powercli - Reference

Connexion avec le user courant:
Connect-VIServer 192.168.0.12

Conexion avec user explicite:
Connect-VIServer vc.domain.local -user readonly@domain.local -pass xxxxxx

Connexion avec menu
Connect-VIServer 192.168.0.12 -menu

Deconnexion forcée de tous les VC
Disconnect-VIServer -Server * -force

Gérer des credentials
New-VICredentialStoreItem -host xxxx -user Admin -Password xxxxxx
(Get-
(Remove-

Voir les connexions utilisées lors d'une session
$DefaultVIServers

---------------

get-vm -name *exch*
get-vm -name * | Out-GridView
get-vm -name SRVxxx | fl

get-vm | Where-Object{$_.Powerstate -eq "PoweredOff"} | Start-VM

get-VM vSRVxxx| Stop-VMguest

get-cluster | Get-VM | select name, @{N="Datastore";E={Get-Datastore -VM $_}} | sort name

Get-VM | Select Name, @{N="Network Adapter";E={$_.NetworkAdapters| foreach-object {$_.Type}}}, @{N="MacAddress";E={$_.NetworkAdapters| ForEach-Object {$_.MacAddress}}}, @{N="PortGroup";E={Get-VirtualPortGroup -VM $_}}

Get-VMHost | Sort-Object Name | Select Name,@{N="VM";E={ if ($_.ExtensionData.Vm -ne $null) { $_.ExtensionData.Vm.Count } else {0}}}

Get-Cluster "clustername" | get-vmhost "hostname" | get-vm | Get-NetworkAdapter | Format-Table parent, networkname, type, MACaddress

To create table with renamed property name, use @{Name="New_Name";Expression={$_.Old_Name}}
Like in above script:

Get-Cluster "clustername" | get-vmhost "hostname" | get-vm | Get-NetworkAdapter | Format-Table @{Name="VirtualMachine";Expression={$_.parent}}, @{Name="VLAN";Expression={$_.networkname}}

To list all harddisks of a VM with size,
Get-VM VM01 | Get-HardDisk | ft Parent, Name, Filename, CapacityKB –AutoSize

And if you want to export this to a CSV file then,
Get-VM VM01 | Get-HardDisk | Select Parent, Name, Filename, CapacityKB | Export-csv C:\file.csv

We can't export output of Format-Table cmdlet to CSV file so we need to use Select-Object instead.

Add PortGroup to all hosts in cluster with PowerCLI
Get-Cluster “clustername” | Get-VMHost | Get-VirtualSwitch -Name “vSwitch_name? | New-VirtualPortGroup -Name “VLAN-xx” -VLanId xx

Check Multi-path policy/configuration of connected storage,
Get-VMHost | Get-ScsiLun | Select VMHost, ConsoleDeviceName, Vendor, MultipathPolicy, LunType

To get list of VMs with snapshot,
Get-VM | Get-Snapshot | Select VM,Name,Created,sizemb

List of VMs having snapshot older than 3 days,
Get-VM | Get-Snapshot | Select VM,Name,Created,sizemb | Where {$_.Created -lt ((Get-Date).AddDays(-2))}

To remove snapshot older than 3 days,
Get-Snapshot | Select VM,Name,Created,sizemb | Where {$_.Created -lt ((Get-Date).AddDays(-2))} | Remove-Snapshot

To list time on all VMhosts,
Get-VMHost | sort Name | select Name,@{Name="Current VMHost Time";Expression={(Get-View
$_.ExtensionData.ConfigManager.DateTimeSystem).QueryDateTime()}}

To find a list of VMs having sync time with host option selected,
Get-View -viewtype virtualmachine -Filter @{'Config.Tools.SyncTimeWithHost'='True'} | select name

----------------------------

Mettre à jour les VmWareTools

vm = "vsrvtest"
**** deconnecter CD
get-vm $vm | get-cddrive | set-cddrive -nomedia -confirm:$false

PS C:\Users\plop> Get-CDDrive $vm | Set-CDDrive -IsoPath "[Datastore] vmware-tools-10.1.7/windows-vmwaretools-10.1.7.iso" -connected:$true -confirm:$false

Confirm
Are you sure you want to perform this action?
Performing the operation "Setting IsoPath: [Datastore] vmware-tools-10.1.7/windows-vmwaretools-10.1.7.iso,
Connected: True, NoMedia: False." on target "CD/DVD drive 1".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): Y

IsoPath HostDevice RemoteDevice
------- ---------- ------------
[Datastore] vm...



