Using Credentials in Powershell

Gracefully borrowed from http://www.adminarsenal.com/

Putting it all together

We now know how to convert a SecureString to an encrypted standard string. We can take any method we like to get a SecureString, convert it to a standard string and then save it to a file. Here is an example of each:

Exporting SecureString from Plain text

"P@ssword1" | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString | Out-File "C:\Temp 2\Password.txt"

Exporting SecureString from Get-Credential

(Get-Credential).Password | ConvertFrom-SecureString | Out-File "C:\Temp 2\Password.txt"

Exporting SecureString from Read-Host

Read-Host "Enter Password" -AsSecureString | ConvertFrom-SecureString | Out-File "C:\Temp 2\Password.txt"

Any one of these examples should provide you with a Password.txt file that has an encrypted standard string the represents the password.

When you need to use this encrypted password, you simply reverse the process by importing the data from your file and use ConvertTo-SecureString. If all you need is a SecureString, you can stop there. You could even take it a step further and create a PSCredential object.
Creating SecureString object

$pass = Get-Content "C:\Temp 2\Password.txt" | ConvertTo-SecureString

Creating PSCredential object

$User = "MyUserName" $File = "C:\Temp 2\Password.txt" $MyCredential=New-Object -TypeName System.Management.Automation.PSCredential ` -ArgumentList $User, (Get-Content $File | ConvertTo-SecureString)

Here's all the crapware that comes with new Windows 8 PCs | ITworld

Great little fact that has always bugged me. One more reason to use a Mac.

Here's all the crapware that comes with new Windows 8 PCs | ITworld:

The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier

The PC Decrapifier Wipes Unwanted Junk | The PC Decrapifier:

E-mail shines in Windows 8 with radical overhaul of mail client

E-mail shines in Windows 8 with radical overhaul of mail client:

The Windows 8 Consumer Preview comes with a pre-installed e-mail client for webmail and Exchange. While it's designed with the touch-friendly Metro interface in mind, it's quite usable even in traditional desktop mode, at least for the basic tasks of reading and writing messages.

Windows 8 Mail is an alternative to the mail client in Windows Live Essentials, a free productivity suite for download on the stable versions of Windows in use today. Microsoft has not yet released a Windows 8-specific version of Outlook, the fee-based, business-class e-mail client that is part of Office. A beta version of "Office 15" is expected this summer, Office President Kurt DelBene said this week.

Impressions: Windows Sysinternals Administrator's Reference

Impressions: Windows Sysinternals Administrator's Reference: Mark Russinovich and Aaron Margosis have written another awesome addition to the Microsoft Press catalog, Windows Sysinternals Administrator's Reference. Per my policy, because I did not read the whole book I am only posting "impressions" here and not a full Amazon.com review.
In brief this book will tell you more about the awesome Sysinternals tools than you might have thought possible. One topic that caught my attention was using Process Monitor to summarize network activity (p 139). This reminded me of Event Tracing for Windows and Network Tracing in Windows 7. I remain interested in this capability because it can be handy for incident responders to collect network traffic on endpoints without installing new software, relying instead on native OS capabilities.
I suggest keeping a copy of this book in your team library if you run a CIRT. Thorough knowledge of the Sysinternals tools is a great benefit to anyone trying to identify compromised Windows computers.
Tweet

Copyright 2003-2011 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)

Windows Log Parsing

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24659 – logparser 2.2 from MS

http://martin77s.wordpress.com/2010/01/16/evtlogparser/ - someone wrote an overlay for logparser

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 – EventCombMT is what I used to use.

http://www.eventid.net/ - this is good if trying to find esoteric event codes

Thanks Charles!

Windows 2003 Server Domain Time

I have a system with a 5 minute time delay. It's domain joined but for unknown reasons it has a 5 minute delay. Now being an e-commerce system this is a bad deal. Credit Card companies don't like it when transactions are delayed by 5 minutes (can you say "man-in-the-middle"?).

Now I just need to figure out why it was off in the first place.

Here is the command to reset the time to the Doman time.

