Ncat for Fun and Profit - The network Swiss army knife ... not so much.

Ncat was born out of the Google Summer of Code project and was written in similitude to Netcat by Hobbit but not using any of Hobbit's source code. 

There are some differences between Ncat and Netcat such as the omission of port scanning functionality - Ncat cannot take a list of ports to connect to on a host system, only a single port at a time, and has no port randomization or zero-I/O mode functionality. 

From the developers standpoint, this does make sense as it is bundled with the best port scanner in the world, Nmap. 

However, Ncat can't really take on the mantle of "The network Swiss army knife" by reducing functionality.

You can download the current stable and beta versions of Ncat from: Fyodor's Nmap site

The windows binary can be gotten in the Nmap Win32 zip distribution or installed as part of the Nmap installation using the windows installer version.

Here are some usage examples to try out for fun on your "lab network" (grin, grin, wink, wink)

Connect to nsa.gov on TCP port 8080.

• ncat nsa.gov 8080

Listen for connections on TCP port 8080.

• ncat -l 8080

Redirect TCP port 8080 on the local machine to host on port 80.

• ncat --sh-exec "ncat nsa.gov 80" -l 8080 --keep-open

Bind to TCP port 8081 and attach /bin/bash for the world to access freely.

• ncat --exec "/bin/bash" -l 8081 --keep-open

Bind a shell to TCP port 8081, limit access to hosts on a local network, and limit the maximum number of simultaneous connections to 3.

• ncat --exec "/bin/bash" --max-conns 3 --allow 192.168.0.0/24 -l 8081 --keep-open

Connect to smtphost:25 through a SOCKS4 server on port 1080.

• ncat --proxy socks4host --proxy-type socks4 --proxy-auth user smtphost 25

Create an HTTP proxy server on localhost port 8888.

• ncat -l --proxy-type http localhost 8888

Send a file over TCP port 9899 from host2 (client) to host1 (server).

• HOST1$ ncat -l 9899 > outputfile 
• HOST2$ ncat HOST1 9899 < inputfile

Transfer in the other direction, turning Ncat into a “one file” server. 

• HOST1$ ncat -l 9899 < inputfile 
• HOST2$ ncat HOST1 9899 > outputfile  

Hackers of the World - Unite!

Launch CMD line apps from windows shortcuts that stay open after execution

Sometimes you just feel lazy. Admit it. You'd like to be able to just double-click a shortcut and launch your favorite command line applications in one shot ... oh and not have them disappear once they complete their run before you can absorb the output. :)

Here's a quick little trick that some may or may not know.

CMD.EXE has some switches of it's own that don't get used too often unless you spend a lot of time scripting batch files etc.

The one we care about for this blog post is the"/K" switch

Definition -/k : Carries out the command specified by string and continues.

So let's say you have Ncat installed and you want to have a quick desktop shortcut to launch it, you would set it up as follows:

1. Right-click the desktop and choose NEW > Shortcut and the following window will appear

2. Enter "cmd.exe" into the location and click NEXT
3. Type in the desired shortcut name, in this case: Ncat 5.21
4. Once you have clicked Finish, you should see something like the following on the desktop. Right-click the icon and choose Properties
5. In the Properties pop-up window, you should see the following
6. In the "Target:" field append " /k ncat -h" with out the quotes as shown below**NOTE: I like to add the "-h, -?, or /?" switch to print help at the end of the command as some command line tools if launched without a help switch will enter interactive mode immediately and I always like a quick reminder of the switches I can use with the command before using it.

7. Also you'll want to usually run built-in command line tools from the systems directory, in this case: SYSTEM32 So append it to the path "Start in:" like shown below.8. I like to modify the Options for the command prompt window to allow QuickEdit. Just check the box for it on the Options Tab as shown below.9. I usually increase the size of the command prompt window as well. From the Layout Tab I change the windows size height to 50 as shown below, so I can see all the help that the "-h" printed.10. After clicking OK, I double-click the shortcut icon and viola:
This can be used for any command line application. You can get more creative to include more complex switch and command arguments to the shortcut if there is a particular process you want to launch easily. If you go too far with it, you might as well start batch scripting though. ;)

Go Team CMD-LINE!

