash algorithms and to verify system binaries using the system file checker (SFC) API.

Finally, there is the application “ICE ECC” from ice-graphics. This is probably an “off-label” application and I’m not sure how well it would work on a C:\Windows\System like directory. Again, you would need to first “baseline” a known/pure system and then you could compare a suspect system against that baseline to look for clues.

If anyone else knows of any ways to either baseline and/or cross-check the hashes on protected Windows System files to ensure their integrity hasn’t been subverted/compromised by an injected malware attack like Chris and Harlan originally discuss, please drop a line in the comments regarding the tool and/or technique.

Much appreciated.

--Claus V.

Read More

Mostly for Sysadmins and Windows Tweakers

One last linkfest dump before I turn my attention back to a freshly arrived hardback copy of George R. R. Martin’s A Game of Thrones to close out this dark, drizzly and fast-chilling night here on the Gulf Coast. My brother is deep into the book/HBO series and I think he runs an underground distributed book club network of sorts on it. Hence his gifting me this newfound wonder.

This linkfest is a collection of stuff mostly of interest to system administrators and Windows tweakers…your interest level may vary.

Looking at page hits (which I rarely do) it seems that the following posts remain all-time GSD favorites for some reason.

Blocking IE 8 "InPrivate" Mode

Blocking IE 8 "InPrivate" Mode – Updated

Some folks had issues following the steps to make their own REG files to enable/disable “InPrivate” mode on their own system, so I did some and posted the download linkage in the comments section.

I've created the registry keys myself and uploaded them to a shared folder on box.net. http://www.box.net/shared/b0fr5x0qg2

Click that link (or copy/paste it into your browser address bar) then download the "IE8InPrivateMode-Disabled.reg" file directly to your PC.

Depending on your anti-virus application it may complain as .reg files could be malicious. If you want to check, simply open it in Notepad to see that it matches what I have listed on my blog post.

Once you have it download it, right-click on the file and select the "Merge" option.
Depending on your version of Windows and the user-rights of your profile, you may have to confirm some warnings. If all goes well it should be added to the registry and when you re-launch IE8, you should see the option grayed out.

The other registry key in that folder re-enables the option. Follow the same steps and it will allow InPrivate Mode option to work again, unless blocked differently by one of Microsoft's Family Safety programs...

They work on both IE 8 and IE 9 by the way despite the posts being IE 8 centric at the time.

Anyway, the other day I noted this post Internet Explorer InPrivate Browsing Enable or Disable - Windows 7 Forums.  In it, “Brink” also offered some download REG files for merging into the registry.  Out of curiosity I compared them and they were pretty much the same except where my REG files just cover the HKEY_LOCAL_MACHINE key location, Brinks keys have that as well as one for the HKEY_CURRENT_USER key location as well. So basically with Brink’s you get a two-fer deal.

Mine or Brinks…take your pick.

How to REALLY hurt yourself with PSEXEC - Deleting the Undeletable Registry Key and More - Scott Hanselman Computer Zen- Scott’s battle with a “undeletable” registry key makes for a fun read. That said, while his PsExec method worked, I’ve had fantastic success when I’ve run into similar keys on malware-infected systems by using Malwarebytes : RegASSASSIN. I don’t know for sure if it would have helped in Scott’s issue, but I would try that first via the GUI it offers before dropping to the PsExec CLI work (though it is really cool). Related for difficult to delete files: Malwarebytes : FileASSASSIN.

It has been over 4 years now since I set Dad up on his Vista system at his house. In that process I ran into a challenge; how to get his and his wife’s profiles to display at different screen resolutions? She liked a relatively low resolution to see things larger, while dad liked the highest resolution to get the best screen display quality.  In my post of my fix Vista/XP Quick Screen Resolution Toggle Tip I used ResSwitch & ResCopy to create custom desktop icons that lets them just click-to-set the display level at their preference rather than digging into the properties each time.  So when I read this post at Windowshacker How To Set Different Screen Resolution for Individual User in Windows 7, I was curious.  Turns out there is a neat freeware product called Carroll that almost automagically can set individual screen resolution for every user when they log in.  No more clicking desktop icons. And it only took 4 years to get here!

Just in case it keeps you up at night fretting about the text for your Windows desktop icons being underneath them, the Windows Club offers a tip on D-Color which can Display Desktop icons text on the side in Windows 7. Now you can sleep easier.

Decoding Intel’s Laptop Processor List [Technology Explained] - MakeUseOf blog.  Nice explanation.

Dynamic Computer Naming in ZTI Deployments - The Deployment Guys - For you Zero Touch Installation (ZZTI) fans with that issue and need.

Any tech mystery that can combine low-level Windows troubleshooting and analysis with Hello Kitty makes it a Must Read in my book!  Submitted for your education--seriously.