C:\Documents and Settings\wal>net time /?
The syntax of this command is:


NET TIME
[\\computername | /DOMAIN[:domainname] | /RTSDOMAIN[:domainname]] [/SET]
         [\\computername] /QUERYSNTP
         [\\computername] /SETSNTP[:ntp server list]


C:\Documents and Settings\wal>net time /domain:your.domain.com /set
Current time at \\server.your.domain.com is 12/20/2011 9:56 AM

The current local clock is 12/20/2011 9:51 AM
Do you want to set the local computer's time to match the
time at \\server.your.domain.com? (Y/N) [Y]: y
The command completed successfully.


C:\Documents and Settings\wal>

About Damn Time: Microsoft Will Silently Upgrade Everyone To Latest Version Of IE | TechCrunch

About Damn Time: Microsoft Will Silently Upgrade Everyone To Latest Version Of IE | TechCrunch:

'via Blog this'

Microsoft Store Online

Download Windows 7 Media!

Microsoft Store Online:

Download: FSCT - Microsoft Download Center - Download Details

File Server Capacity Tool!

Download: FSCT - Microsoft Download Center - Download Details:

Another Malware Victim

Yesterday I had a visit from a family friend and of course, they brought along an infected laptop. His daughter's new Toshiba laptop was all shiny and fresh out of the box but it just wasn't working like it used to. Of course not; it had over 50 infections of various breeds of malware and trojans.

This was a brand new PC running the latest version of Windows and fully patched. There were two well known AV programs installed not to mention Microsoft Security Essentials.  The reason she was infected is simple: "click this box to save the world".  No amount of security in the world will protect people from their own infallible minds.  We can try to protect people from all sorts of threats in the world; virus, terrorists, crime, even taxes but in the end we are all victims of our own gullible minds. Let's face it, if bad people can design a web page to look legit, they can just as easily make an application look identical to any number of seemingly safe applications. One errant click and "it's goodbye Seattle" --Steve Martin. 

Microsoft Security Scanner is a frequently updated tool (it is only valid for 10 days) that can be downloaded and copied to an infected system either in safe mode or from a secondary boot method. This tool should find and remove most malware or virus.

Dear Microsoft: Resource Monitor Sucks

Dear Microsoft:

If I can watch a movie, play a game with thousands of people with live news and weather feeds scrolling across the screen from around the world all on this hardware, why can't you make a performance monitor that looks decent and doesn't chug along like an over worked grandma?

Signed,

Every Windows Sysadmin in the World!

New Windows SMB 0-Day Vulnerability

Windows 0-day SMB mrxsmb.dll vulnerability, (Wed, Feb 16th): "A new vulnerability has been discovered exploiting SMBcomponent of Windows. The attack involve ...(more)..."

New Critical Bug In All Current Windows Versions

New Critical Bug In All Current Windows Versions: "Trailrunner7 writes 'Microsoft is warning its users about a dangerous flaw in the way that Windows handles certain MHTML operations, which could allow an attacker to run code on vulnerable machines. The bug affects all of the current versions of Windows, from XP up through Windows 7 and Windows Server 2008. Microsoft issued an advisory about the MHTML vulnerability, which has been discussed among security researchers in recent days. There is some exploit code available for the bug, as well. In addition to the advisory, Microsoft has released a FixIt tool, which helps mitigate attacks against the vulnerability in Windows.'

AD Resources

I've been working quite a bit with AD lately at work and someone compiled a list of great resources. Here is a reproduction of that list.

Links

Active Directory Cookbook
PowerGUI Powershell Interface
Windows Server Port Requirements
AD Library on Technet
GPO Library on Technet

Out of Band Release to Address Microsoft Security Advisory 2416728

Out of Band Release to Address Microsoft Security Advisory 2416728:
Hello -

Today we provided advance notification to customers that we will release an out-of-band security update to address the vulnerability discussed in Security Advisory 2416728. The update is scheduled for release tomorrow, Tuesday, September 28, 2010 at approximately 10:00 AM PDT. The bulletin has a severity rating of Important and addresses a publicly disclosed vulnerability in ASP.NET that affects all versions of the .NET Framework when used on Windows Server operating systems. Windows desktop systems are listed as affected, but consumers are not vulnerable unless they are running a Web server from their computer.

Based on our comprehensive monitoring of the threat landscape, we have determined an out-of-band release is needed to protect customers as we have seen limited attacks and continued attempts to bypass current defenses and workarounds.

The security update is fully tested and ready for release, but will be made available initially only on the Microsoft Download Center. This enables us to get the update out as quickly as possible, allowing administrators with enterprise installations, or end users who want to install this security update manually, the ability to test and update their systems immediately. We strongly encourage these customers to visit the Download Center, download the update, test it in their environment and deploy it as soon as possible.