PS C:\Users\plop>

PS C:\Users\plop> $DriveLetter = Get-WmiObject Win32_CDROMDrive -ComputerName $vm -credential domain\great.adm | Where-Object {$_.VolumeName -match “VMware Tools”} | Select-Object -ExpandProperty Drive

PS C:\Users\plop> $DriveLetter
M:



PS C:\Users\plop> $ScriptText = "$DriveLetter\setup64.exe /S /v `"/qn /l*v ""%temp%\vmtoolupgrade.log"" REBOOT=R ADDLOCAL=ALL REMOVE=Hgfs`""

PS C:\Users\plop> Invoke-VMScript -VM $vm -GuestUser domain\great.adm -GuestPassword xxxxx -ScriptText $ScriptText -ScriptType bat
WARNING: The version of VMware Tools on VM 'vsrvtest' is out of date and may cause Invoke-VMScript to work improperly.

ENISA 2017 - Report

Le Report 2017 de l’ENISA 

https://www.enisa.europa.eu/publications/enisa-threat-landscape-report-2017/at_download/fullReport

[Windows] Install/Uninstall Trouble

                

1/ Télécharger et installer "Windows Installer CleanUp utility"
http://www.microsoft.com/downloads/details.aspx?familyid=914fbc5b-1fba-4bae-a7c3-d2c47c6fcffc

(source https://support.microsoft.com/en-us/help/17588/fix-problems-that-block-programs-from-being-installed-or-removed)

puis reboot et re-essayer d’installer les mises à jour concernées

(lien direct https://files01.tchspt.com/temp/msicuu2.exe)

[What it fixes



Corrupted registry keys on 64-bit operating systems
Corrupted registry keys that control the update data
Problems that prevent new programs from being installed
Problems that prevent existing programs from being completely uninstalled or updated
Problems that block you from uninstalling a program through Add or Remove Programs (or Programs and Features) in Control Panel ]


2/ Si ca ne suffit pas : ouvrir un mode command "admin" et lancer sfc /scannow pour checker/corriger les fichiers système

 
3/ Si ca ne marche encore pas :
reseter Windows Update selon la procédure
https://support.microsoft.com/en-us/help/971058/how-do-i-reset-windows-update-components


4/ Autre possibilité

Travailler en mode "clean boot"
https://support.microsoft.com/fr-fr/help/929135/how-to-perform-a-clean-boot-in-windows

Apache: visualiser la configuration (PROTIP)

Pour ne visualiser que les lignes non-commentées (donc effectives) d'un fichier de configuration Apache:


grep -v '^#' /etc/httpd/conf/httpd.conf

DNS Sinkhole et proxy HTTP

#PROTIP

 Comment empêcher à peu de frais les systèmes d'un LAN d'accéder aux ressources d'un domaine web ? Différents contextes peuvent légitimer ce type de besoin: un malware résident a été repéré au sein du LAN essayant de contacter un hôte extérieur par son nom FQDN fixe pour exfiltrer des données ou prendre des prérogatives, un nouveau service Cloud hébergé sur un domaine extérieur  doit être rendu inopérant pour les utilisateurs du LAN,...

La solution qui vient naturellement à l'idée est l'utilisation du DNS.

Imaginons que le domaine à bloquer soit malware.ex, il suffit simplement de créer une nouvelle zone DNS "malware.ex" sur le serveur DNS ayant autorité au sein du LAN. Aucun enregistrement particulier supplémentaire à créer.

Dès que le cache DNS client se videra, ces deniers n'auront plus accès au domaine concerné...

Attention: si le malware ou les clients utilisent un proxy d'entreprise pour se connecter à internet il faudra créér la zone "malware.ex" sur le serveur DNS utilisé par le proxy web.

En effet lors de l'utilisation d'un proxy la resolution DNS peut être déléguée de la manière suivante:

- l'utilisateur ou le malware cherche a se connecter sur le domaine malware.ex

- l'adresse malware.ex est cherchée dans les exceptions du proxy client (visibles dans "Ne pas utiliser de proxy pour les adresses..." dans les options de configuration du browser)

- si malware.ex figure dans la liste des exclusions proxy client, le client se connecte directement à la cible via la requète suivante:

GET /control.php HTTP/1.1

Host:foo.malware.ex

 ...en réalisant lui même la résolution DNS.

- si malware.ex ne figure pas dans la liste des exclusions proxy client, le client se connecte à son proxy via la requète suivante:

GET http://foo.malware.ex/control.php HTTP/1.1

et dans son rôle de mandataire, le proxy  réalisera la résolution DNS (ie: à la place du client) et se connectera directement à la cible.

   (à completer)

 



DNS Queries in the LAN: an interesting source of information

Observing DNS queries inside your LAN is a very simple way to detect security problems and/or various misconfiguration issues.

