Jan 11

Export all users in ActiveDirectory

If you’re tasked with generating a list / creating a spreadsheet of all user accounts in AD but are worried you might miss out an OU when manually going through and exporting the list using the Active Directory Users and Computers MMC Snap-in, then use Powershell to generate a list instead, safe in the knowledge it’ll find everything.

If you’re really keen you can subsequently use GNUWin32 to give you neat command line tools usually only available to a bash command prompt on a Linux/UNIX OS to chop columns out of the exported csv file using cut, awk, sort and uniq.  Or just use Excel to achieve it.  More on GNUWin32 here.

Open a Powershell and type the following to export all users in the directory to a csv file…

Import-module activedirectory

get-aduser -filter * | Export-Csv c:\myusers.csv

Since the OU Path’s are themselves comma separated, it throws the keys in the csv out of alignment, making it challenging to extract the columns to the right of it that contains the samAccountName  “Logon Name”.  To get over this hurdle, go back to PowerShell and be more specific about the exact key (or Label) you want, e.g. if you just want a list of Logon Names for all users in AD, then this command works…

get-aduser -filter * | select-object @{Label = “Logon Name”;Expression ={$_.saMAccountName}} | Export-Csv D:\ADUsers\ADUsers.LogonNames.csv

Some other useful Labels you may want to use are shown below for your convenience (including a neat If statement for extracting Disabled Accounts).

@{Label = “First Name”;Expression = {$_.GivenName}}
@{Label = “Last Name”;Expression = {$_.Surname}}
@{Label = “Display Name”;Expression = {$_.DisplayName}}
@{Label = “Logon Name”;Expression = {$_.sAMAccountName}}
@{Label = “Full address”;Expression = {$_.StreetAddress}}
@{Label = “City”;Expression = {$_.City}}
@{Label = “State”;Expression = {$_.st}}
@{Label = “Post Code”;Expression = {$_.PostalCode}}
@{Label = “Country/Region”;Expression = {if (($_.Country -eq ‘GB’) ) {‘United Kingdom’} Else {”}}}
@{Label = “Job Title”;Expression = {$_.Title}}
@{Label = “Company”;Expression = {$_.Company}}
@{Label = “Description”;Expression = {$_.Description}}
@{Label = “Department”;Expression = {$_.Department}}
@{Label = “Office”;Expression = {$_.OfficeName}}
@{Label = “Phone”;Expression = {$_.telephoneNumber}}
@{Label = “Email”;Expression = {$_.Mail}}
@{Label = “Manager”;Expression = {%{(Get-AdUser $_.Manager -server $ADServer -Properties DisplayName).DisplayName}}}
@{Label = “Account Status”;Expression = {if (($_.Enabled -eq ‘TRUE’) ) {‘Enabled’} Else {‘Disabled’}}}
@{Label = “Last LogOn Date”;Expression = {$_.lastlogondate}}

You can combine the Labels above in a single command with a comma in the select-object section, for example to extract all logon names and whether or not the account is disabled…

get-aduser -filter * | select-object @{Label = “Logon Name”;Expression ={$_.saMAccountName}},@{Label = “Account Status”;Expression = {if (($_.Enabled -eq ‘TRUE’) ) {‘Enabled’} Else {‘Disabled’}}} | Export-Csv D:\ADUsers\ADUsers.LogonNames.csv

I had some trouble with the LastLogon Label, so have included the working example used to obtain this information below.

get-aduser -filter * -properties * | select-object @{Label = “LogonName”;Expression = {$_.saMAccountName}},@{Label = “LastLogonDate”;Expression = {$_.LastLogonDate}}| Export-Csv D:\ADUsers\ADUsers.LastLogon.csv

 

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Jan 03

Protect your Anonymity online with Vadalia, Privoxy and Proxychains

Happy New Year.  You will be monitored.  We are watching you.  We know who you are.  We know where you are.

The following is a concise guide to configuring Internet Anonymity on Linux by leveraging the tor network (vidalia) and a local proxy server (privoxy) then running your web browser using proxychains.

I have tried the tor browser bundle but couldn’t access most of my websites so found it to be pretty useless in everyday life.  This however, lets me access all my sites fine (so far), so provides protective anonymity without getting in the way.

