# Wednesday, June 04, 2008
posted on Wednesday, June 04, 2008 11:27:46 AM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Wednesday, May 21, 2008
So lets pose a problem, you have a computer with encrypted HDD and you cant reboot the PC. Or a comptuer has something worth getting in memory (encryption key) and you want it. But the computer is locked. well you can now hack this.

winlockpwn - tool to connect to windows with firewire and inject a dll hack into memory to bypass passwords on the "windows lock screen" and allow you access to windows with no password when locked.

if your not a linux power user, or just want to cheat here is a setup quide and if you use backtrack here is a post about it.

So a lot of people say it works, I agree that it will - it uses dll hacking for passwords, you can do this with the computer powered off or just hack it

so what did I get, nothing...

i get this error

IOError: [Errno 22] Invalid argument

from firewire.py, line 693: "If a node doesn't feel like fulfilling a request, it will raise an IOError."

now if you unplug the fw and plug it back in repeatedly running the script it will start scanning memory only to end with a device busy

seems that the "money time" is when the device is detected as a "Hard Drive" you start scanning the memory at that point. then the ipod comes in and all work ends

same issue on two computers

but who's to say Im just odd.

UPDATE: May22

I got it to work, who knows if I was sleepy or a reboot fixed it. But when I powered up. Started from "step 5" and followed steps exactly.

Dell630 fully patched on the domain and it worked! I had full access as advertised.

something I noticed was that this morning businfo has 1 on the node 0 and not 0 for all the data it spits out on what will and wont work.


posted on Wednesday, May 21, 2008 9:43:17 PM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Tuesday, May 13, 2008
I saw this poster the other day about Exchange 2007 from TechNet turns out they published them. If your a m$ person this is worth downloading and printing (or trying to print and jamming up your printer buffer)

Exchange Server 2007 Component Architecture
Active Directory Component Jigsaw Poster
Windows Server 2008 Component Poster

posted on Tuesday, May 13, 2008 3:20:08 PM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
I recently was working with some shared code and didnt like the regulations or the publicity of SourceFourge, so I set up a home CVS server to distro the code. Like another individual I googled out and found a bunch of documentation from linux users, no offence but I dont have time to read 30 pages to edit a password file. so I duplicated notes from here -http://www.adp-gmbh.ch/blog/2004/november/3.html- in case its ever removed and added my own commentary and edited some things for the new version of cvsnt.

Wih the server I also just checked out TortoiseCVS (formally I used wincvs) I dont like how much its locked into explorer but its so easy that I dumped wincvs and only use the turtle.

Installation

The installation turns out to be quite straight forward. Starting the installer takes care of the entire installation.
The default installation installs two windows services: the cvsnt service (named CVSNT) and the cvsnt lock (named CVSNT Locking Service) service. Additionally, it also installs a default certificate.
The cvs.exe was installed into C:\Program Files\cvsnt. Install also adds to your path statment.

Creating a repository

A repository needs a root directory under which both the files under version control and auxiliary files for use by CVS server are stored. I created this directory manually:
C:> mkdir c:\CVSSERVER
However, this is not a CVS repository by itself; the CVS server needs to be told to use this directory as a repository. The CVS server (or service, respectively) is administered through a service control panel that can be invoked in the dos prompt like so: (or via start menu)
C:\> cvsnt.cpl 
Now, with cvsnt.cpl, one can go to the Repositories tab and add the created repository. I chose /test for the name of the repository.

A dialog informed me: C:/CVSSERVER, but is not a valid CVS repository.
Do you want to initialise it?

And yes, of course, that's what I wanted.
Then I pressed apply.
The initialization basically created a CVSROOT directory beneath c:\CVSSERVER and put some 55 files and yet another directory into CVSROOT.

Adding a user

After creating the repository, I needed to create a user that can access (that is store and retrieve files) the repository.
C:\>cvs -d:sspi:localhost:/test passwd -a some_user
Adding user some_user@localhost
New password: ******
Verify password: ******
cvs server: *WARNING* CVS user 'some_user' will not be able to log in until they are aliased to a valid system user.
The password that I have specified (and is hidden in the console) was password.
This command created \CVSSERVER\CVSROOT\passwd with the following content:
some_user:AuC4s3kI8ixcs
Now, some_user needs to be aliased (according to the warning returned by cvs) to a valid NT system user:
C:\>cvs -d:sspi:localhost:/test passwd -r SYSTEM\administrator some_user
Changing repository password for some_user@localhost
New password: ******
Verify password: ******
Although this seems a bit redundant, it looks like one has to give the password again. This is the password for the CVS user not the system account. The SYSTEM\administrator is the NT-FQ name of the local admin in this example.

