Final Build

Well the end of school is finally here and we're as done as we're going to be with our final build lab. The basic jist of this excercise was to take a disorganized workgroup organization and produce a three site Actice Directory controlled organization featuring two Domain Controllers, Two DNS servers, and a RRAS server at each site. Feel free to download the files from the margin of this blog for your review, for your portfolio if you were a member of this class, or as a model for future classes.

Local Password Bypass

Ok, before I start I would like to put a disclaimer on this article (actually this could apply to all my articles). The author of this blog offers this information as an educational resource only. Please do not use the information in this blog on any system other than your home PC without the express consent of the owner or company involved. The author is hearby innocent of any damages incured by the misuse or illegal use of the information stated or implied in this and all other articles written. ok, now on to the good stuff.

Ok, for most of you out there in the IT fields you have probably come across a situation where you needed access to a machine and the password was not available for on of millions of weird reasons.

Originally I used a suite of tools called the PC Doctor (not to be confused with The Computer Doctor) which resets the password parameter.

I also used OphCrack (bootable CD or as part of Backtrack 3 & 4) which cracked the Hash with pre-configured rainbow tables. This could take between 5 - 15 minutes depending on the targets processor.

I finally found a new tool, thanks to Snubbs at HAK5, which is fast and undetectable.

The tool is called Kon-Boot which is deployed as a bootable CD or Floppy.

Instead of cracking a password or changing the password, it temporarily changes the kernel so you just press enter and you get into the local machine. The only downside is this is for local machine use only and does not log you into Active Directory (to my knowledge).

Another plus is that this disk can be used for both Microsoft as well as some Linux Distros. Just insert the disk, boot up, press any key when the screen comes up and press enter when asked for the windows password. (see the website for Linux instructions)

According to the website this disk works on Windows XP, Vista, 7, Server 2003, Server 2008, and with Grub 0.97 Gentoo, Ubuntu, Debian and Fedora.

Attention all bored hackers. If anyone can test this program on the following systems and report back, i'll re-edit this post and credit your find. Windows 95, 98, NT workstation, 2000, ME, XP CE, XP SE, NT server and server 2000. Also Kubuntu, Edubuntu, Mepis, OpenSuse, and any other mainstream Linux Distros.

Contest Submission

Life's been pretty busy lately with interviews, homework, still trying to pass 70-291 plus learn 70-350. There's also a special lady in my life now, but i'm sure she'll make it into future blogs.

So I was watching this weeks episode of Hak5 and I had almost forgotten that there was a contest on mapping your home LAN, so I hurried to my visio console and threw together the computer doctors home map and submitted it. It would be cool to win, but even if I don't, it was fun to make. To see my submission and all the others, check out the user submission page.

Taking Time Out

So as most of you know I've been studying for my 70-291 like crazy lately. So to blow off some steam, I took a day off just to play with the boys. I also gave Drake his first big boy haircut. Hope you enjoy a few moments of fun with my boys and remember to take time off to enjoy your summer as well.

IPSEC Request, Reply or Require

In this video I explore the different policies in IPSEC; Request, Reply or Require. The video shows some common servers and clients with these policies (or lack thereof) in effect and how they relate to eachother.



While this isn't the first instructional video I've produced, it is the very first video I've ever put into a blog, so please forgive the few mishaps towards the end of the video, and as always I hope you enjoy.

How VPN Access Works

Maybe you're a telecommuter or an offsite salesperson or a manager that was roped into taking your work home with you and your company set you up with VPN access. All you know is that you log in with an icon and punch in your key number, swipe your card or verify a certificate... but what happens behind the scene to make this work???

VPN or Virtual Private Network isn't much of a mystery at all. It is a series of hoops to jump through to let the companies network know that you are supposed to be there and it's ok to let you in.

For this example (refer to picture at the bottom) I have set a RAP rule (remote access policy) illustrated by security guards, in honor of my youngest brother, with 4 questions... lets go through this step by step.

1. User "dials in"
2. Rule number 1 asks "is it between 6am and 6pm?" lets assume it's is... go to the next rule
3. Rule number 2 asks "are you a member of our ADUC (active directory)?" lets again assume yes... go to the next rule
4. Rule number 3 asks "are you authorized for dial-in / vpn access?" lets again assume yes... go to the next rule (NOTE: many times this question becomes a stumbling block because the system admin or other IT personnel forgot to check the dial-in access in the users active directory profile)
5. Rule number 4 asks "are you using the right security protocol?" (ie. MS-ChapV1 or EAP ect.) lets assume yes again... access is granted!!!

