1<!DOCTYPE HTML> 2 3<!-- 4Strata by HTML5 UP 5html5up.net | @n33co 6Free for personal and commercial use under the CCA 3.0 license (html5up.net/license) 7--> 8<html> 9 <head> 10 <title>bluesoul [dot] net</title> 11 <meta charset="utf-8" /> 12 <meta name="viewport" content="width=device-width, initial-scale=1" /> 13 <meta name="author" content="bluesoul"> 14 <meta name="description" content="A blog about information security and systems administration and management."> 15 <meta http-equiv="content-language" content="en-us" /> 16 17 <meta name="generator" content="Hugo 0.17" /> 18 19 <!--[if lte IE 8]>
19<script src='{{ .Site.BaseURL }}js/ie/html5shiv.js'></script>
19<![endif]--> 20 <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" type="text/css"> 21 <link href='https://d33wubrfki0l68.cloudfront.net/css/4f1a07caa1cedb8bec8e7d12c5f2bfece251e377/css/main.css' rel='stylesheet'/> 22 <!--[if lte IE 8]><link rel='stylesheet' href='{{ .Site.BaseURL }}/css/ie8.css' /><![endif]--> 23 24 25 </head> 26 27 <body id="top"> 28 <!-- Header --> 29<header id="header"> 30 <a href="/" class="image avatar"><img src="https://d33wubrfki0l68.cloudfront.net/8571b84e5a298c8bf45a097ade57d8b0c0916182/80688/images/avatar.jpg" alt="" /></a> 31 32 <h1>I’m a CTO, former sysadmin and occasional malware researcher and rabbit-hole spelunker. I’m not here to sell anything.</h1> 33 34 35 36 <nav id="sidebar"> 37 <ul> 38 39 <li><a href="/">Home</a></li> 40 41 <li><a href="/about">About</a></li> 42 43 <li><a href="/practical-malware-analysis-starter-kit">Practical Malware Analysis Starter Kit</a></li> 44 45 <li><a href="/post/">Blog</a></li> 46 47 </ul> 48 </nav> 49 50</header> 51 52 53 <!-- Main --> 54 <div id="main"> 55 56 57 <div> 58 59
60 <span> 61 <h1> 62 <a href="/post/setting-up-laravel-on-dreamhost-vps/">Setting up Laravel on Dreamhost VPS.</a> 63 </h1> 64 65 66<i class="fa fa-calendar"></i> 67<time datetime="2018-01-02 12:59:12 -0700 -0700">2018-01-02</time> 68 69 70 71 72 73 74</span> 75 76<p>I inevitably google these things in advance so here’s my chance to pay it forward. The good news is it’s incredibly easy. 77Set up PHP 7.1 as the command-line binary: Create a fully-hosted, choosing your VPS as the destination server. By default it’s going to set the web directory to /home/username/{domain} and you’ll want to append /public to the end of that. Use (or create) a user with shell access, the default is SFTP only.</p> 78<hr> 79 80 <span> 81 <h1> 82 <a href="/post/the-most-important-piece-to-getting-hired-isnt-the-certs-or-the-degree-its-the-interview/">The most important piece to getting hired isn't the certs or the degree. It's the interview.</a> 83 </h1> 84 85 86<i class="fa fa-calendar"></i> 87<time datetime="2017-04-13 07:45:58 -0700 -0700">2017-04-13</time> 88 89 90 91 92 93 94</span> 95 96<p>It’s an unfortunate reality that you can be, and maybe already have been, rejected for a position you applied for. Certifications in the relevant fields in hand, a degree to your name…would you be gutted to know that “warm and fuzzies” carries equal weight to the other two? 97Improving your warmth and fuzziness is key not only to getting a foot in the door, but advancement in your career. This is one of a few things that go into the nebulous area of “soft skills,” and I have passed on a lot of candidates because the soft skills aren’t there, and it takes a long, long time to train.</p> 98<hr> 99