Creating a module

Now, it was time to create a module which I named test_module:
C:\CVSSERVER\>mkdir test_module
C:\CVSSERVER\>cd test_module
For the beginning, I only stored one file, README.txt, into this module. (one file is required to start the module)
C:\CVSSERVER\test_module\>notepad README.txt
Here's the content of README.txt:
test_module
===========
This is some dummy text.
C:\CVSSERVER\test_module\>cvs -d:pserver:some_user:password@localhost:/test import TestModule no-vendor initial-release
I didn't specify the -m flag, so CVS opened the default editor likely notepad (as the environment variable CVSEDITOR is not set) to enter a message. 
CVS: ----------------------------------------------------------------------
CVS: Enter Log. Lines beginning with `CVS:' are removed automatically
CVS:
CVS: ----------------------------------------------------------------------

just say C for continue
.. and CVS answered with:
N tm/README.txt

No conflicts created by this import
The N obviously indicates that tm/README.txt is a new file.
Now, let's see what happened in C:\CVSSERVER>.
C:\CVSSERVER\test_module\>cd \..

C:\CVSSERVER>dir
Directory of C:\CVSSERVER
02.11.2004 23:35 <DIR> .
02.11.2004 23:35 <DIR> ..
02.11.2004 15:53 <DIR> CVSROOT
02.11.2004 23:35 <DIR> TestModule
Indeed, it added a new directory called TestModule What's in there?
C:\CVSSERVER\test_module\tm>dir
Directory of C:\test_repository\tm

02.11.2004 23:35 <DIR> .
02.11.2004 23:35 <DIR> ..
02.11.2004 23:35 <DIR> CVS
02.11.2004 23:35 506 README.txt,v
It contains a CVS directory (again, used for CVS use) and the README.txt (with a ,v suffix)
Now, the repository is ready to be used.


so in the end to connect
cvs -d:pserver:some_user:password@localhost:/test /TestModule

posted on Tuesday, May 13, 2008 11:06:21 AM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Monday, May 12, 2008

So I got hooked into LinkedIn as I went crazy adding all my co-workers to get a friend base, I thought… I have been here before. I remember back in 2002 Adding friends to MySpace account. This is funny, adult myspace for the working professional. You can even upload a picture of yourself for what, to date?

All the funny social aside, this is a gold mine for social engineering. You have CxO level people all over the place adding each other and making connections.

Hello Mr.Thompson, My Name is Kelly I got your contact from John Doe who referred me to you for a security audit. I was wondering if i could find some time to meet with you next week. “Sure”

// or “yes kelly what is your last employer …google google”

…awesome

posted on Monday, May 12, 2008 3:36:02 PM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Saturday, May 10, 2008
So I had to pull out a copy of VB6 today to do some project work, hunted down a burnt CD with all my former projects (needed a bit of code I wrote years ago) I burned this cd in 1998. Well looks like the statute of limitations for 1's and 0's are up. I couldnt read 30% of the cd and with RoboCopy it took about 30 min to copy out 100mb. a 4 meg file took 5 min to read from the cd. Sigh.... at least robocopy came to save the day. If only windows file copy was more like that think of all the time it would save people.

anywhoo, remember to re-burn all your old CDs before its too late!

posted on Saturday, May 10, 2008 11:08:19 AM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Tuesday, May 06, 2008

so its been a while since a movie review, things that dont suck were Juno, if you havent seen it then watch it. But this blog post is about action movies that suck.

Spiderman 3 - what the hell was this? suck suck suck

Superman Returns - yawn, was this a action movie or a boring PBS drama?

posted on Tuesday, May 06, 2008 9:17:58 PM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Monday, April 28, 2008
updates crunched into one post as its been slow month for security and nerdy things...

Security:
new versions of fgdump for your slurp tool are out
http://www.foofus.net/fizzgig/fgdump

along with another neat tool for pass the hash type of information gathering
http://sourceforge.net/projects/incognito

a guy rolled his own version of the usb2ram tool that will dump WDE drive keys
http://www.mcgrewsecurity.com/?p=93

also anyone seen that USAirforce commercial about blowing up satellites? great security awareness video haha.

Wedding:
almost everything is done, we got the wine most recently, just need to set it in motion!

Work:
I offically off IT support again, now just do Security Consulting!

other news I also passed my test for General HAM you can now call me K7MHI



posted on Monday, April 28, 2008 2:44:37 PM (Pacific Daylight Time, UTC-07:00)  #    Comments [0] Trackback
# Sunday, March 23, 2008

After all it is easter.

posted on Sunday, March 23, 2008 1:32:08 PM (Pacific Standard Time, UTC-08:00)  #    Comments [0] Trackback
# Thursday, March 20, 2008

recently found a good use of VM Converter to change the disk size and no need to mess around in command line

 1) if you own a copy of converter thats a cheat

http://www.vmware.com/products/converter/

 if all else fails

http://www.ebswift.com/OpenSource/VMDiskSize/

then use diskpart (cmd tool with windows)

run the following commands…(on a different box)

diskpart

list disk

list volume

select volume=(your volume)

extend

list volume (check your work)

posted on Thursday, March 20, 2008 1:49:47 AM (Pacific Standard Time, UTC-08:00)  #    Comments [0] Trackback