作者归档:flyinweb

How to change Registry Permissions with RegIni.exe (VBScript)

Today I’ll show how we can set the following permissions on a registry key with RegIni.exe and a VBScript:

– Creator Owner Full Control
– Users Full Control
– Power Users Full Control
– Administrators Full Control
– System Full Control

I will set the permissions here for testing purposes:

– HKEY_CLASSES_ROOT\AlejaCMaTypelib
– HKEY_LOCAL_MACHINE\Software\AlejaCMaCo\AlejaCMaApp

And for that I will need to create a special regini.exe script which will have the following contents:

HKEY_LOCAL_MACHINE\Software\Classes\AlejaCMaTypelib [1 5 7 11 17]
HKEY_LOCAL_MACHINE\Software\AlejaCMaCo\AlejaCMaApp [1 5 7 11 17]

Notes:
– With regini.exe I won’t be able to set Users Full Control, but Everyone Full Control.
– HKEY_CLASSES_ROOT = HKEY_LOCAL_MACHINE\Software\Classes 继续阅读

Webshell中的不死僵尸删除方法:解决“删除文件或文件夹时出错,无法删除找不到指定文件”

正 文:

今天有客户网站中毒,遂从FTP下载所谓木马文件,本地运行后,生成一个com7.h.asp的文件,在图形界面下无论如何都无法删除。提示“删除文件或文件夹时出错,无法删除 com7.h : 找不到指定文件”。     其实这是利用系统保留文件名来创建无法删除的webshell。

Webshell中的不死僵尸删除方法:解决“删除文件或文件夹时出错,无法删除找不到指定文件”

Windows 下不能够以下面这些字样来命名文件/文件夹:
aux|prn|con|nul|com1|com2|com3|com4|com5|com6|com7|com8|com9|lpt1|lpt2|lpt3|lpt4|lpt5|lpt6|lpt7|lpt8|lpt9    但是通过cmd的copy命令即可实现:

D:\>copy piaoyi.asp \\.\D:\lpt6.piaoyi.asp    前面必须有 \\.\

这类文件无法在图形界面删除,只能在命令行下删除:

D:\>del “\\.\D:\lpt6.piaoyi.asp”
D:\>del “\\.\D:\lpt3.1.asp;.jpg”

如果提示找不到文件错误,则可以先解除RHSA只读属性:

D:\>attrib -s -h -r “\\.\D:\lpt3.1.asp;.jpg”
D:\>del “\\.\D:\lpt3.1.asp;.jpg”

注意:因为路径中有分号; 所以需要用双引号,否则,路径找不到。
然而在IIS中,这种文件又是可以解析成功的。Webshell中的 “不死僵尸” 原理就在这。     删除这类文件可以用下面的方法:
最简单也是最方便的,通过命令删除:

del /f /a /q \\?\%1
rd /s /q \\?\%1

把上面的命令保存为.bat后缀名称的文件,然后把不能删除的文件或者文件夹拖到bat文件上就可以。

ZAP介绍

Zed Attack Proxy简写为ZAP,是一个简单易用的渗透测试工具,是发现Web应用中的漏洞的利器,更是渗透测试爱好者的好东西。

ZAP下载地址:https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

ZAP中国:http://www.owasp.org.cn/

BackTrack5R3中集成了ZAP,下面我来演示了一下ZAP的简单实用。

打开方式:

1.

cd /pentest/web/owasp-zap
./zap.sh

2.

Applications|BackTrack|Vulnerability Assessment|Web Application Assessment|Web Vulnerability Scanners|owasp-zap

使用方法:

1.设置

ZAP像Burp suite一样使用代理的方式来截取网站。

ZAP介绍

在Tools|Local proxy中设置相关选项。

ZAP介绍

默认已经设置好了,如果端口冲突就自己改。

在Firefox中设置代理。

Edit|Preferences|Advanced|Network|Setting

选择Manual proxy configuration单选项。

ZAP介绍

浏览目标机器,这里使用Metasploitable2来示例。

用Firefox访问后,在ZAP中出现了Sites。

2.Spider site

右键选择Attack|Spider site

ZAP介绍

扫描要很久,因为是示例所以就先停了。

3.Brute Force

在Site选择目标,在List中选择字典。有big medium small等类型的字典。

ZAP介绍

4.Port Scanner

ZAP介绍

虽然扫描速度很快,但是不够Nmap准确。

5.Active Scan

主动扫描是ZAP最强大的功能之一。

ZAP介绍

6.Alerts

扫描出来的漏洞就在这里了。

ZAP介绍

7.插件

Remove Unwanted HTTP Response Headers

From:https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

The purpose of this blog post is to discuss how to remove unwanted HTTP response headers from the response. Typically we have 3 response headers which many people want to remove for security reason.

  • Server – Specifies web server version.
  • X-Powered-By – Indicates that the website is “powered by ASP.NET.”
  • X-AspNet-Version – Specifies the version of ASP.NET used.

Before you go any further, you should evaluate whether or not you need to remove these headers. If you have decided to remove these headers because of a security scan on your site, you may want to read the following blog post by David Wang. 继续阅读

How to remove all information about IIS Server from Response Header?