If at any time one or more of those questions are answered with a no, the user is denied access and should call their local helpdesk for help troubleshooting their access denial.

Hopefully this article was an interesting primer on VPN Access. RAP rules are as various as Group Policies in Active Directory but also just as easy to implement.

If you are interested in different security protocols or any other item touched in this article please let me know in the comments and I may write a follow up article.

How we resolve websites through the use of DNS

Ever wonder how when you type in http://www.google.com/ you end up going to a site with an IP address of 209.85.171.100 (or something similar) ? I never type in an IP address to get to a website, do you? So how does information flow through the system of tubes to get to you? (the internet was never a system of tubes of course http://en.wikipedia.org/wiki/Series_of_tubes) The answer lies in an ingenious system of lookups in the DNS process or Domain Name Service. I'll go through the steps for you so you can get a better grasp of what is going on durring the few seconds from when we press enter and your desired webpage pops up.



For this example we are useing http://www.google.com/ which is broken up as www(web server).google(secondary level domain).com(top level domain).(root level domain)

1. The user types http://www.google.com/ into their favorite browser and presses enter


2. The PC initiates a recursive query to their corprate, home, or ISP DNS server.


3. The DNS server looks at their root hints to find the root zone server and does the first interitive query to it


4. The root zone server sends the information about which top level domain server should be contacted next


5. The DNS server does it's next interitive query to the top level domain server


6. The top level domain server sends information about which second level domain server should be contacted next


7. The DNS sever does it's next interitive query to the second level domain server


8. The second level domain server sends informaiton about where it's web server is located


9. The DNS does it's last interitive query to the web server


10. The web server sends it's IP address to the DNS server


11. The DNS server closes the recursive query after giving the web server IP to the PC


12. The PC goes directly to the web server in question using the direct IP address

Hopefully this article was interesting, but to find out more about DNS servers, zones and lookups feel free to google or if you have a specific question or scenario feel free to leave a comment and I will try to answer you as soon as possible.

Pulling Rabbits Out Of Hats

It's getting to the point in class where most of us are in multiple interviews each week now and we're getting job offers and in some cases counter offers and soon most of us will be employed in our first IT jobs. I would like to feature stories about troubleshooting victories or as I like to call it, pulling the rabbit out of the hat (please refrain from any stories involving pulling hats out of rabbits) where you can send in your story about a difficult problem, what you did to troubleshoot, what failed, what was successful, how did you come up with your final solution, ect.

I'll start with a semi-common desktop problem that is mal-ware related. I had a customer who could no longer see her desktop icons, start button, taskbar, or anything other than her wallpaper picture. I immediately assumed it to be a virus problem even though she said that she had anti-virus and it was up to date. (remember assume makes and ass out of u and me)

• So the first thing I did was CTRL+ALT+DEL to bring up the task manager and run a new program. From the run line I entered the http for the avast antivirus program and downloaded it and had it do a full computer scan which took about 45 minutes and I came up with nothing noteworthy ruling out a virus.


• The second thing I did was CTRL+ALT+DEL to run the http for the SuperAntispyware download to look for other malware, rootkit, ect. and after it did it's full system scan that took about 1 hour I came up with a handful of cookies, but nothing noteworthy again. Now I'm frustrated because I have 1:45 invested with no results.


• So I do what every good IT professional should do. www.google.com thats right, you heard it here, google it. Somewhere out there, there is someone smarter than you, thats had the same problem as you, and wants the world to know how smart they really are. I found someone who said that if you run explorer.exe in this situation that it will re-fire explorer and everything will be back to normal, so I tried it and got the error that windows could not find explorer.exe.


• I went to the command line (cmd) and clearly saw that explorer.exe was right where it was supposed to be so I took an educated guess, went to regedit, found the key for explorer and changed the name to explorer.bak, re-ran explorer.exe and presto-chango-rearrango, windows did it's thing when there is no registry for explorer and it made a new one and everything came back.


• I learned that the customer already had AVG which found the virus and removed it, but not before the damage was done to the registry.

So to summerize boys and girls

1. never assume


2. have your tools ready


3. bring your laptop to do research


4. learn how to effectively use google including boolean string searches


5. never let them see you sweat


6. don't forget to pat yourself on the back when you finally have that rabbit out of the hat

Feel free to send you stories in on the comment line (use more than one comment if you need and I'll string them together in upcoming articles)

Your Comments...

