Finding a Specific Microsoft Patch on a Host

After the Word (.rtf) 0-day was announced at the end of March, we turned on an alert to let us know when an .rtf file was delivered to the company.  Until the patch was applied, we actually blocked the incoming mail, inspected it, and if it was clean, we allowed it to reach its destination.  After the patch, we just alerted on the incoming mail. 

It's been a couple of months, and we are still getting the alerts.  Before I turned off the alerts, I wanted to ensure that the patch was on my host.  A quick script I ran to look for the specific patch was:

wmic qfe | find "KB2953095"

It seemed to work ok.

If there are better/easier ways to do this, leave a comment.

Somewhat off-topic....I can't believe the number of people that still send documents as .rtf.  Why not just use Word?  Or a text document?  The number of incoming .rtf documents was way higher than I would have guessed.  Most were resumes or travel booking documents.

SANS SIFT 3 and the Desktop Share

I had the new SIFT 3.0 downloaded for a while, but I haven't been using it as much as I would like.  I've been using the older 2.x version. One of the main reasons is that on the 2.x version of SIFT, there was a desktop shortcut that took me directly to a directory of the host OS.  This is missing in the 3.0 version of SIFT.  I fully admit, I don't know linux as well as I know Windows.

Quickly reading up on the issue, and I found that this mount to the guest OS should be found in mount_points/hgfs.  I had that directory, but nothing was populated there.  And, in the Virtual Machine Settings, I had the Shared Folders set to Always Enabled.  Still nothing.

On a reboot, I noticed that there was an update to VMWare Player.  I updated, and checked the mountpoints directory, but still nothing.  One last google suggested running vmware-config-tools.pl.

Sure enough, after answering the questions, that did the trick.  Now, in the mout_points/hgfs folder, I see a subfolder for "C".  Bingo.

Now I have to get used to Unity and finding what I used to be able to find in SANS SIFT 2.x.

If anyone else has tips on making that transition, feel free to leave advice in the comments.

Finding Inactive Accounts

The SANS Top 20 Controls has a control named Account Monitoring and Control.  Within that control is a Quick Win:  Ensure that systems automatically create a report on a daily basis that includes a list of locked-out accounts, disabled accounts, accounts with passwords that exceed the maximum password age, and accounts with passwords that never expire. This list should be sent to the associated system administrator in a secure fashion.

We don't have an automated report of those types of accounts, and quite frankly, we have very poor visibility into account control.  Coming from a DoD environment, I'm not used to having such lax controls.  Slowly, I'm starting to push the company forward, but it is taking time.

My first thought was to look at the inactive accounts.  I figured that these accounts would be low enough of the low-hanging fruit to start with, and here's how I have gone about finding them.

(Note: that I have created a master script that will do more than what this post details...I'm only describing inactive accounts at this time.)

1.  This command is in a batch file:  dsquery user -inactive 4 -limit 3000 > accountout.txt

Call the output file what you like.  The -inactive 4 parameter tells dsquery to look for accounts that have been inactive for at least four weeks.  I picked four to start with, as I realize that we have users that travel extensively.  My hope is that once we manage the output, I'll be able to lower that number.

2.  I took the output of the file, and copied it to Excel.  From there, I went to Data>Text-to-Columns in order to break up the data nicely.

3.  Column 2 seemed to be where I could differentiate between user and non-user accounts.  I filtered on just user accounts and copied that to a new sheet.

My results were staggering.  There are way too many accounts.  My next step is to find or create a process to validate that these accounts are a) legitimate, and b) truly inactive.  Spot checking a bunch of these users revealed users that are contractors.  And, if I have to guess, they are no longer with the company.  Prime targets to attack - which is why they should be disabled or deleted.

Once that's done, I'll need to automate the process and schedule it to run weekly or so.  As for locked-out, disabled, and password length checking...those will be added in time.

Finding hostnames on a Subnet

We have offices all over the world.  What I came to learn today is that there are two countries where we have very poor visibility into our own corporate networks.  To the point that I suspect that they are not managed very well, if at all.  I know I chase down malware in a couple of the networks on a daily basis. 