It is amazing technique to remove any information from response header about IIS server is very scarce online. So I decide to blog this.

The reason why you would want this is because you would not want to readily disclose what version of server or what server you are running. For example see blow response header I gathered from  one of the site running IIS:

 

Notice that you have information about Server, X-AspNet-Version, X-Powered-By. There are enough information to know it is running on IIS. Why hide these info? Because why if certain version of IIS server had security hole that the hacker can expose? Sometimes, in Enterprise environment there will be external third party security firms like WhiteHat tagging such exploits so you have to fix. 继续阅读

Adjusting child processes for PHP-FPM (Nginx)

Problem:

The following warning message appears in the logs:

[26-Jul-2012 09:49:59] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 8 idle, and 58 total children
[26-Jul-2012 09:50:00] WARNING: [pool www] server reached pm.max_children setting (50), consider raising it

It means that there are not enough PHP-FPM processes. 继续阅读

CentOS / RHEL 7 : How to modify Network Interface names

On CentOS / RHEL 7, a new naming scheme is introduced.
For instance:

# ip addr show
.....
eno1: [BROADCAST,MULTICAST,UP,LOWER_UP] mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 6c:0b:84:6c:48:1c brd ff:ff:ff:ff:ff:ff
inet 10.10.10.11/24 brd 10.10.10.255 scope global eno1
inet6 2606:b400:c00:48:6e0b:84ff:fe6c:481c/128 scope global dynamic
valid_lft 2326384sec preferred_lft 339184sec
inet6 fe80::6e0b:84ff:fe6c:481c/64 scope link
valid_lft forever preferred_lft forever

This post describes how to revert to legacy naming scheme with Network Interface names as eth0, eth1, etc. 继续阅读

Linux audit files to see who made changes to a file

How do I audit file events such as read / write etc? How can I use audit to see who changed a file in Linux?

The answer is to use 2.6 kernel’s audit system. Modern Linux kernel (2.6.x) comes with auditd daemon. It’s responsible for writing audit records to the disk. During startup, the rules in /etc/audit.rules are read by this daemon. You can open /etc/audit.rules file and make changes such as setup audit file log location and other option. The default file is good enough to get started with auditd.

In order to use audit facility you need to use following utilities
=> auditctl – a command to assist controlling the kernel’s audit system. You can get status, and add or delete rules into kernel audit system. Setting a watch on a file is accomplished using this command:

=> ausearch – a command that can query the audit daemon logs based for events based on different search criteria.

=> aureport – a tool that produces summary reports of the audit system logs.

Note that following all instructions are tested on CentOS 4.x and Fedora Core and RHEL 4/5 Linux. 继续阅读

HOWTO configure the auditing of the system (auditd)

Introduction

The audit service is provided for system auditing. By default, this service audits about SELinux AVC denials and certain types of security-relevant events such as system logins, account modifications, and authentication events performed by programs such as sudo.

Under its default configuration, auditd has modest disk space requirements, and should not noticeably impact system performance. The audit service, configured with at least its default rules, is strongly recommended for all sites, regardless of whether they are running SELinux. Networks with high security level often have substantial auditing requirements and auditd can be configured to meet these requirements:

  • Ensure Auditing is Configured to Collect Certain System Events
  • Information on the Use of Print Command (unsuccessful and successful)
  • Startup and Shutdown Events (unsuccessful and successful)
  • Ensure the auditing software can record the following for each audit event:
    • When the event appears
    • Who initiated the event
    • Type of the event
    • Success or failure of the event
    • Origin of the request (example: terminal ID)
    • For events that introduce an object into a user’s address space, and for object deletion events, the name of the object, and in MLS systems, the objects security level.
  • Ensure daily of the audit logs
  • Ensure that the audit data files have restrictive permissions (at least 640).

继续阅读

使用Informix审计功能

关于本教程

在本教程中,您将了解到如何通过预防对数据或其他数据库对象进行未授权查看和更改来保障数据安全。此处提供的材料主要包括考试第 8 部分的相关内容,标题为 Security,本教程涉及的主题包括:

  • 连接安全
  • 网络加密
  • 审计
  • 自主访问控制

目标

通过对本教程的学习,您将能够:

  • 了解身份验证、授权和加密的概念及使用方法
  • 允许 non-OS 用户访问数据库
  • 利用 onaudit 在数据库服务器上设置并配置安全审计
  • 利用可信连接和可信上下文连接来增强安全性
  • 使用角色特权来保护数据安全
  • 设置角色分离来加强对数据库服务器用户的访问控制

先决条件

Informix 11.70 安装在本系列教程的第 1 部分进行了介绍。如果还没安装,可下载并安装 IBM Informix 11.70 的副本。Informix 服务器能够帮助您了解 IBM Informix V11.70 系统管理认证考试当中涉及的许多概念。

系统要求

学习本教程时,不需要 IBM Informix 的副本。但是,如果下载了 Informix Innovator-C Edition(参见 参考资料)的免费试用版,并与本教程配套使用,您将收获更大。 继续阅读