1<!DOCTYPE HTML> 2 3<!-- 4Strata by HTML5 UP 5html5up.net | @n33co 6Free for personal and commercial use under the CCA 3.0 license (html5up.net/license) 7--> 8<html> 9 <head> 10 <title>Posts · bluesoul [dot] net</title> 11 <meta charset="utf-8" /> 12 <meta name="viewport" content="width=device-width, initial-scale=1" /> 13 <meta name="author" content="bluesoul"> 14 <meta name="description" content="A blog about information security and systems administration and management."> 15 <meta http-equiv="content-language" content="en-us" /> 16 17 <meta name="generator" content="Hugo 0.17" /> 18 19 <!--[if lte IE 8]>
19<script src='{{ .Site.BaseURL }}js/ie/html5shiv.js'></script>
19<![endif]--> 20 <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" type="text/css"> 21 <link href='https://d33wubrfki0l68.cloudfront.net/css/4f1a07caa1cedb8bec8e7d12c5f2bfece251e377/css/main.css' rel='stylesheet'/> 22 <!--[if lte IE 8]><link rel='stylesheet' href='{{ .Site.BaseURL }}/css/ie8.css' /><![endif]--> 23 24 25 </head> 26 27 <body id="top"> 28 <!-- Header --> 29<header id="header"> 30 <a href="/" class="image avatar"><img src="https://d33wubrfki0l68.cloudfront.net/8571b84e5a298c8bf45a097ade57d8b0c0916182/80688/images/avatar.jpg" alt="" /></a> 31 32 <h1>I’m a CTO, former sysadmin and occasional malware researcher and rabbit-hole spelunker. I’m not here to sell anything.</h1> 33 34 35 36 <nav id="sidebar"> 37 <ul> 38 39 <li><a href="/">Home</a></li> 40 41 <li><a href="/about">About</a></li> 42 43 <li><a href="/practical-malware-analysis-starter-kit">Practical Malware Analysis Starter Kit</a></li> 44 45 <li><a href="/post/">Blog</a></li> 46 47 </ul> 48 </nav> 49 50</header> 51 52 53 <!-- Main --> 54 <div id="main"> 55 56 57 58 <span> 59 <h1> 60 <a href="/post/setting-up-laravel-on-dreamhost-vps/">Setting up Laravel on Dreamhost VPS.</a> 61 </h1> 62 63 64<i class="fa fa-calendar"></i> 65<time datetime="2018-01-02 12:59:12 -0700 -0700">2018-01-02</time> 66 67 68 69 70 71 72</span> 73 74<p>I inevitably google these things in advance so here’s my chance to pay it forward. The good news is it’s incredibly easy. 75Set up PHP 7.1 as the command-line binary: Create a fully-hosted, choosing your VPS as the destination server. By default it’s going to set the web directory to /home/username/{domain} and you’ll want to append /public to the end of that. Use (or create) a user with shell access, the default is SFTP only.</p> 76<hr> 77 78 <span> 79 <h1> 80 <a href="/post/the-most-important-piece-to-getting-hired-isnt-the-certs-or-the-degree-its-the-interview/">The most important piece to getting hired isn't the certs or the degree. It's the interview.</a> 81 </h1> 82 83 84<i class="fa fa-calendar"></i> 85<time datetime="2017-04-13 07:45:58 -0700 -0700">2017-04-13</time> 86 87 88 89 90 91 92</span> 93 94<p>It’s an unfortunate reality that you can be, and maybe already have been, rejected for a position you applied for. Certifications in the relevant fields in hand, a degree to your name…would you be gutted to know that “warm and fuzzies” carries equal weight to the other two? 95Improving your warmth and fuzziness is key not only to getting a foot in the door, but advancement in your career. This is one of a few things that go into the nebulous area of “soft skills,” and I have passed on a lot of candidates because the soft skills aren’t there, and it takes a long, long time to train.</p> 96<hr> 97 98 <span> 99 <h1> 100 <a href="/post/use-nested-traversal-groups-to-allow-access-to-abe-enabled-grandchild-folders/">Use nested traversal groups to allow access to ABE-enabled grandchild folders.</a> 101 </h1> 102 103 104<i class="fa fa-calendar"></i> 105<time datetime="2016-10-06 09:35:02 -0700 -0700">2016-10-06</time> 106 107 108 109 110 111 112</span> 113 114<p>Say you have the following structure: 115 \\DOMAIN\DFS\Folder1\ <– UserA can access this folder. \\DOMAIN\DFS\Folder1\Folder2 <– UserA has no privileges on this folder. \\DOMAIN\DFS\Folder1\Folder2\Folder3 <– UserA has modify access to this folder, subfolders and files. \\DOMAIN\DFS\Folder1\Folder2\Folder4 <– UserA has no privileges on this folder. With ABE, the UserA will not see Folder2 even though Folder3 is something they do have access to. So permissions are added for UserA, but because they were done incorrectly, they can now also enumerate Folder4 which they should not even have been aware of.</p> 116<hr> 117 118 <span> 119 <h1> 120 <a href="/post/use-gpo-to-change-the-default-behavior-of-potentially-malicious-file-extensions/">Use GPO to change the default behavior of potentially malicious file extensions.</a> 121 </h1> 122 123 124<i class="fa fa-calendar"></i> 125<time datetime="2016-05-12 12:08:08 -0700 -0700">2016-05-12</time> 126 127 128 129 130 131 132</span> 133 134<p>If you’re like me and don’t have direct control of your own email filtering, or want to go a step beyond, you’re going to want a way to prevent non-PE viruses from running. Software Restriction Policies are good for this if you’re using them in a whitelist capacity, provided that you’ve also added the extension to the Designated File Types. From a blacklist standpoint it’s tougher. 135Another way to approach the problem is to change the default program to open a particular file extension, and if nothing else it’s another layer of security.</p> 136<hr> 137