The update will also be released through Windows Update and Windows Server Update Services within the next few days as we test to make sure distribution will be successful through these channels. This approach allows us to release sooner to customers who may choose to deploy it manually without delaying for broader distribution.

For customers using Automatic Update, this Security Update will automatically be applied once it is released broadly. Once the Security Update is applied, customers are protected against known attacks related to Security Advisory 2416728.

We will also hold a special edition webcast for the bulletin release on Tuesday, September 28, 2010 at 1:00 PM PDT, where we will present information on the bulletin and take customer questions. If you are interested in attending the webcast, click here to sign up.

Thanks,


Dave Forstrom

Director, Trustworthy Computing

Windows DLL Vulnerability Exploit In the Wild

Windows DLL Vulnerability Exploit In the Wild: "WrongSizeGlass writes 'Exploit code for the DLL loading issue that reportedly affects hundreds of Windows applications made its appearance on Monday. HD Moore, the creator of the Metasploit open-source hacking toolkit, released the exploit code along with an auditing tool that records which applications are vulnerable. 'Once it makes it into Metasploit, it doesn't take much more to execute an attack,' said Andrew Storms, director of security operations for nCircle Security. 'The hard part has already been done for [hackers].''"

Securing Remote Desktop Services in Windows Server 2008 R2

Securing Remote Desktop Services in Windows Server 2008 R2: "Taking a look at the security mechanisms built into RDS; how to use Group Policy and configuration settings for better security."

Use a Batch Script to Keep SysInternals Utilities Updated [Batch Scripts]

Use a Batch Script to Keep SysInternals Utilities Updated [Batch Scripts]: "Windows only: The SysInternals suite of utilities, including the excellent Process Explorer tool, are a must-have for any serious geek, but they don't come with a built-in way to keep them updated. Here's how to keep them automatically updated. More »

Microsoft Zero-Day: Malformed Shortcut Vulnerability

Microsoft Zero-Day: Malformed Shortcut Vulnerability:
"Today Microsoft updated the security advisory that was initially published last Friday (July 16), stating that they’re working on issuing a security patch for this vulnerability. Earlier, malware exploiting this issue was found in the wild. Researchers at McAfee Labs have been busy tracking this issue over the weekend and we have come up with some more quick Q&A’s.

1. What is the issue with .LNK files and how can it be exploited?

A. McAfee Labs researchers analyzed malware that was exploiting a design flaw in parsing shortcut (.LNK) files. This issue gets triggered because the Windows Shell component does not validate parameters sent out in the shortcut. This issue can be exploited via any mechanism that makes the user load the icon of the .LNK file.

2. Does the malware need a payload (shellcode) to exploit this flaw?

A. Since this is a design issue in the way shortcuts are parsed, no malicious payload (shellcode) is required to exploit this flaw. The .LNK file needs to point to a malicious file, the path of which needs to be hardcoded in the shortcut.

3. What are the requirements to successfully exploit this flaw?

A. This flaw can be triggered when Windows Explorer or Internet Explorer tries to render a malformed .LNK file that points to a malicious executable. The user need not double-click on the .LNK file to trigger the vulnerability; just opening the folder containing the malicious shortcut is enough to get infected.

4. What are the most likely attack vectors used to exploit this vulnerability?

A. USB drives are likely to be affected the most. The malware discovered in the wild was exploiting this issue via a USB drive. File sharing over SMB is another likely vector to exploit this flaw and this can lead to widespread malware infections over internal networks. WebDAV shares are equally susceptible to exploitation.

5. What are the affected platforms?

A. Microsoft has acknowledged that all supported platforms are affected. More details are available in the Microsoft security advisory. Windows XP SP2 is not listed in the list of affected platforms from Microsoft, so there is a chance of Windows XP SP2 users might remain vulnerable.

6. How widely is the issue being exploited?

A. The issue is known to be exploited by malware in the wild. Initial attacks were limited. However, an exploit module in metasploit was published today that uses WebDAV shares as an exploit vector. We expect wider exploitation of this issue. Users should keep their anti-virus software updated with the latest DATs (signatures).

We’ll keep our readers updated on this issue as we analyze more malware and techniques used by malware writers to exploit this flaw."