Break-out the low-level processes running under SVCHOST

This is an after thought note the preceding post.

Windows uses the Service Host (svchost.exe) process to collect a number of lower-level critical system services into a single process instance for task management. It does this to reduce boot time, system overhead and reduce the number of separate lower-level service processes running.

Windows creates different svchost.exe instances based on the different lower-level processes' system access and security requirements.

To determine which processes are running under a single svchost.exe instance use the following command sequence from the command-line:

tasklist /svc /fi “imagename eq svchost.exe”

Make sure to type it from scratch, sometimes copying and pasting will cause the command parser to misinterpret the section in quotations on this particular command.

It should output something that looks like the following:

Check out this link for a deeper look at TechNet details on the tasklist command:

http://technet.microsoft.com/en-us/library/cc730909(WS.10).aspx

Bad service!! BAD! STOP!!

Have you ever tried to stop or restart a Windows Server service when you couldn't afford to reboot because the CFO was in the middle of something "Financial" on the server and you like having a job? Well I have and on many occasions. Now what happens when that service doesn't want to stop?

SMTP service "stopping".... (get lunch and come back) SMTP service "stopping"....

Ugh.

Well if that service is an executable file then you can force it to stop with either the following command sequences:

taskkill /s hostname /IM ImageName /F

taskkill /PID ProcessID /F

But you say, "That's great, ServerGoBoom, but how do I figure out the ImageName or ProcessID for the &#^$%! service I want to kill .. er ... stop?"

Good question. You could do it one of a couple ways both involving the Windows Task Management systems, graphical and textual. :)

You can use Task Manager which provides a GUI view of the Process currently running on your system. If you don't already know, you can access this utility easily by right-clicking the Task bar (or Start Bar) and choosing Task Manager from the dropdown menu that appears.

Once you have it open, you'll notice that the Task Manager window has several tabs, one of which is Processes. Click this to put it in focus. If you don't see a column named PID then click the View option at the top of the window, click Select Columns ... then put a check in the box next to PID (Process Identifier) and click OK.



Now you can see which Services (Image Name column) match which PIDs (PID Column), plug in the info for the service that won't stop into the either of the command sequences quoted above and bingo. Bob's your uncle, Fanny's your aunt. Service stopped.

If you prefer the simplicity and stark beauty of the command-line as I do, then you can open the command prompt and use the tasklist command to generate a text-based table of the same info that looks like this:









Check out this link for the TechNet break-down on the Taskkill command:


http://technet.microsoft.com/en-us/library/cc725602(WS.10).aspx

Get a list of Windows 2008 Updates in simple text format.

When recording the updates manually that have been installed on a system for my clients, it used to be easy in Windows 2003 since the update history was just a web page.

However, in Windows 2008/Vista/Window 7 it is no longer easy to copy all the updates which have been installed on a certain date with the description and KB numbers and paste them into my report.

I have found a way around this as Windows 2008/Vista/Window 7 has a log of all downloaded updates and if they have been installed successfully at the following location:

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log

It is a simple process of scrolling to the end of the log to copy the section that looks like the following:

{FD92377F-D788-4D8F-923F-6D07CE81DB3D} 2010-04-28 22:33:42:727-0700 1 184 101 {98140701-9959-0001-0000-812532895600} 102 0 AutomaticUpdates Success Content Install Installation successful and restart required for the following update: Update Rollup 10 for Exchange Server 2007 Service Pack 1 (KB981407){F45D593D-CA26-484A-AC33-C6724C83C954} 2010-04-28 22:35:49:984-0700 1 183 101 {E4AB408F-0208-4BB8-9782-C1D895DC4F78} 101 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Windows Malicious Software Removal Tool x64 - April 2010 (KB890830)

Then you can paste it to a text file and clean it up or you can Paste Special as Unicode Text to a MS Excel spreadsheet to paste the data into nice columns which you can copy the specific data columns you want and then paste to your report.

Enjoy!

Status information for Windows services

When a windows service is running, it sends status notifications to the SCM process. SCM maintains this status information in the service record for each service. SCM tracks this information so that it does not mistakenly send control requests that do not conform to the recipient service's current state.