I have found certain sites like Google sometimes use captcha to prove you’re a human but it’s no big deal.  It is a response that is more likely to be coming from OpenDNS rather than Google actually.

Disclaimer:  The following should be used for educational purposes only and not to facilitate any illegal online activity.

This is a compliment to your firewall.  It should remain ON.  You can further harden your web browser by “jailing” it to prevent penetration by following this guide here.

Remember:  Todays paranoia is tomorrows security standard.

TEST
firefox www.dnsleaktest.com www.whatismyip.com
You should see your IP address and location.

This information is logged along with the sites you visit and held by your ISP in line with new regulations.  Everything they need to lead them right to your door.  FTS.

PACKAGES TO INSTALL
sudo apt-get install privoxy vidalia proxychains

PRIVOXY – local privacy proxy server runs on 127.0.0.1:8118
vi /etc/privoxy/config, search for localhost:8118 and replace with 127.0.0.1:8118

VIDALIA – tor front-end. set up relaying to use local privoxy proxy (enter privoxy settings above) then add vidalia to Session & Startup apps list.

  Note that the green Tor onion may take a little while to go green after your computer initially connects to the network/wifi.

DNS SERVICES – change your network/wifi IPv4 settings
Use OpenDNS addresses 208.67.222.222 208.67.220.220

PROXYCHAINS
ProxyChains allows to run any program through HTTP or SOCKS proxy.
This tool tunnels all TCP and DNS connections of given applications.

Note: precede launcher command of application with proxychains, i.e. proxychains firefox %u

vi /etc/proxychains.conf
comment out strict_chain
uncomment dynamic_chain
add these lines under [ProxyList] section
socks4 127.0.0.1 9050
socks4a 127.0.0.1 9050
socks5 127.0.0.1 9050
http 127.0.0.1 8118

TEST
proxychains firefox www.dnsleaktest.com www.whatismyip.com
You should see that you now appear to be in a foreign country, not your actual geographical location.

Download the latest Linux .iso file to create some bandwidth and view the bandwidth graph in vidalia.

That’s it.  You’re Anonymous!

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Dec 14

Best file manager on Linux? Dolphin.

Need a powerful file manager on Linux?  Minimalism is so last decade.  Functionality is king and it needn’t look ugly either.  Look no further than Dolphin.  KDE’s file manager and it’s an absolute cracker of a file manager.  It’s nothing new as it’s been about a while.

My favourite feature, other than the split screen and integrated command line panel (so long as you install konsole as well as dolphin), is being able to pause multiple, individual in-flight IO operations.  This is great if you’re making multiple copies to a USB stick and want to queue up the individual copy requests so they’ll ultimately complete quicker.

It’s quite simply the best file manager I’ve ever seen.  All about functionality.

sudo apt-get install dolphin konsole

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Dec 14

Notepad++ for Linux (Notepadqq)

Add yours and my favourite text editor (Notepad++) to your preferred Linux distribution (Linux Mint) using the following commands…

sudo add-apt-repository ppa:notepadqq-team/notepadqq
sudo apt-get update
sudo apt-get install notepadqq

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Nov 28

Change Cisco MDS Admin password

Step 1 Use the show user-accounts command to verify that your user name has network-admin privileges.

switch# show user-account
user:admin
this user account has no expiry date
roles:network-admin

Step 2 If your user name has network-admin privileges, issue the username command to assign a new administrator password.

switch# config t
switch(config)# username admin password <new password>
switch(config)# exit
switch#
 

Step 3 Save the software configuration.

switch# copy running-config startup-config
Full cisco documentation here (includes password recovery for lost passwords)
Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Nov 25

How to cable up VNX SP Ports (Dual Fabric topology)

So your VNX has two SP’s and you have two fabric switches.  You already know you have to connect each SP to each fabric for resilience, but you’re still a bit confused.  Fear not.  Use this as a guide.  It can be used no matter how many front-end port modules and SFP’s you have so that you get it right first time for all your designated Storage Ports, Mirrorview Ports, Sancopy Ports required for your project.  The FC Switch Ports you choose are not set in stone, but keep it the same on each side at least.

 What’s important is that the correct SP port, goes to the correct switch.

When you know you’ve got it right, you can get verify the WWN in Unisphere corresponds with the WWN logged in on the FLOGI database on the switch to check before you create the requisite fcaliases etc.

cablingvnx

It’s much easier to build it right first time than sort it out afterwards.