138 <span> 139 <h1> 140 <a href="/post/dangitbobby-ps1-remotely-disable-a-nic-given-only-a-username/">DangItBobby.ps1 â Remotely disable a NIC given only a username.</a> 141 </h1> 142 143 144<i class="fa fa-calendar"></i> 145<time datetime="2016-04-07 06:53:19 -0700 -0700">2016-04-07</time> 146 147 148 149 150 151 152</span> 153 154<p>So I have a code offering today, which I’m calling DangItBobby.ps1. It lets you remotely disable the NIC of a computer given only the username that is logged in. In essence, when in the middle of a ransomware infection, and you see that the owner of all the files is changing to Bobby, you run the script and provide credentials of a local admin account. Then you tell it you’re looking for Bobby, it’ll check AD to make sure that’s a valid account, then check with WMI to see if there’s an explorer.</p> 155<hr> 156 157 <span> 158 <h1> 159 <a href="/post/quick-tips-programmatically-emptying-the-temp-folder-for-all-user-profiles-in-a-terminal-server/">Quick Tips: Programmatically emptying the Temp folder for all user profiles in a terminal server.</a> 160 </h1> 161 162 163<i class="fa fa-calendar"></i> 164<time datetime="2016-03-28 07:50:25 -0700 -0700">2016-03-28</time> 165 166 167 168 169 170 171</span> 172 173<p>I ended up needing to do this last week, we have a LOB application that people access via Terminal Services, and it doesn’t clean up after itself in the Temp folder, which causes the application to act up. Can’t get the developers to fix the problem so it’s on us. The existing fix was one batch file, tied to one scheduled task, for every user (50+) of the terminal server. Nightmare to keep maintained.</p> 174<hr> 175 176 <span> 177 <h1> 178 <a href="/post/quick-tips-share-permissions-do-more-than-you-think/">Quick Tips: Share Permissions do more than you think.</a> 179 </h1> 180 181 182<i class="fa fa-calendar"></i> 183<time datetime="2016-03-21 16:29:16 -0700 -0700">2016-03-21</time> 184 185 186 187 188 189 190</span> 191 192<p>While rebuilding a piece of my lab for file server and DFS services, I had an odd set of symptoms. I had a user in a security group that was not set to be able to change permissions, and no ability to take ownership, in the NTFS permissions. Yet they were able to add permissions to give others elevated access, or even elevate their own access. 193It turns out I’d forgotten the share permission side, where this still had some debug settings; in particular, that “Authenticated Users” had full control.</p> 194<hr> 195 196 <span> 197 <h1> 198 <a href="/post/ransomware-is-the-future/">Ransomware is the future.</a> 199 </h1> 200 201 202<i class="fa fa-calendar"></i> 203<time datetime="2016-03-18 10:53:15 -0700 -0700">2016-03-18</time> 204 205 206 207 208 209 210</span> 211 212<p>When I first started fighting ransomware in late 2013, I had a premonition that this was something serious. While CryptoLocker was rather easily defeated in the enterprise and ultimately killed by killing the botnet, media outlets and tech sites ran with the story. It showed this small group making millions and millions of dollars. Guess what? More people started writing ransomware. 213Cut to now. Ransomware-as-a-service is a real thing you can buy, some variants have live chat support to receive payment, and we routinely see new versions with bugfixes and feature-adds.</p> 214<hr> 215 216 <span> 217 <h1> 218 <a href="/post/setting-up-secure-home-folders-without-touching-ad/">Setting up secure Home Folders without touching AD.</a> 219 </h1> 220 221 222<i class="fa fa-calendar"></i> 223<time datetime="2016-03-02 14:29:16 -0700 -0700">2016-03-02</time> 224 225 226 227 228 229 230</span> 231 232<p>In preparing for a new file server schema, I’ve been playing with home folders and quotas. I wanted to come up with a “home folder” solution that met a couple needs: 233 Worked well with Windows 7 through 10 Did not involve the client support team having to set the home folder in each user’s AD profile Did not rely on folder redirection or roaming profiles Set-and-forget implementation and minimal headache to manage in the event of data going missing out of a directory Secure with no ability for users to see other users shares or even be aware of them, or to delegate permissions to other users Does not use a mapped drive, to mitigate against current ransomware trends Can be managed with File Server Resource Manager for quotas and file screening.</p> 234<hr> 235 236 237 238 239 240 </div> 241 242 <!-- Footer --> 243<footer id="footer"> 244 <ul class="icons"> 245 246 247 248 <li><a href="//twitter.com/bluesouldotme" target="_blank" class="icon fa-twitter"><span class="label">Twitter</span></a></li> 249 250 251 <li><a href="//github.com/pxdnbluesoul" target="_blank" class="icon fa-github"><span class="label">Github</span></a></li> 252 253 254 255 256 257 <li><a href="/#contact-form" class="icon fa-envelope-o"><span class="label">Email</span></a></li> 258 259 </ul> 260 261 <ul class="copyright"> 262 263 <li>© bluesoul.net</li> 264 265 <li>Design: <a href="//html5up.net">HTML5 UP</a></li> 266 267 <li>Images: Bluesoul Photography</li> 268 269 </ul> 270</footer> 271 272<!-- Scripts -->
273<script src='https://d33wubrfki0l68.cloudfront.net/bundles/c7517b1a1d09568af32dfaaedffe600aa1f03235.js'></script>
273 274 275 276 277 278 279 </body> 280</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.