One of our admins asked me if there is a way that we can get all of the hostnames on one of those subnets that we don't have much visibility to.  NMAP would have worked well, but I wanted to come up with a command that I could have had a non-technical person run and send me the output. So, using a little Command Line Kung-Fu, I came up with:

for /L %A in (0 1 255) do nbtstat -A "XXX.XX.XXX.%A">>hosts.txt

Substitute your subnet for the Xs in that command.

It worked like a champ.  I suspect that there is an easier way to do this, but this worked easy enough.

PhishMe and Sophos Enterprise

We're starting up a security awareness campaign, where, in part, we will be using PhishMe's service to phish our employees; where falling for the phish will lead to training and education.  PhishMe provided us with the list of all the domains that they own so that we could white-list them in our proxies.  I tested them all, but there were two or three domains I still couldn't reach.

Sophos Enterprise provides a method to explicitly allow connections to specific web sites even if the Sophos proxy would normally block it.  (Exceptions can be added in the Web Control, on the "Website Exceptions" tab.)  Pretty simple.

However, after adding the domains to the exception, there were still two or three domains that I still could not reach.  I didn't want to just exclude those domains from scenarios, as I felt it might limit my choices.  I found that the Anti-Virus and HIPS Policy has a section that addresses domain blocking...and I believe this is if the AV thinks that there is malware on the page.  If you view your "Anti-Virus and HIPS Policy" you will see a section mid-way down the screen titled Web Protection.  If it is on, click the Authorization button at the top of the screen.  Go to the Websites tab, and add the domains you want to white-list.  Bear in mind that the AV will not scan these domains.  Once you hit OK, you should be able to browse the domains.

Fixing CAC access to a website when certificates seem to be the problem

A co-worker lost CAC access to ONE of the DoD websites we routinely access.  One, of the four or five we use on a regular basis.  We tried switching browsers.  We tried removing certificates.  We tried re-installing (from our install file.)

In the end, it seems like following the instructions in this PDF did the trick.

Ultimately, I think the install-root file for the root certificate was newer than our file, and so I believe newer certificates were added.  Also, the PDF mentioned some specific certificates that had to be removed.

Recovering from a Blue Screen after upgrading XP to Service Pack 3 from Service Pack 2

I received a laptop that had XP Service Pack 2 on it. During the reboot after installing Service Pack 3, the laptop blue screened. I could not get in at all. A little elbow grease and some googling, and I was able to get back to where I was before the original upgrade. Here are the steps I took.
1. As I could not get past the blue screen, I had to use recovery console. Put an XP cd in the drive and boot the machine. (Of course, on my machine, I had change the boot order in BIOS.)
2. Press any key to boot from the CD.
3. When the "Welcome to Setup" message appears, press R to start the Recovery Console.
4. Select the Windows XP installation (I had only 1.)
5. Enter the admin password (a miracle that I had this.)
6. When you get the command prompt, type: cd $ntservicepackuninstall$\spunist and hit enter.
7. When you get a prompt back, type: batch spuninst.txt and hit enter.
(You will see error messages and files being copied, this is normal.)
8. Remove your cd.
9. When you get your prompt back, type: exit and hit enter
10. Restart the computer in safe mode.
11. Log in as administrator.
12. Either open Control Panel, or Start -> Run and type: appwiz.cpl
13. Click the check box to Show Updates.
14. Scroll and find Windows XP Service Pack 3...and click remove.
15. Click Finish to restart the computer after the removal process is finished.

Now, I have to re-apply Service Pack 3 to get this computer up to date. But, at least I'm beyond the blue screen.

Using Foremost to recover files from a dead hard drive

A client gave me a 250 gig hard drive that wouldn't boot any more. I was hoping it was a problem with Windows, such that I could image it and move on. However, when I tried imaging the drive, it would fail after 145 gigs of imaging. I tried this a couple of times and was able to repeat the fail at the 145 gig mark. Without a physical image, I wasn't able to pull out the logical partition. However, the client was asking what word documents I could pull off the machine.

So, with an image (as complete as I could make it) I decided to carve out what I could find. I edited the foremost.conf file to uncomment the "doc" file type. Following that, I ran foremost:

foremost -o /path/to/foremost/output -c /path/to/formost.conf /path/to/image

This bombed right away. I shouldn't say that it bombed, rather it brought back many files, and most of them were huge files, quite obviously not Word documents. Taking a look at the documentation, I decided to add the -q switch, which starts the search of files on sector boundaries. This produced more files, but all of them were gibberish...at least, I couldn't read anything meaningful from them. I took another look at the foremost.conf file and some postings on the internet and found that the ole type has automatic extration. And, I would not need the config file. My final command was:

foremost -q -t ole -o /path/to/foremost/output /path/to/image

This carved out plenty of Word files for me. I'm going to try carving jpgs in a few minutes. One spec I haven't found is Word 2007 files (docx) or excel files. If you have a config that can be used in a foremost.conf file for those formats, I'd appreciate it. Just leave a comment.