100 <span> 101 <h1> 102 <a href="/post/use-nested-traversal-groups-to-allow-access-to-abe-enabled-grandchild-folders/">Use nested traversal groups to allow access to ABE-enabled grandchild folders.</a> 103 </h1> 104 105 106<i class="fa fa-calendar"></i> 107<time datetime="2016-10-06 09:35:02 -0700 -0700">2016-10-06</time> 108 109 110 111 112 113 114</span> 115 116<p>Say you have the following structure: 117 \\DOMAIN\DFS\Folder1\ <– UserA can access this folder. \\DOMAIN\DFS\Folder1\Folder2 <– UserA has no privileges on this folder. \\DOMAIN\DFS\Folder1\Folder2\Folder3 <– UserA has modify access to this folder, subfolders and files. \\DOMAIN\DFS\Folder1\Folder2\Folder4 <– UserA has no privileges on this folder. With ABE, the UserA will not see Folder2 even though Folder3 is something they do have access to. So permissions are added for UserA, but because they were done incorrectly, they can now also enumerate Folder4 which they should not even have been aware of.</p> 118<hr> 119 120 <span> 121 <h1> 122 <a href="/post/use-gpo-to-change-the-default-behavior-of-potentially-malicious-file-extensions/">Use GPO to change the default behavior of potentially malicious file extensions.</a> 123 </h1> 124 125 126<i class="fa fa-calendar"></i> 127<time datetime="2016-05-12 12:08:08 -0700 -0700">2016-05-12</time> 128 129 130 131 132 133 134</span> 135 136<p>If you’re like me and don’t have direct control of your own email filtering, or want to go a step beyond, you’re going to want a way to prevent non-PE viruses from running. Software Restriction Policies are good for this if you’re using them in a whitelist capacity, provided that you’ve also added the extension to the Designated File Types. From a blacklist standpoint it’s tougher. 137Another way to approach the problem is to change the default program to open a particular file extension, and if nothing else it’s another layer of security.</p> 138<hr> 139
140 <span> 141 <h1> 142 <a href="/post/dangitbobby-ps1-remotely-disable-a-nic-given-only-a-username/">DangItBobby.ps1 â Remotely disable a NIC given only a username.</a> 143 </h1> 144 145 146<i class="fa fa-calendar"></i> 147<time datetime="2016-04-07 06:53:19 -0700 -0700">2016-04-07</time> 148 149 150 151 152 153 154</span> 155 156<p>So I have a code offering today, which I’m calling DangItBobby.ps1. It lets you remotely disable the NIC of a computer given only the username that is logged in. In essence, when in the middle of a ransomware infection, and you see that the owner of all the files is changing to Bobby, you run the script and provide credentials of a local admin account. Then you tell it you’re looking for Bobby, it’ll check AD to make sure that’s a valid account, then check with WMI to see if there’s an explorer.</p> 157<hr> 158 159 <span> 160 <h1> 161 <a href="/post/quick-tips-programmatically-emptying-the-temp-folder-for-all-user-profiles-in-a-terminal-server/">Quick Tips: Programmatically emptying the Temp folder for all user profiles in a terminal server.</a> 162 </h1> 163 164 165<i class="fa fa-calendar"></i> 166<time datetime="2016-03-28 07:50:25 -0700 -0700">2016-03-28</time> 167 168 169 170 171 172 173</span> 174 175<p>I ended up needing to do this last week, we have a LOB application that people access via Terminal Services, and it doesn’t clean up after itself in the Temp folder, which causes the application to act up. Can’t get the developers to fix the problem so it’s on us. The existing fix was one batch file, tied to one scheduled task, for every user (50+) of the terminal server. Nightmare to keep maintained.</p> 176<hr> 177
178 <span> 179 <h1> 180 <a href="/post/quick-tips-share-permissions-do-more-than-you-think/">Quick Tips: Share Permissions do more than you think.</a> 181 </h1> 182 183 184<i class="fa fa-calendar"></i> 185<time datetime="2016-03-21 16:29:16 -0700 -0700">2016-03-21</time> 186 187 188 189 190 191 192</span> 193 194<p>While rebuilding a piece of my lab for file server and DFS services, I had an odd set of symptoms. I had a user in a security group that was not set to be able to change permissions, and no ability to take ownership, in the NTFS permissions. Yet they were able to add permissions to give others elevated access, or even elevate their own access. 195It turns out I’d forgotten the share permission side, where this still had some debug settings; in particular, that “Authenticated Users” had full control.</p> 196<hr> 197 198 <span> 199 <h1> 200 <a href="/post/ransomware-is-the-future/">Ransomware is the future.