archiveren

computer

There are really some huge flaws in this system…

To bad actually, because it’s a nice thing!

Let’s show you my setup:

exe rules script rules

So everyone can run executables and scripts signed by my selfsigned codesigning certificate and the juniper ones.
Everyone can execute from %programfiles% and %windows (default rule) and Everyone from a safe directory called “epic tools” on my skydrive.
And 2 file-path exceptions for keepass and onecal…

Almost the same for powershell, with specific hash-rule for my powershellprofile (which can go now because it’s signed by the selfsigned cert)

Anyway, %desktop% is blocked for all normal users.

Bypass Applocker’s PowerShell policy

Let’s try to run a ps1 file located on the desktop.

weird
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\mendel\Desktop\applockertest\helloworld.ps1'"

I noticed this one when running a powershell script and invoking it from rightmouseclick (run with powershell) and used procmon to find the exact launch command…

(The rightmouseclick “run with powershell” is only available in the context menu if you have the “.ps1” extension associated with notepad… WTF)

And of course there are more: http://www.wilderssecurity.com/threads/windows-7-applocker-can-be-bypassed.321479/ , https://www.mountknowledge.nl/2011/01/28/bypassing-windows-applocker-using-vb-script-in-word-and-excel/ .
This one is also nice! http://baileysoriginalirishtech.blogspot.be/2015/06/applocker-schmapplocker.html

Bypass Applocker’s exe policy

Multiple bugs/exploits for this are known. As for example the ones from Casey Smith https://twitter.com/subtee/status/627904214451138560

CaptureI just used Case’s code to PoC this πŸ™‚ https://github.com/subTee/ShmooCon-2015/blob/master/POC.cs

Basically, just block everything!

Device Guard

A new feature in Windows 10 might be a solution for all of this πŸ™‚ http://www.malwaretech.com/2015/09/device-guard-beginning-of-end-for.html?m=1

We’ll see, we’ll see…

Advertenties

Ok, let’s get it over with. Once and for all a decent how-to to setup Authentication Mechanism Assurance (AMA) in Active Directory Domain Services…

The last time I talked about this, is when I just found out of it existence at techet, in a talk by Hasain Alshakarti and Marcus Murray .

It basically shows a difference in group memberships between logging in using a regular username/password , and logging in using smarcards. If you login with a password you’ll become a normal user, when you logon with a smartcard you’re an admin! πŸ™‚

The Microsoft step-by-step guide however is a bit long, and a bit clumsy… So here a quick rewrite πŸ™‚

➑ Required components: a Windows Server, a PKI (or the default one in ADDS whatever), and some time.

CA Templates

First, we’ll have to create a new certificate template.
Open the certificate template management console, and go to the templates.

Lets start by duplicating the “smartcard logon” one. Choose 2008R2 for everything.

dupl
This default template should be good, 1 little thing needs to change.

Open the template, go to the extensions tab. And you see the issuance policies. Here you’ll need to add a new one.

Give it some useful name, for example “server admin” or whatever.
issuancepolicy

This extra extension will now go into the actual enrolled certificate…

Mapping

Next we’ll need to teach the ADDS how to map that extension to an actual Security Group. This can be done using the weird PowerShell script provided by Microsoft, but let’s do it manually here (it goes way faster!)

The link between the OID we just created and a security group is a policy defined in the regular SYSTEM partition of ADDS. Open it either using ADSIEDIT or the Sites and Services mmc.

Ofcourse we’re working with the Public Key Services, OID config, and there are all the policies stored. We’re looking for the OID of the policy we created earlier (add the “displayname” to the mmc-colums to make your life easier).

If you’ve found the correct object, rightmouseclick it, open attributes, and search for the “msDS-OIDToGroupLink” attribute.

⭐ This is the magic attribute ⭐

Fill in the DN of the security group.
And you’re good to go!

sitesandservicesgrouplink

Next steps are of course the enrollment and issuance of the CA template to the correct users. But I hope you know how that works πŸ˜‰
From here on you can either put it in a Virtual Smart Card, and start using it!

 

My Vaio died…
For all the ones that will be pointing “hahahahaha, told you so”: whatever =)
In the end, it was the Samsung SSD inside that died…

Anyway, needed to reinstall my laptop. Quick list of essential tools!

And since the sudden disappearance of wallbase -> http://alpha.wallhaven.cc/ for a new wallpaper! πŸ™‚

desktopAnd for the first time I didn’t make my account localadmin πŸ™‚ Let’s see how that turns out πŸ™‚

http://www.hdkn.net/ is pretty awesome for a headless torrent client! It even has a native PowerShell module! But it doesn’t implement everything you want. (runs only in x86 shell, no magnets support, …)

Here a quick (and very dirty) PoSh snippet to add magnets to the download engine using its REST API… (don’t judge me on code quality!)

Accesstoken is the “api key” from the upper right corner, id is whatever you want it to be, and the convertto-json can probably be used as well.. But it was late, and this works :-).