The only pre-requisite for the operator: a good knowledge of his network infrastructure and technologies. The operation can be realized with the builtin Windows features, enabling the DNS debugging (http://technet.microsoft.com/en-us/library/cc759581(v=ws.10).aspx)

I prefer use a simple tool “NirSoft DNS Query Sniffer” available here: http://www.nirsoft.net/utils/dns_query_sniffer.html

1/ Copy and launch it locally on your DNS server. DNS queries appear in real-time.

2/ Stop the acquisition

3/ Analyze in the GUI or export in a file

...easy and simple.

Examples of use:

-          Internet Explorer configuration issue:

A request to wpad.landnssuffix indicates the use of Web ProxyAuto-Discovery Protocol by clients. Of course you can always retrieve IP adress of the requesting source in the dedicated column on the right side (not shown on screenshot) and modify the browser settings as convenient.

 

-          Misconfiguration of a client process:

Here we can see a double dns suffix generating an error. The client, for an unknown reason append the lan dns suffix twice.

 

-          Browser Addon characterization and detection

Look at the Ask toolbar in action and find the clients

 

 

-          Usage of Network Connectivity Status Indicator:

A good explanation can be find here http://www.techrepublic.com/blog/data-center/what-do-microsoft-and-ncsi-have-in-common/

-          CRL checking :

 

And this…

Microsoft puts non-qualified domain name in some certificates. They contain the following CRL distribution point: http://corppki/crl/Microsoft Secure Server Authority.crl which probably only works inside Microsoft LANs.

 

-          Malware detection:

The more powerful usage according to me. Example of requests done by an infected client.

-          Other cases:

Be aware of isolated systems that don’t have internet access and realize outside DNS requests. It can be a data exfiltration in a covert channel
(see https://blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html and http://bernardodamele.blogspot.fr/2012/06/data-retrieval-over-dns-in-sql.html )
 

Capturing DNS queries is an easy way to observe your network infrastructure in action. There's a lot of stuff to do with this little tool. Thanks Nirsoft!

Chicks & Risks

A few years ago, when I started to study Infosec, I was living in the countryside of Provence.
My home was in the middle of a walled garden. I had a dog too. Good, but very unruly! Always jumping everywhere and eating everything. I never succeeded in training him.
One year, at Easter time,some members of my family decided to be innovative when thinking of a gift for my children. They bought 4 young chickens. Wow “What a nice idea !” I replied but with a bad feeling.

At that time, the young chickens were small and lived in a box under a warming light. They had to stay inside the house for 3 or 4 weeks. It was at that time I noticed the behaviour of my dog. He remained outside, his face stuck to the glass window, looking for the chickens with the ever-present idea to “play” with them.

At that time, I realized too that there was only 4 weeks left before the chicks needed to housed outside, I needed to build a strong hen house. A henhouse the dog could never defeat!

So I do ! Building a henhouse is a nice family project. Everybody was involved but I was the project manager: solid metal wire was pegged around the perimeter. Fixing fence posts were cemented in to the ground. Inside the enclosure we built a though wood house where the chickens could be safe. Quickly, the work was done and the hen house and enclosure completed. Before releasing the chicks inside, I checked on several times the overall security off the building. I was proud of our work and was in no doubt that it was impossible for the dog to get inside.

So the chicks were released. It was a success. During the first few days, the dog kept looking at these new guests, sometimes barking but never trying to penetrate the henhouse defences. From their ivory tower, the chickens got used to his presence and behaviour. They were so used to the dog that eventually they paid no attention to him. Instead, they spent their lifes walking around the enclosure eating and sleeping.

I noticed that the chickens particularly appreciated eating blades of grass within the hen enclosure. They systematically ate them all so it was progressively impossible to find any grass inside the run.

One day a chicken passed his head through the metal wire to eat a blade of grass. The dog quickly appeared, grabbed the chicken’s head and well you can guess the rest!

What Infosec lessons can we learn from my henhouse?

When conducting a risk assessment it is often the case that we concentrate on the external threat. Or, in this case, the threat from the dog to the chickens. As the story highlights this is not a thorough or complete assessment of risk.
In my case by only considering the threat of the dog’s behaviour, it led me to develop controls, in this case a wire mesh fence, to prevent the dog getting inside the hen coup where my chickens could be found.  I had forgotten that the objective of my efforts  was to protect the chicken and not just stop the dog.

Thinking in the context of the asset you are trying to protect should never be limited to the malicious threat. In my analogy  I did not consider the chickens behaviour as a threat in its self. Neither did the risk assessment consider the role of grass or the lack of it play in the chickens behaviour, would result in an increased risk. If I had, I would have recognised  that chickens eat grass, and that, when they had eaten all  the grass in the hen coup,  they would be tempted to eat the grass outside of the coup. And, for them to eat the grass outside of the hen coup, they would need to stick their head through the wire mesh fence which was designed to keep the much larger dog from getting through. Recognising this I would have used a finer wire mesh that even the chicken could not get their heads through.
In Infosec, a risk assessment ought to consider the whole environment, within which the asset operates, which may influence the likelihood or impact of an event happening. This should include both internal and external factors.

