Creating an executable file

The main usage of this is to create an executable file from a batch file to mask certain user credentials used in the batch file. A rather primitive way of obfuscating information but its better than storing a batch file where anyone can see the user credentials in plaintext.

Step 1
Navigate to C:\Windows\System32 and locate the file named IEXPRESS.EXE

Step 2
Double Click to launch IEXPRESS.EXE

Step 3
You will be presented with the initial welcome screen and be given two choices. Select “Create new Self Extraction Directive file.” Click Next.

Step 4
Next you will be presented with the Package Purpose screen. For our purposes select “Extract Files and run an installation command” and click the Next button.

Step 5
You will be presented with the Package Title screen, which will give you the opportunity to give your project a name. If you are so inclined give it a meaningful name. If like me you are never going to come back to this, name it whatever you want.

Step 6
You will next be presented with the Confirmation Prompt Screen. We would like the batch file to just be extracted and run so just choose “No Prompt” and click the Next Button.

Step 7
You are presented with the License Agreement window. If you don’t want your users to have to answer a prompt select “Do not display a license.”

Step 8
The Packaged Files window is where you will select your batch file (or .vbs). Click the Add button and browse to your desired file. Then click next.

Step 9
Here you are presented with a window titled Install Program to Launch. Use the drop down control next to “Install Program and choose the only option that will be present, the .bat or .vbs file that you chose in the previous window.

Step 10
The Show Window screen is next. I didn’t want my users to be prompted in any way so I chose Hidden. Click Next.

Step 11
No Finished Message for my users. Select “No message” and choose Next.

Step 12
The Package Name and Options window is where the new .exe specified. Type in a path or browse to the folder you would like your .exe in, type a name in the file name box and click save. Also check the box that says “Hide File Extraction Progress Animation from User.” If you’re worried about long file names go ahead and click the other box as well.

Step 13
Since we really aren’t installing anything we probably want to tell the Configure Restart window to not restart. So choose the option that says “No restart” and hit Next.

Step 14
This window is where you have a chance to save all of the options you have chosen into a project file so that if necessary you may later return and make modifications. I have no need to retain the file, but if you would like to be able to come back to it, by all means choose “Save Self Extraction Directive (SED) file” and tell it where to put it. As always, click Next.

Step 15
Here’s where you’re new .exe is born, on the Create Package screen. Explore to the directory you told it to put the file in, click Next and then watch your little .exe’s first moments as it pops into the big digital world.

Step 16
You’re done! Click finish and go try it out. Pin it directly to the start menu. Point a shortcut to it and pin that to the start menu. Most importantly, script it and see how slick it is. If you’re not familiar with how to script start menu pinning the scripting guys will tell you how.

*Ref: http://renegadetech.blogspot.com/2006/07/how-to-convert-bat-file-or-vbs-file.html

Checking Password Policies in Linux

To check the list of users of  linux machine, check the password or shadow password file.

cat /etc/shadow

cat /etc/passwd

cat /etc/group

cat /etc/aliases

cat /etc/sudoers

To check the policy of a user

chage -l

chage -I -1 -m 9 -M 100 -E -1

NTFS for MAC OS X

Problem

Sometimes if you have an external drive that's NTFS formated and it's not disconnected properly from Windows, it'll come up with this message while trying to mount it in Mac OS X

$LogFile indicates unclean shutdown (0, 0)
Failed to mount '/dev/disk1s1': Operation not supported
Mount is denied because NTFS is marked to be in use. Choose one action:

Choice 1: If you have Windows then disconnect the external devices by
clicking on the 'Safely Remove Hardware' icon in the Windows
taskbar then shutdown Windows cleanly.

Choice 2: If you don't have Windows then you can use the 'force' option for
your own responsibility. For example type on the command line:

mount -t ntfs-3g /dev/disk1s1 /Volumes/WD Passport -o force

Or add the option to the relevant row in the /etc/fstab file:

/dev/disk1s1 /Volumes/WD Passport ntfs-3g defaults,force 0 0
Solution

I just had to force it to mount, and then umount it in Terminal. After unplugging and plugging the drive back in, everything works like it did before:

$>sudo mkdir /Volumes/WD\ Passport
$>sudo /usr/local/bin/ntfs-3g /dev/disk1s1 /Volumes/WD\ Passport -o force
$>sudo umount /Volumes/WD\ Passport

Taken from
http://www.elctech.com/projects/troubles-mounting-ntfs-external-drive-on-mac-os-x

Windows Admin Tricks

Windows SID

This is basically the internal identifier used by Windows to uniquely determine a user/group/machine.

Local machine administrator SID will always end with -500.

Guest SID will end with -501

User SID will end with -1001 (1001 signifies the first user and will auto increment with subsequent user)

This is how ACL determines if a user is allowed access to files/services/etc.

Net use

1) net use \\192.168.1.2\ipc$ password /u:domain\administrator

2) Useful sid tool (user2sid and sid2user)

user2sid \\caesars administrator

sid2user \\caesars 5 21 124532423423 4234234234234 4235234234-500

whoami /user /groups

Windows Impersonation

Let the server notify the subsystem that it is temporarily adopting the token of the client making the resource request.