 

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Nov 07

Protect your Linux system by jailing your web browser

Your Linux system is inherently less vulnerable to attack than Microsoft Windows for a number of reasons.

  1. You’re less of a target to virus attack by being in the minority (Only 2.18% of people run Linux as their desktop operating system with most of those running a Debian derivative, the most popular being Linux Mint).
  2. You execute user processes as a non-privileged user (Remote code executing in your browser is not running in the context of a local Administrator account so has much less privileges to do potentially damaging things to your computer and data).
  3. Your Linux system is built entirely from packages obtained and installed from known, trusted repositories (No dodgy software downloaded from goodness-knows-where that may or may not be what you think it is.  The code of any given package undergoes constant scrutiny and improvements by the open source community.)
  4. There’s no marketing, advertising, ransom-ware or hidden agendas lurking in the operating system or the applications that are ultimately built by the people, for the people, and distributed to the people for free (feel the love).

Despite all these advantages, we live in the (dis)information age, and that means that the way to reach your users is through their web browsers.  So this next part should interest you.

…we live in the disinformation age, and that means the way to reach you is through your web browser.  So this next part should interest you.

How do I protect my web browser? (Firefox is the default web browser on Linux Mint -my OS and browser of choice)

firewall

  1. Enable the firewall (above)
  2. Once a new installation of Linux Mint is complete, I reboot, log on, Install all pending updates by typing sudo apt-get update && sudo apt-get dist-upgrade in a terminal window.
  3. Connect to my WiFi network, open Firefox and install the AdBlock Plus and uBlock Origin plugins.

And that’s it.  Or at least it has been until now, and in fairness it’s kept me safe since 2005.  I’ve never installed anti-virus software and never had a problem in over a decade.  AV products on Linux such as clam are usually for the benefit of Windows users on the same network or mail attachment scanning on Linux mail servers, neither of which is applicable in my home network environment.

Today though, I learned about something else.  The existence of firejail, -a program that “jails” certain other programs, and I really like what I see.

Like most Linux programs, it’s super quick to install with a quick sudo apt-get install firejail command in a terminal window and as easy to “use”.  In firejail’s case, you just edit the shortcuts of your existing launchers and pre-pend the command firejail

e.g. firefox %u becomes firejail firefox %u

firejail

By jailing the firefox process, it prevents the web browser from being able to access your system, quite literally.  Kind of like a firewall for processes rather than TCP/UDP ports, that only allows certain interactions with the rest of the operating system through.

For example, look what happens when trying to upload a picture I’ve saved to my Desktop to this very blog post…

desktop

The Desktop looks empty.  Nothing.  Blank.  No files or subfolders.  Yet my Desktop folder contains loads of images and other files and subfolders, as does my Pictures folder – same again, blank.  This is because firefox is jailed.  It can’t get out and into your filesystem.  Brilliant – and only a little inconvenient as it can still access my Downloads folder.  So if I want to upload a file, I just have a make a copy into my Downloads folder first using my File manager caja (which isn’t jailed).  Uploading to my Dropbox account using the web based interface would be a bit of a pain, but the Dropbox daemon running on my computer does all my file syncing anyway, so it doesn’t present a problem.  I don’t actually need to use Dropbox’ web interface.

This all works in accordance with the application profile in /etc/firejail/firefox.profile -there’s loads of them, not just for firefox but other internet/vulnerable programs like filezilla, transmission etc too.

Filezilla’s firejail profile on the other hand seems to be a lot more lenient and allows access to your home directory where you might wish to upload an entire folder structure to your web server.  You could always edit the filezilla.profile to harden it yourself I guess.

Whilst I found firejail in my repositories, I didn’t find the accompanying firetools package – a simple launcher that sits on your desktop.  It’s not really needed if you’ve edited your launchers to your favourite apps already and just allows you to add some additional programs to it and shows any running jailed processes if you’re interested in seeing that.  It places a convenient icon in your systray area too, for easy recall.

firetoolsfiretools-trayfiretools-processes

 

 

 

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Oct 31

What groups am I a member of?