</a> 201 </h1> 202 203 204<i class="fa fa-calendar"></i> 205<time datetime="2016-03-18 10:53:15 -0700 -0700">2016-03-18</time> 206 207 208 209 210 211 212</span> 213 214<p>When I first started fighting ransomware in late 2013, I had a premonition that this was something serious. While CryptoLocker was rather easily defeated in the enterprise and ultimately killed by killing the botnet, media outlets and tech sites ran with the story. It showed this small group making millions and millions of dollars. Guess what? More people started writing ransomware. 215Cut to now. Ransomware-as-a-service is a real thing you can buy, some variants have live chat support to receive payment, and we routinely see new versions with bugfixes and feature-adds.</p> 216<hr> 217
218 <span> 219 <h1> 220 <a href="/post/setting-up-secure-home-folders-without-touching-ad/">Setting up secure Home Folders without touching AD.</a> 221 </h1> 222 223 224<i class="fa fa-calendar"></i> 225<time datetime="2016-03-02 14:29:16 -0700 -0700">2016-03-02</time> 226 227 228 229 230 231 232</span> 233 234<p>In preparing for a new file server schema, I’ve been playing with home folders and quotas. I wanted to come up with a “home folder” solution that met a couple needs: 235 Worked well with Windows 7 through 10 Did not involve the client support team having to set the home folder in each user’s AD profile Did not rely on folder redirection or roaming profiles Set-and-forget implementation and minimal headache to manage in the event of data going missing out of a directory Secure with no ability for users to see other users shares or even be aware of them, or to delegate permissions to other users Does not use a mapped drive, to mitigate against current ransomware trends Can be managed with File Server Resource Manager for quotas and file screening.</p> 236<hr> 237
238 <span> 239 <h1> 240 <a href="/about/">About Me</a> 241 </h1> 242 243 244 245 246 247 248 249</span> 250 251<p>Aren’t you that guy from..? Maybe.</p> 252<hr> 253 254 </div> 255 256 257 258 <section> 259 260 <h2>Recent blog posts</h2> 261 262 263 <div class="row"> 264 <br> 265 <p> 266 <ol class="recent-posts"> 267 268 <li><a href="/post/setting-up-laravel-on-dreamhost-vps/">Setting up Laravel on Dreamhost VPS.</a></li> 269 270 <li><a href="/post/the-most-important-piece-to-getting-hired-isnt-the-certs-or-the-degree-its-the-interview/">The most important piece to getting hired isn't the certs or the degree. It's the interview.</a></li> 271 272 <li><a href="/post/use-nested-traversal-groups-to-allow-access-to-abe-enabled-grandchild-folders/">Use nested traversal groups to allow access to ABE-enabled grandchild folders.</a></li> 273 274 <li><a href="/post/use-gpo-to-change-the-default-behavior-of-potentially-malicious-file-extensions/">Use GPO to change the default behavior of potentially malicious file extensions.</a></li> 275 276 <li><a href="/post/dangitbobby-ps1-remotely-disable-a-nic-given-only-a-username/">DangItBobby.ps1 â Remotely disable a NIC given only a username.</a></li> 277 278 </ol> 279 </p> 280 </div> 281</section> 282 283 284 285 286 287 </div> 288 289 <!-- Footer --> 290<footer id="footer"> 291 <ul class="icons"> 292 293 294 295 <li><a href="//twitter.com/bluesouldotme" target="_blank" class="icon fa-twitter"><span class="label">Twitter</span></a></li> 296 297 298 <li><a href="//github.com/pxdnbluesoul" target="_blank" class="icon fa-github"><span class="label">Github</span></a></li> 299 300 301 302 303 304 <li><a href="/#contact-form" class="icon fa-envelope-o"><span class="label">Email</span></a></li> 305 306 </ul> 307 308 <ul class="copyright"> 309 310 <li>© bluesoul.net</li> 311 312 <li>Design: <a href="//html5up.net">HTML5 UP</a></li> 313 314 <li>Images: Bluesoul Photography</li> 315 316 </ul> 317</footer> 318 319<!-- Scripts -->
320<script src='https://d33wubrfki0l68.cloudfront.net/bundles/c7517b1a1d09568af32dfaaedffe600aa1f03235.js'></script>
320 321 322 323 324 325 326 </body> 327</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.