The service status information includes:

• Service Type - A service can be a file system driver, device driver, or a Windows service, and can run its own process or share a process with other services. System Attendant is an example of a service that runs its own process. The SMTP service, however, is a service that shares a process with other services that are integrated with Internet Information Services (IIS).
• Current state - The service state can be starting, running, paused, stopping, or not running.
• Acceptable control codes - Theses are the control codes that the service is able to accept and process in its handler function, according to the current state.
• Windows exit code - The service uses this code to report an error that occurs when it is starting or stopping. To return an error code specific to the service, the service must set this value to ERROR_SERVICE_SPECIFIC_ERROR to indicate that additional information can be found in the service exit code. The service sets this value to NO_ERROR when it is running or stopping properly.
• Service exit code - The service uses this code to report an error when it is starting or stopping. The value is ignored unless the Windows exit code is set to ERROR_SERVICE_SPECIFIC_ERROR.
• Wait hint - The service uses this code to report the estimated time, in milliseconds, required for a pending start, stop, pause, or continue operation.
• Checkpoint - The service uses this value to periodically report its progress during a lengthy start, stop, pause, or continue operation. For example, the Services tool uses this value to track the progress of the service during start and stop operations.

Displaying Serivce Exit Codes -

To display the current status for all Windows services, you can use the command sc query

Simply run the command sc query service_name and look for the WIN32_EXIT_CODE field in the output of the command.

If this field is zero then the service started properly, and if the service didn't start properly then WIN32_EXIT_CODE will display a non-zero exit code specific to the service.

For example, when I run the command sc query vss to query the status of the Volume Shadow Copy service on a Windows XP machine, the WIN32_EXIT_CODE value returned is 1077 (0x435).

To find out what this exit code means, you can type net helpmsg 1077, and the result of doing this is "No attempts to start the service have been made since the last boot."

This likely indicates that the Startup Type for this service is Manual i.e. the service isn't set to start automatically upon reboot.

I hope this tip proves useful for you.

**Information in this post consolidated from several sources including MS TechNet, WindowsNetworking.com, etc.**

Remote control sessions keep loosing connection

RDP, LogMeIn, VNC etc -

The most common issue is an unstable IP protocol stack. Try running "netsh int ip reset c:\ipreset.log"

The other common issue is trojan redirectors attempting to override the DNS which causes connections to drop.

If this goes away by the user connecting in Safe Mode with Networking, then you have an issue with a trojan, a firewall application, or an a/v application trying to block the system.

Email Administrator Tips - Volume 1

When you are performing the email administration role, there are some important things to keep in mind and to test on a regular basis.

Here's some basic Email services checklist items:


Test Remote Email Web Access -

Make sure you can successfully connect and log in to Outlook Web Access (OWA) etc.

Check that all Email services are running -

You either need to confirm these yourself on a daily basis or setup availability monitoring via RMon etc. Some of these services can be continuosly monitored from your desktop using Exchange Monitor.

Check Mail queues -

Check in Exchange System Manager (or equivalent) that there are no pending emails in the mail (SMTP) queues.


Check Size of Mailbox stores -
Managing the size of your email databases is critical especially in Small Business environments where disk space is at a premium.

Exchange uses single-instance storage, so if a message is sent to 20 employees, only one copy is kept in the mailstore DB.

This keeps the size of the store down, but the mailbox list counts this message in the total size for each of those 20 users. So, the total of the mailbox sizes from System Manager will almost always be larger than the actual databases sizes.

The quickest way to check total storage size for Exchange 2000 - 2007 is here: http://www.petri.co.il/reporting_storage_size_in_exchange.htm

Check sizes of individual mailboxes -

As with the above advice, you also need to make sure you keep track of your biggest offenders in the mailbox disk space usage wars. In Exchange 2003 this can be checked easily from System Manager's Mailboxes screen. Mailbox sizes should be kept below 2GB and 10K items to maintain performance according to best practices.

Offline Mail Store Defrag -

Consider performing an offline mail store defrag depending on the activity of email, but especially if you haven't performed one in 6 months or if you have recently deleted a lot of old mailboxes.

The mail store size doesn't really shrink after these deletions until on offline defrag is performed. This can take several hours for a small to moderate sized mail store set, so you'll need to bring mail services down during that time, best done in the middle of the night and when you have scheduled downtime with the users.