Need to know what groups you’re a member of in Active Directory, but don’t have access to AD Users and Groups management snap-in?  Try this command.  It may help to run cmd.exe as Administrator if that privilege is available to you, but may not be necessary.

gpresult /r

The output at the bottom will be something like this, along with any additional Global group names you’re a member of.

gpresult

An alternative is whoami /groups which provides an output similar to this…

whoami

Note: whoami also works on Linux/UNIX systems.

 

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Sep 07

Inject Administrators/Full Control permissions into inaccessible folders.

Note:  This can also be used to inject Everyone/Full Control, or a specific user, using the username or SID.  The Administrators Group SID is always S-1-5-32-544.  Other well-known SIDs are listed here.

Download the command line version of SetACL.exe from here.  Like all the best things in life, it’s free.

Open a command prompt as Adminstrator (right click cmd.exe, run as admin)

setacl -on “C:\Private No Entry” -ot file -actn ace -ace “n:Administrators;p:full” -rec cont_obj -ignoreerr

The “Private No Entry” folder should now have Administrators, Full Control Permissions.  If not, don’t fret, read on…

The following command gives Administrators the “dream ticket” to accessing all data by setting ownership to Administrators on all folders and files and forcing subdirectories to re-inherit inheritable Administrators:Full Control permissions from the parent.

setacl -on “C:\Private No Entry” -ot file -actn setprot -op “dacl:np;sacl:nc” -rec cont_obj -actn setowner -ownr “n:S-1-5-32-544”

If you still receive “Operating System Message:Access Denied” or similar, then you’ll need to take a robocopy of the “inaccessible” data using the /B switch to exploit OS Backup Right, leaving permissions behind using /COPY:DAT (instead of /COPY:DATSOU or /COPYALL) then repeat the process above on the copied data instead.

robocopy “C:\Private No Entry” “T:\Cracked Data” /B /COPY:DAT /E /NP /R:1 /W:1

Now view the Inherited permissions on the copied data…  You’ll see it has a whole bunch of new, open permissions that it’s got from the parent folder T:.

cacls “T:\Cracked Data”

The cracked data could be robocopied back over the original inaccessible source data using /MIR /COPYALL /SEC /SECFIX switches if required.  If it doesn’t allow it, then note that I have successfully robocopied an empty folder over the top of an inaccessible folder before using just /MIR  (in order to delete it), then robocopied the cracked data back into place, e.g.

robocopy “T:\Empty Folder” “C:\Private No Entry” /MIR /B

robocopy “T:\Cracked Data” “C:\Private No Entry” /MIR /SEC /B

Finally, if you want to re-harden the folder whilst retaining the access you’ve granted Administrators, then use the following commands…

Presently, access has been attained via inherited permissions so before removing inheritance, first inject a non-inherited ACE that allows administrators access, i.e.

setacl -on “C:\Private No Entry” -ot file -actn ace -ace “n:S-1-5-32-544;p:full” -rec cont_obj

Verify the Administrators:Full Control permissions are present on the folder

cacls “C:\Private No Entry”

Finally it is safe to remove inheritance without losing access (strictly speaking, you are “protecting the child object from inherited permissions on the parent object”)

setacl -on u567149 -ot file -actn setprot -op “dacl:p_nc;sacl:p_nc”

This sequence of commands can be used to copy users home directories that are typically hardened to only permit the user themselves access to the data contained within.  If you are using it to migrate home dierctories, there is a loop to re-apply user-specific permissions to each homedirectory afterwards here

Facebooktwittergoogle_plusredditpinterestlinkedinmail
comment?
Jul 15

Install hevc codec for .mkv video on Linux Mint

Given how complete Linux Mint is out of the box, I’m surprised to have experienced this problem even after installing all extra codecs from the repositories after initial installation.

Upon attempting to play the latest .mkv episode of Silicon Valley, I received the following error in VLC Media Player.

“unable to decode hevc, there’s nothing you can do about this error”

Or words to that effect.  I’d include a screen-shot of the error but I’ve fixed it now, so am sharing the fix with you instead.  I’ll keep it succinct.

sudo apt-add-repository ppa:strukturag/libde265

sudo apt-get update

sudo apt-get install gstreamer0.10-libde265

sudo apt-get install gstreamer1.0-libde265

sudo apt-get install vlc-plugin-libde265

Facebooktwittergoogle_plusredditpinterestlinkedinmail
2 comments
Social Media Auto Publish Powered By : XYZScripts.com