$accesstoken="111111-11111111-11111"
$url="http://host.ext:port/jsonrpc"
while($magnet = read-host "gimme magnets")
{
$body = @"
{"id":74,"jsonrpc":"2.0","method":"torrents.addUrl","params":["$magnet",{"name":"","savePath":"E:\\ServerFolders\\Linuxes"}]}
"@
Invoke-RestMethod -Method Post -Uri $url -Header @{ "Authorization" = "Token $accesstoken" } -Body $body -ContentType "application/json"
}
$body = @"
{"id":1,"jsonrpc":"2.0","method":"torrents.getAll","params":[]}
"@
$res=Invoke-RestMethod -Method Post -Uri $url -Header @{ "Authorization" = "Token $accesstoken" } -Body $body -ContentType "application/json"
$res.result |ft

Nietje is awesome!

Nietje is a Neato Botvac 75 and it vacuums our apartment πŸ™‚

I love Nietje ❀InstagramCapture_4cf77e6f-1aa0-4f85-a153-40220672a072

It’s eyes exists of a very cool technology actually! It’s called a “lidar”, and combines the reflection of a laser, a photosensitive sensor and time of flight to calculate distance to objects!

If you want you can read about it on following websites:

I recently found a usb port inside the machine! It’s hidden next to the on/off button, behind the dust bin, behind a rubber plug! And there it is: a microusb-port! Nice πŸ™‚

Plugged it in, but Windows couldn’t find a driver (vid_2108&pid_780c).
To get passed that, you’re going to need the official driver included in the update package.

And thanks to a guy called heX, we can control the robot πŸ™‚ jeeeehaaaa

Video:

https://onedrive.live.com/?cid=A03220EB96D0D784&id=A03220EB96D0D784!112460&v=3&authkey=!ABRqe5XuhDgNoog

http://www.robotreviews.com/chat/viewtopic.php?f=20&t=18173

 

More of those bloody scheduled tasks that get re-enabled when you disable them… 😦

UserTask
OfficeTelemetryAgentFallBack
Office 15 Subscription Heartbeat
Scheduled Start
Scheduled Start With Network
OfficeTelemetryAgentLogOn
SynchronizeTime
Microsoft Office 15 Sync Maintenance
.NET Framework NGEN v4.0.30319
SilentCleanup
CreateObjectTask
BackgroundUploadTask
Idle Sync Maintenance Task
Idle Maintenance
Routine Maintenance Task
Regular Maintenance
.NET Framework NGEN v4.0.30319 64

 

Anyway, thanks to my beloved search engine, i stumbled on yet another stackoverflow/superuser thread concerning this same issue: http://superuser.com/questions/497500/disable-automatic-maintenance-in-windows-8

Just disable that bloody “Maintenance Configurator” task using local system privileges

Result: no more fans spinning up when I lock my laptop! ❀

Remapping all the way!

So, this is another trick I learned at TechEd πŸ™‚
Basically, a registry key can be created in “image file execution options” , that changes Windows behaviour, and instead of starting any executable, launching a debugger of choice and attaching the executable to that debugger…

This means, you can also set any executable to be run whenever a certain executable is started. I noticed when running cmd this way, the original executable will be the argument passed to the “debugger”-executable.

Simply open the registry, browse to following location, set a key with the EXACT name (case sensitive) of the executable you want to replace, create a new string value named “debugger” and as value the executable of the debugger (or exe you want to run)
To prevent the argument of reaching debugger-exe, add “/z” to the end of the value.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VAIOCare.exe]
“debugger”=”\”C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\” /z”

WP_20141115_12_32_42_Pro

So, now for my VAIO’s assist button…
The laptop originally comes withΒ  bunch of bloatware installed, and when I reinstalled the OS the button became useless… It can only start Sony software…
So you’re going to need some of the original Sony tools for this as well…

Anyway, after installing Sony Care and the Shared Drivers pack, things got working, and on a press of the button the process “VAIOCare.exe” was launched.
Threw some sysinternals tools in the game to get some details and find the exact executable that starts.
Also found some other regkeys, but that was a dead end.
Applied the trick above on VAIOCare.exe, and replaced it with firefox /z =)
(don’t exactly know what the “/z” stands for, but it kills the argument it seems…)

Capturea

CapturlkjeCapture

Security note on all this: you can create a replacement of every file executable on your system by design. This also means you can let every executable start on boot. This registry-key can contain traces of malware, “Autoruns”Β  from Sysinternals also checks for this as “Image hijacks”.
This way, you can also add “sethc.exe” with debugger options. sethc is the thing that will run when you hit shift 5 times in a row πŸ™‚
So now, when I hit shift 5 times, a powershell window pops up πŸ™‚

Bigger Security note: this also works before you login (localmachine regkeys), so when you hit 5 times shift at the logonscreen, a powershell window pops up running as .\system πŸ™‚
After that, the only limit, is your own imagination…