Processes, information systems, people, facilities which host these systems and people and the geographical location of the assets  to all need to be considered. But this is all only part of the picture. Political, economic, social, technological, environmental and legal factors, all outside of the control of the organisations can also have an effect on our exposure to information security risks.

Le monde après Snowden

Les retranscriptions du colloque par la Chair Castex à l’assemblée nationale le 13 Mars dernier «le monde après snowden » publiées en intégralité sur le site le Monde.fr.

 

http://www.lemonde.fr/pixels/article/2014/06/27/geopolitique-big-data-et-democratie-le-monde-apres-les-revelations-d-edward-snowden_4446858_4408996.html?xtmc=castex&xtcr=1#

How to Anonymize Everything You Do Online

(external source)







One year after the first revelations of Edward Snowden, cryptography has shifted from an obscure branch of computer science to an almost mainstream notion: It’s possible, user privacy groups and a growing industry of crypto-focused companies tell us, to encrypt everything from emails to IMs t



Read more => http://ift.tt/1n8Y808

The Psych of Sec

(external source)







I recently gave this presentation at BsidesCT and have found that slideshare does not like my sense of graphic design as well as a slide deck at times alone just doesn’t tell the full story of the presentation.



Read more => http://ift.tt/1pkTQYc

If You Are Doing Incident Response, You Are Doing It Wrong

(external source)







I’d been thinking about this for awhile, but conversations with Rob Lee and then a presentation with him really helped me clarify my thinking on this issue. Here goes: If you are doing incident response, you are psychologically, if not operationally, in a reactive rather than proactive mode.



Read more => http://ift.tt/1hY5tDE

Infosec has his Godwin law

"As an infosec discussion grows longer, the probability of an ending involving human factor approaches 1"

Windows exploitation in 2013

(external source)







In the past year, Microsoft (MS) has fixed a large number of vulnerabilities for Windows and its components, as well as for Office.



Read more => http://ift.tt/1lwoGd8

Enumeration using the Meterpreter ADSI Extended API Commands

(external source)







Windows Meterpreter recently got some new capabilities thru the Extended API module by OJ Reeves also known as TheColonial. He added support for:



Read more => http://ift.tt/1k6PtMz

PHDays 2014 Quals: DT_VCS writeup

(external source)







It was my favorite task from PHDays 2014 Quals, and the best CTF web challenge i made. During the PHDays Quals it was solved only 3 times, so i think that this writeup will be interesting. Ok, we found Detcelfer Version Control System and need to PWN it.



Read more => http://ift.tt/1dO4q01

ECB/CBC Encryption modes (chop suey)

(Chop Suey are results of my personnal web monitoring about specific topics. I publish the more relevant results in my blog to pickup themes again at a later time if needed)

 

https://www.adayinthelifeof.nl/2010/12/08/encryption-operating-modes-ecb-vs-cbc/

 

https://twitter.com/corkami/status/425895957138399232

 

http://www.racom.eu/eng/support/crypt.html

 

http://bradconte.com/ecb-isnt-a-mode-of-operation 

 

https://pentesterlab.com/exercises/ecb/

 

http://blog.spiderlabs.com/2013/01/defeating-aes-without-a-phd.html

 

Metasploit Meterpreter and NAT

(external source)







Professional pentesters typically use a host that is connected directly to the internet, has a public IP address, and is not hindered by any firewalls or NAT devices to perform their audit.



Read more => http://ift.tt/1dCRvC2

News and Threat Research A Closer Look at Cryptolocker's DGA

(external source)







CryptoLocker is the name of a ransomware trojan family that emerged late last year. This malware is designed to target Microsoft Windows systems and is renown for its ability to take its victim’s files hostage by fully encrypting files on the victim’s computer.



Read more => http://ift.tt/1aMiRoQ

Anatomy of a password disaster - Adobe's giant-sized cryptographic blunder

(external source)







One month ago today, we wrote about Adobe's giant data breach. As far as anyone knew, including Adobe, it affected about 3,000,000 customer records, which made it sound pretty bad right from the start.



Read more => http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/

Adobe credentials and the serious insecurity of password hints

(external source)







Adobe had a little issue the other day with the small matter of 150 million accounts being breached and released to the public. Whoops. So what are we talking about? A shed load of records containing an internal ID, username, email, encrypted password and a password hint.



Read more => http://www.troyhunt.com/2013/11/adobe-credentials-and-serious.html