I have re-opened comments from unregistered users again in hopes of generating more reader comments. Remember these are moderated and may end up being primers for new articles or end up on Dagger of the Week. As always I hope you have enjoyed this column and continue to read in the future.

Malware on legit sites, more common than you think.

For the past seven years I've watched the influx of spyware, adware and malware become a daily problem for my customers and co-workers and one question has always troubled me. "how did I get this?" After quizzing the already frustrated user about e-mail, downloads and websites I would always assume game downloads or porn sites. Before chucking the problem up to one of these reasons, read this article by avast.

My suggestion to all of my customers has always been

1. Always use a good antivirus software. The most expensive one at the store may not be the greatest, the one with the best known name may not be the greatest. Top 5 antivirus programs to purchase are Viper, Bitdefender, Kaspersky, Panda and Norton. Top free antivirus programs are AVG, Avast and Avira.


2. Always use a antispyware program. Isn't this the same as antivirus? No. Doesn't antivirus do the same thing? NO. Doesn't my antivirus take care of this too? YOU AREN'T LISTENING. NO, NO, NO!!!! You can not rely on your anti-virus software to take care of anything more than viruses which leave you wide open to all kinds of malware. The best one I've found that specializes in root-kit attacks is SuperAntispyware (programmed by geniuses and named by a 5 year old, i'm sure)
   
3. If you have an anti-phishing filter (not to be confused with NO FISHING) on your browser please keep it turned on.


4. Quit reading mail from people you don't know and quit sending the chain mail. To all my readers, you will not save little timmy's leg, there is no little girl saving the deer with water from her hand, there is no stalker in the wal-mart parking lot under your car, there is no gang initiation waiting for you to flash your headlights, or any of thousand other ridiculous chainmail stories that just aren't true, and you'll for sure not find a thousand dollars from Bill Gates, true love, world peace, or anything else at the end of these insane e-mails. Get an education at snopes.com for God's sake.

Active Directory Primer

So many of you, (or maybe not so many) may be wondering... Wow Mitchel You've been gone so long at school, but there's no posts on anything from school.

Well I've got one for you. Two ways to look at creating users in active directory GUI (I'm working on a database project that can add multiple users in the server 2003 command line with dsadd and will talk about that when the bugs are out)

• The first way, which is the simplest but most time consuming is to go directly to the user group or the OU that is assigned to you and click add new user or the picture of the user (single human) and when the GUI opens you fill in the name, the address, the fax number, the phone number, give them and e-mail address, create their roaming profile, create their network folder, add them to all the groups you think they fall in and then wait for the user to call and complain about which network resources they still need access to, (more on NTFS troubleshooting in the future, just remember high/high/low for principle of least privilege), and then blame their supervisor for not knowing what groups the employee should have been in.

• The second way is to re-evaluate your current ADUC structure and make a group for each department and create a new "template" user with all the generic info about their site, add a home directory of \\server\folder\%username% (the %username% is a universal variable, if you don't understand how this saves time then google it) and the same for their roaming profile.

Now all you have to do is add their group to the security tab on the system NTFS folders in question and your done... unless you need to have your group access shares outside your local domain, don't know what an OU was, are not sure what a roaming profile is, or enjoy setting up one account at a time.

Still on target part 2

Sorry for the lack of posts lately, I've been pretty busy studying for my MCP which I passed on 4/17. Moving on to my MCSA.
I've got multiple interviews this week so hopefully I'll be back to work soon.

I thought I felt a little tingle in my back recently and upon investigation I found that there are daggers stuck in my back, so for future posts I'll add dagger of the week comments (except for the truly poisonous one's which I'll just delete)

WHOISDNS writes again "still no job huh? thats weird with all your experience and certifications you should be making atleast $70,000 by now...."

To which I reply "Nope"

My question to you is, why do you care? I never get any comments from anyone except you. You seem so happy that I don't have a job at this point. Why is that? I'd hate to think that maybe you contributed to me being terminated. But it doesn't matter much to me, keep up the good work at baker and taylor and make sure you don't learn anything new especially how to keep my databases running when something goes wrong. I'd hate to think my old department didn't immediately fall back into the same old complacent slump of fixing antique crap, putting users off and making excuses for why new projects can't be achieved.