*Restricted token is assigned to child processes that has more limited access than the parent token.

The token consist of all the SID that the logged user is a member of.

Eg John Smith, who is a member of group Developers, Webmaster and Requester logs into Windows. The token will consist of John Smith's SID, Developers group SID, Webmaster group SID and Requester group SID.

Assuming John tries to access file A (which is assigned to Developers group). The ACL will check if John's token consist of the Developers group SID. If yes, John will have access to file A.

 

Forensics: Filesystem Mount

To see the list of devices detected  by linux, type

ls /dev

Usually, hard disk partitions are labeled sda, sda1, hda, etc

To mount these partitions, first make a path where these partitions are to be accessed.

Eg mkdir  /mnt/mywindrive or sudo mkdir /mnt/mywindrive

Then, associate the device with the mount location.

sudo mount -o ro -t auto /dev/sda1 /mnt/mywindrive

*Taken from Unix and Linux Forensic Analysis DVD Toolkit 

DD to image a drive

Challenge Procedure Step-by-Step
The following steps show you how to use dd and MD5 to create, restore, and verify forensically sound disk images:

First, we start by creating an MD5 checksum of a disk. To do this, first log in as root, and open a command prompt. Create the MD5 checksom for the disk to be duplicated using the following:

md5sum /dev/fd0 > /tmp/original-md5
This command creates the MD5 checksum of the device, /dev/fd0, and outputs the result to a file named /tmp/ original-md5.

View the checksum with cat /tmp/original-md5.

Now, create an image file of the disk.

Use dd to create a binary copy of the disk:
*Remember to unmount the disk before using dd.

in OS X, use diskutil unmountDisk /dev/disk1

dd if=/dev/fd0 of=/tmp/disk.img bs=1k
The if=/dev/fd0 parameter directs dd to use the device /dev/fd0 as the input file. The of=/tmp/disk.img parameter tells dd to output the data to a file named /tmp/disk.img. The bs=1k tells dd to use a block size of 1024 or 1KB.

Next, we'll use MD5 to verify the accuracy of the image file. First, create the MD5 checksum for the image file with the following:

md5sum /tmp/disk.img > /tmp/image-md5
Compare the checksums of the original disk and the image file using the following:

cat /tmp/*md5
The cat command displays the contents of files that end with md5. Note that the checksums are identical.

Next, you'll restore the image file to a blank disk.

Use dd to copy the image file to the disk:


dd if=/tmp/disk.img of=/dev/fd0 bs= 1k
This command reverses the flow of the data, whereas the command in step 2 created the image file.

Create the checksum for the duplicate disk:


md5sum /dev/fd0 > /tmp/duplicate-md5
Now, use cat to verify the accuracy of the duplicate disk by comparing the checksums of all three versions:


cat /tmp/*md5
Test MD5 against an altered image file. Do this by first adding a single byte of data to the image file:


echo x >> /tmp/disk.img
Then, create a new checksum for the image file:


md5sum /tmp/disk.img > /tmp/corrupt-md5
Finally, compare the checksums for each step of this exercise:


cat /tmp/*md5
Note how a difference of only 1 byte causes the MD5 to change drastically. This demonstrates the value of using and checking the MD5 signatures of files when downloading them from the Internet.

*Taken from http://www.informit.com/articles/article.aspx?p=27203&seqNum=3

Computer Privacy Annoyances (Dan Tynan)

Essential Privacy Practices

1) Be stingy with data. Give out only essential data. 

2) Check credit card report to ensure that no one is using your personal information to apply for credit cards

3) Minimum information on cheques. Writing home address, phone numbers, driver's license on cheques is exposing too much private information to the cheque recipient

4) Rent a private mailbox to protect your home address and safe keep confidential letters from mail looters

5) Delist from phonebook and online directories/yellow pages

6) Opt out early and often

7) Avoid surveys. You may have a one-in-a-million shot at winning but you've definitely lost your privacy

8) Don't expect others to defend your rights for you 

Cell phone Candid Camera

Covert cameras are banned in locker rooms, bedrooms where the subject has "reasonable expectation of privacy". However, if someone captures you during a wardrobe malfunction at the Super Bowl, you're out of luck.

Moblog Rules

If a picture of you appears on blogs (and you don't want it there), you can contact the service provider to have the picture removed. If the picture appears on a private server, you can contact the ISP to lodge the complaint.

*You might need to surrender some private information such as your identity and why you feel the picture invades your privacy. 

Remain anonymous online

Check out www.bugmenot.com to find logins for various websites that requires registration to access.

Peer to peer sharing

Since it is hard for you to identify the person whom you're exchanging files with in a P2P system, be aware that the RIAA might just plant a few seeders and log the transaction between your machine and theirs. From there, they can request the ISP to reveal the identity of the people who were involved in the download/file exchange.

It is not compulsory for employers to inform employees that they are being monitored. The employer also have rights to search the bags of employees who are accused of theft.

*Taken from Computer Privacy Annoyances (Dan Tynan)