Using AppDetective to audit a MySQL database

I'm still in the middle of a big project testing web applications. Most of the databases have been SQL Server or Oracle. Believe it or not, we've run into some Access databases as well. And I'll admit, I did not know that Access could be used as a back-end to a web application. Yesterday, I had to test a MySQL database. The DoD has not put out a specific checklist for MySQL, and there are not SRR Scripts for MySQL either.

We did have AppDetective, though. We've run into many issues with getting AppDetective to audit LotusNotes databases, so I was a little worried. But, I'm happy to say that it was pretty straight forward and I got good results back.

To do this:

Fire up AppDetective
Add an application

• Fill out the DNS Name / IP Address
• On the Port tab, pick MySQL (and the correct version.) For my test I was able to leave the default port, but you could add the port if it is not on the default.
• On the platform tab, select the platform that the application is running on.
• On the Miscellaneous tab, I added the version of MySQL.

Once the application is added to the right pane in AppDetective,
Expand the + signs until you reach your application.
Right-mouse click on the app, and pick Audit with....
then choose your audit policy

(Of course, you could run a Pen Test, or pick any number of audit policies.)

I chose Strict.

The AppDetectivePro - Run Audit window will pop up.
Right-mouse click in the username/password frame.
At this point, you can fill in the username and password combination that will grant you the access you need. I always test the DB connection, just to make sure every thing connects and works.
Click OK.
Then, click the Run Audit button to start the test.

If I've left anything out, leave it for me in the comments, and I'll update the post.

SANS: ADSL Router / Cable Modem / Home Wireless AP Hardening in 5 Steps

(This is probably for my own edification, so I don't lose the article, and can easily remember where it can be found.)

SANS has a great, simplistic article on securing a home access point that everyone with a wireless access point should read. And follow.

Getting Nessus running on Ubuntu (Feisty) on a Thinkpad T40

Notes for myself, hopefully, they'll help someone else.

I noticed that Nessus was available from the Ubuntu repositories.
I added it through Add/Remove, but realized that it did not include the server package.
Type: "sudo apt-get install nessusd" to grab and install the server.
Next, run: nessus-mkcert to create a certificate.
Next, run: nessus-adduser in order to create a user to run the scans from.

I ran Nessus, both the server and the client. However, the scan was limited because I did not have many of the plug-ins. To get the plug-ins, I went to http://www.nessus.org and register for free. (Free gets the newest plug-ins after they have been out for a week.) You will receive the key to unlock the program in the email that was used to register. To activate it, type:

sudo nessus-fetch --register

(In the future, to update the plug-ins: sudo nessus-update-plugins)

That done, it's time to run Nessus.
To start the server and put it in the background, type:
sudo nessusd -D

Wait for the command prompt to come back (plug-ins will be loaded.)

Then, you are able to run the client program from Applications -> Internet -> Nessus

That should do it.

Kismet on a Thinkpad T40

It took me a bit, but I finally got Kismet installed and running on my Thinkpad T40. I believe the on-board wireless chip is a Cisco, and as such was not easily detected. There were a couple of things I needed to fix.

Mainly, I had to edit the read-only kismet.conf file.
In the file, there were two settings that needed to be changed. The first was the user Kismet would drop into if needed. I run Ubuntu, and to get Kismet to work properly, I start it with sudo. Secondly, you need to add a source record. This was the hardest part for me. A quick check at the ThinkWiki showed me that the wireless card could have been one of three manufacturers. A little trial and error got me to the Cisco card (and even that had some tricky conventions.) In my case, I set the source = "cisco_wifix,eth1:wifi0,Cisco" That middle parameter was the tricky part. For the Cisco card, you have to list both configurations. You can get a listing of the different chipsets and parameters at Kismet's documentation page.

To get Kismet running, I just typed 'sudo kismet' and away I went.