• The case of the broken Hello Kitty IZMO toy (Part 1 of 2) - Within Windows blog
• The case of the broken Hello Kitty IZMO toy (Part 2 of 2)- Within Windows blog

Need more standard low-level troubleshooting tips? How about this exercise.

• The case of the vanishing print jobs - Ask the Performance Team

I’m not yet a Hyper-V guy, but I think it is really cool stuff and read up when I can.  I found this Series: Hyper-V upgrade posts at 4sysops to be helpful stuff.

Tenniswood Blog serves up some awesome remote access card P0rn with a nice Review: HP Microserver Remote Access Card.

Create internet bookmarks as browser-independent files on your desktop with HTMtied - Freewaregenius.  I’ve always found it frustrating that I can’t do this as easily as it seems it should be. Turns out the free tool HTMtied can assist with that process and make it a bit more bearable to do.

How to fix incorrect logon information for Windows XP mode - Virtual PC Guy's Blog - Ben’s solution is pretty easy to follow and will get you running again in no time.

Windows 7 Background Customization - The Deployment Guys blog. There are a number of ways to change the background image in Windows 7, doing so is a “signature tweak” I like to perform on all the systems I am asked to help set up for friends and family members; leaving them with an image that reflects their home/personality is a nice touch.  This post is a bit more technical and geared for pushing such changes for enterprise branding and such. Still good stuff.  I personally prefer to use Julien Manici’s free Windows 7 Logon Background Changer but there is also the Tweaks.com Logon Changer for Microsoft Windows 7 and the Windows 7 Logon Screen Tweaker 1.5. Many Windows7 tweaking suites also include this feature in them.

FREE Download Preassembled Windows 7, Vista, and XP VPC Images From Microsoft - Windows7hacker. I try to always keep the latest versions of these handy for ad-hoc testing in Virtual PC. Although at home we now exclusively run WIndows 7, there may be times when I want to trial something in XP or Vista. Rather than dual-booting or keeping another physical test-bed around, I just fire up one of these in a virtual session and away we go! They do have some operational limits baked in, but nothing that should be too much of a headache if you use em regularly.

FREE: Delprof2 – Reliably delete a user profile - As reviewed by 4sysops.  Seriously, if you ever deal with Windows user profiles and occasionally deleting them, you really need to refresh yourself on this post as well as the great freeware tool Delprof2.  While you are there, check out some of the other cool Free Tools from Helge Klein such as DiskLED and ListRegistryLinks which could be handy when doing some incident response work.

MoonPoint Support Weblog - List Installed Programs - This post tips us to a Bill James VBScript script, InstalledPrograms.vbs which when run from the command line prompts for a IP or PC name to remotely check for installed software (or leave blank to check your own). Save the resulting text file for review.  There are a number of “system audit” programs that can do something similar for local systems, but this is the first I’ve seen quite like this.  For generating a list of installed Windows programs on a local machine for reporting purposes and review, I prefer Nir Sofer’s MyUninstaller which seems to be significantly faster than Add/Remove Programs (XP) or Programs and Features (Win7) anyway for adding and removing programs. With MyUninstaller, after running I just select all and save the file in whatever supported format I prefer (usually tab-delimited).

Cheers,

--Claus V.

Read More

Quick Web Screen Grabs

One of the processes we have in the shop is to archive a series of network graphs for various URL locations that are created in a specialized MRTG - Multi Router Traffic Grapher deployment.

Once the web-page screen shots with the graphs are each captured, they are combined into a single Word document for that day which is then archived for historical reference and distribution to management.

The result is the daily tasking of an analyst for about an hour clicking through a large Excel table that contains each of the URL links, grabbing a screen shot, pasting it into the Word document, then moving on to the next URL.

This has been going on for some time and unfortunately, the madness of my other projects has kept me from turning my attention onto addressing it for a more efficient process.

Last week was a bit lighter at my workbench so I could consider the issue for a few minutes.

It took me about five minutes to come locate the free command-line tool IECapt - A Internet Explorer Web Page Rendering Capture Utility coded by Björn Höhrmann.

It’s just 102 kB unpacked and though it requires the gdiplus.dll, I had no problem finding that file already present on our XP Pro systems (and about fifteen others in various portable utility program folders on my own system).

My solution for this daily task was very simple.

I created a folder “C:\graphdumps” and copied both the IECapt.exe and (for good measure a gdiplus.dll I had on my system) into it.

I then created a batch file that had a line for each of the separate MRTG page URL’s we need to access.  In my case I had approximately 50 or so URLS each on their own line.

As an example, each line in the batch file has something along the following (all on a single line):

IECapt --url=http://www.uhcougars.com/ --out=GoCougs.jpg --min-width=800 --delay=5 --silent

I also choose an simple output filename for each URL line that was clearly indicative of the logical location each URL represented.

For now, I’m outputting as a jpg file format for maximum compatibility with the folks who would receive the final file, however IECapt supports a number of output formats such as .png, bmp, jpeg, emf, and probably a few other formats not listed in the help.  I like the idea of using a PNG format instead and may do some comparisons between the two formats moving forward.