Clean up BADMAIL directory -

"What is this BadMail? Let us start with NDRs (Non-deliverable requests). These NDR emails cannot be returned to the sender. So what happens is that after the allotted retries, Exchange 2003 routes the email to a bin called the BadMail folder.

To find the BadMail folder: Navigate to \Exchsrvr\Mailroot, now you should see a \vsi 1\BadMail folder. There will be one vsi folder for each virtual server. " (See link below)

This was important with Exchange 2000 and earlier. If you are using Exchange 2003 SP1 and later then you can skip this.

Here is a good summary of BadMail: http://www.computerperformance.co.uk/exchange2003/exchange2003_badmail.htm

Confirm that there are no open relays -

Test for open mail relays using (one or more of the following sites): http://www.mxtoolbox.com/diagnostic.aspx

http://www.checkor.com/

http://www.spamhelp.org/shopenrelay/shopenrelaytest.php

http://www.abuse.net/relay.html


Useful tools to have in your toolkit:


Sam Spade (WIN32) - a multi-function analysis web site that can decode a message's headers and make a fairly good guess about where it came from. Be patient with yourself while learning it, it's a very useful tool for dealing with spam and backtracing it's origin.


Exchange Monitor (WIN32) - from SolarWinds is a desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health.

Microsoft Exchange Server User Monitor (WIN32) aka ExMon - Use the Microsoft Exchange Server User Monitor to gather real-time data to better understand current client usage patterns, and to plan for future work. Administrators can view several items, including IP addresses used by clients, versions and modes of Microsoft Office Outlook, and resources such as CPU usage, server-side processor latency, and total latency for network and processing. Works with Microsoft Exchange Server 2000, 2003, 2007 and 2010. How to use it: http://www.petri.co.il/using_ms_exmon.htm

Configure Services MMC to Open Maximized by Default

One of my pet peeves when working on client servers remotely doing maintenance is that I need to check to make sure all automatically started services are ... started, using Services MMC.

You'd think this would not be an issue, but believe me, automatically started services do not always start automatically. True Story.

Now when you open up Services (services.msc) it starts in extended windowed mode. I like to maximize it to see the most services at a glance as possible.

You can edit the shortcut for the MMC all day long and it will never start Maximized ... Damn you Microsoft!

Well here's how you fix this in the non-obvious way:

You will open Services MMC in author mode to create a new Services console or modify existing Services console. (This works for all MMCs btw)

1. Click Start, Run and type %systemroot%\system32
2. Right click the file Services.msc and copy/paste it back into the same directory, which will create a backup copy called "Copy of Services.msc"
3. Right-click the original Services.msc, and choose Author

The Services MMC Snap-In opens in Author mode, in which you can customize the window size, pane width, view mode (Standard or Extended) etc.

4. Customize the MMC to your hearts content.
5. From the File menu, click Save As to save your settings, save over Services.msc.
6. Exit the Services MMC.

Now open Services MMC (services.msc) normally, it should have retained your customizations.

Rock it like a hurricane, baby!

Get System Uptime quickly via the Command-line

Here is a real quick way to find the a System's Up Time value (Time since it was last booted) using the Command Prompt.

This becomes important during due-diligence on a server crash etc. where you need to determine when the system came back online etc.

The following command-line coding uses the piping technique and the Find filter tool to easily isolate the System Up Time value:

Open a Command Prompt window.

Type the following command, exactly as you see it here, caps and quotes included:

Systeminfo Find "Up Time"

This will print the info to the Command Prompt window, if you would like to send it to a text file for instance, type is in as follows:

Systeminfo Find "Up Time" > c:\uptime.txt

For Windows 2008 and Vista/Windows 7 use the following command:

Systeminfo Find "System Boot Time"

** Note between Systeminfo and Find there is a pipe (shift+\) which blogger.com is removing, so make sure to put it in.

If you'd like to just type in uptime to get the System Up Time value then you can also download the following command-line app from Microsoft and install on your PC/server:

http://download.microsoft.com/download/appcenter2000/uptime/1.0/NT5/EN-US/AC-UpTimeTool.exe