I did have one “gotcha” I had to overcome first.

Every time I ran the batch file, I would get an output error unable to generate the thumbnail image.

I checked around and found this forum post IECapt does not work when --url contains a query string which did seem to confirm the issue was that the URL’s I was using in my batch file contained query strings.  I didn’t really like the options (recode the program or use a url-shorting service).  On a hunch I wondered what would happen if I encapsulated the URL parameter in double-quotes.

It worked perfectly.  So for example, each line in my batch file was now changed to add the “  “ accordingly.  It now looked more like the following on a single line.

IECapt --url=”http://weather.chron.com/radar/station.asp?ID=HGX19&NOHEADER=1#MAPZOOM” --out=radar.jpg --min-width=800 --delay=5 --silent

My test run of the batch-file took just under 1.5 minutes to complete the pulling and saving of all the pages.  I then opened up a blank Word document, selected all the output jpg files that had just been generated in my folder, and dragged/dropped them into the Word doc.  I then saved it with the daily file name and was done. From about 60 minutes of dreary click-saving URLs to under 2 minutes of mostly-automated grabbing and pasting. Sweet.

Now if I could just find a way to automatically import these images into a templated Word/RTF format document (with images embedded not linked) I will be set.  I’ve looked at “mail-merging images” into Word but I’m not sold yet on the process. There should be an easier way to just pipe the output into an RTF “word pad” document but I haven’t figured that out yet.  This way alone is a big improvement so for now a little drag/drop into Word isn’t a deal-breaker.  Thoughts/suggestions?

Additional notes:

I considered using the robust freeware tool SiteShoter by Nir Sofer.  It supports both a GUI and a CLI mode and is pretty sophisticated. However, for this application, IECapt worked perfectly and is dead-trim. SiteShoter can read out URL’s from a text file to act on, so SiteShoter is a different technique that could be better in some circumstances.

How to automatically capture images of a series of web sites and create thumbnails of the resulting image files. - Post by Paul Bradley that put me onto IECapt and how easy the CLI is to use.

Remembering to actually stop what we are in the middle of doing (especially annoying in the middle of a meeting) when the established URL capture hour comes around is quite challenging as well. More than a few days the designated team-member has forgotten and had to run the captures a few hours later.  Because this process uses a batch-file, one can easily set the batch-file to execute as a scheduled task automatically when the capture-hour occurs.  Then (as long as the system is running) we can come back later that afternoon and assemble the archive document from the jpg’s that were automatically generated. Super-sweet.

Cheers!

Claus V.

Read More

VBScript Resources

For the past few weeks at work, we have been doing some preventative response work on all the workstations across our enterprise environment.

The response was based on log-file results…only a problem was that sometimes the result descriptions we were being provided with either didn’t make logical sense or match what we observed when we manually checked some of the aberrantly reported systems.

I really don’t like chasing shadows, so I set out to find the mechanism generating the raw report data/logs which got re-canned into the report we had to respond to.

Not only did I find it (pretty easily) but I also found where it dumped the raw file daily.  So now we could pre-pull and assemble our own report at least a week faster than the canned report we were using got generated/refreshed. Sweet.

Finding the source, I discovered that the raw log file collector was actually a very nicely coded VBScript. (BTW, did you catch that Nir Sofer released a new CSV/Tab-Delimited file viewer and converter utility? And that MANDIANT announced a new release of their free Highlighter utility?)

Once I had a copy of it, I could then pick it apart to understand exactly what was actually being reported (source) and what the labels provided (on the canned report) actually meant.

Turns out, most of it was pretty close, but because of what the actual data-points are collected off the system, the way the application called to generate the raw-result returns, and those returns are manipulated to generate the report, the labels might not be “logically accurate” as they could be in technical matters, although they may be “practically accurate” for the machine status items being measured and concerned with.

So now our response teams know what the report is “really” telling them, we can all prioritize our responses a bit more finely.

Only to get to that point of really understanding what the VBScript was doing--remember IANAC (I am not a coder)--I had to get up to speed with some VBScript fundamentals.

So in doing so, I found these VBScript resources to be awesome in the process.  Many are in PDF and/or DOC format so you can keep them handy.

Enjoy.

• Introduction to Visual Basic Scripting (VBScript) - irt.org
• VBScript Primer - Microsoft TechNet
• VBScript Overview- Microsoft TechNet
• VBScript Reference- Microsoft TechNet
• VBS Reference (.doc) - Microsoft - Microsoft Download Center
• VBScript » Introduction - DevGuru Quick Reference (Note: free 307 page PDF version link on that page)
• VBScript Reference Manual (direct PDF LINK) - Indusoft.com (255 pages)
• VBScript VBScript User's Guide (direct PDF LINK) - gatech.edu (331 pages)
• VBScript User's Guide - MSDN Library

--Claus V.

Read More