Archive for the ‘Uncategorized’ Category

Configuring IBM Raid controller with Altiris

Author: Remko Weijnen

17 Jun

Today I was deploying some IBM x3550 and x3650 servers with Altiris Deployment Server. IBM Delivers a toolkit for Altiris that contains amongst others jobs for configuring raid arrays.

To do this you need to create a raid policy file and deploy this. I created this policy file:

[Policy.RAID-1]
AppliesTo.1 = t:ServeRAID-8k-l,d:4
Array_Mode = CUSTOM
Array.A = 1,2
Array.B = 3,4
Logical_Mode = CUSTOM
Logical.1 = A:FILL:1
Logical.2 = B:FILL:1

As you can see the policy only applies to the type of array controller in my servers (t:ServeRAID-8k-l). This way we prevent applying the policy to other configurarions. I have a 4 disk configuration (d:4) and want to create to RAID 1 arrays (A & B). On each array one Logical drive with the maximum size (FILL parameter).

(more…)

0 Comments

Filed under: Uncategorized

Script to logoff all Terminal Server sessions

Author: Remko Weijnen

9 Jun

I needed a script to logoff all running Terminal Server sessions in order to rollout an install package. As you might know there is a commandline tool to logoff a session, it’s called logoff.exe.

These are the commandline options:

LOGOFF [sessionname | sessionid] [/SERVER:servername] [/V]

sessionname The name of the session.
sessionid The ID of the session.
/SERVER:servername Specifies the Terminal server containing the user
session to log off (default is current).
/V Displays information about the actions performed.

No option to logoff all sessions is there?

On a Terminal Server there is a special session called the Listener session, you can see it with TSAdmin in the sessions tab:

A Listener is associated with a protocol (Microsoft RDP by default) and is used to setup new sessions. If you logoff a Listener session it will logoff all session that were created through it. Great, just what we need!

So Logoff 65536 will do the trick? Let’s try:

So Logoff is smart enough to ask for confirmation, we can prevent this by using the following commandline:

Echo Y ! Logoff 65536

5 Comments

Filed under: Uncategorized

Encrypting RDP Passwords in VB.NET

Author: Remko Weijnen

2 May

Justin Shepard converted my code to encrypt RPD passwords to VB.NET:

'======SOF
 
Imports System
Imports System.Text
Imports System.Runtime.InteropServices
Imports System.ComponentModel
Imports Microsoft.VisualBasic
 
Public Module RdpEncrypt
 
    Public Class DPAPI
&lt;dllimport&gt; _
        Private Shared Function CryptProtectData( _
            ByRef pPlainText As DATA_BLOB, _
            ByVal szDescription As String, _
            ByRef pEntropy As DATA_BLOB, _
            ByVal pReserved As IntPtr, _
            ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _
            ByVal dwFlags As Integer, _
            ByRef pCipherText As DATA_BLOB _
        ) As Boolean
        End Function
 
&lt;dllimport&gt; _
        Private Shared Function CryptUnprotectData( _
            ByRef pCipherText As DATA_BLOB, _
            ByRef pszDescription As String, _
            ByRef pEntropy As DATA_BLOB, _
            ByVal pReserved As IntPtr, _
            ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _
            ByVal dwFlags As Integer, _
            ByRef pPlainText As DATA_BLOB _
        ) As Boolean
        End Function
 
&lt;structlayout&gt; _
        Friend Structure DATA_BLOB
            Public cbData As Integer
            Public pbData As IntPtr
        End Structure
 
&lt;structlayout&gt; _
        Friend Structure CRYPTPROTECT_PROMPTSTRUCT
            Public cbSize As Integer
            Public dwPromptFlags As Integer
            Public hwndApp As IntPtr
            Public szPrompt As String
        End Structure
 
        Private Const CRYPTPROTECT_UI_FORBIDDEN As Integer = 1
        Private Const CRYPTPROTECT_LOCAL_MACHINE As Integer = 4
 
        Private Shared Sub InitPrompt _
        ( _
            ByRef ps As CRYPTPROTECT_PROMPTSTRUCT _
        )
            ps.cbSize = Marshal.SizeOf(GetType(CRYPTPROTECT_PROMPTSTRUCT))
            ps.dwPromptFlags = 0
            ps.hwndApp = IntPtr.Zero
            ps.szPrompt = Nothing
        End Sub
 
        Private Shared Sub InitBLOB _
        ( _
            ByVal data As Byte(), _
            ByRef blob As DATA_BLOB _
        )
            ' Use empty array for null parameter.
            If data Is Nothing Then
                data = New Byte(0) {}
            End If
 
            ' Allocate memory for the BLOB data.
            blob.pbData = Marshal.AllocHGlobal(data.Length)
 
            ' Make sure that memory allocation was successful.
            If blob.pbData.Equals(IntPtr.Zero) Then
                Throw New Exception( _
                        "Unable to allocate data buffer for BLOB structure.")
            End If
 
            ' Specify number of bytes in the BLOB.
            blob.cbData = data.Length
            Marshal.Copy(data, 0, blob.pbData, data.Length)
        End Sub
 
        Public Enum KeyType
            UserKey = 1
            MachineKey
        End Enum
 
        Private Shared defaultKeyType As KeyType = KeyType.UserKey
 
        Public Shared Function Encrypt _
        ( _
            ByVal keyType As KeyType, _
            ByVal plainText As String, _
            ByVal entropy As String, _
            ByVal description As String _
        ) As String
            If plainText Is Nothing Then
                plainText = String.Empty
            End If
            If entropy Is Nothing Then
                entropy = String.Empty
            End If
 
            Dim result As Byte()
            Dim encrypted As String = ""
            Dim i As Integer
            result = Encrypt(keyType, _
                             Encoding.Unicode.GetBytes(plainText), _
                             Encoding.Unicode.GetBytes(entropy), _
                             description)
            For i = 0 To result.Length - 1
                encrypted = encrypted &amp; Convert.ToString(result(i), 16).PadLeft(2, "0").ToUpper()
            Next
            Return encrypted.ToString()
        End Function
 
        Public Shared Function Encrypt _
        ( _
            ByVal keyType As KeyType, _
            ByVal plainTextBytes As Byte(), _
            ByVal entropyBytes As Byte(), _
            ByVal description As String _
        ) As Byte()
            If plainTextBytes Is Nothing Then
                plainTextBytes = New Byte(0) {}
            End If
 
            If entropyBytes Is Nothing Then
                entropyBytes = New Byte(0) {}
            End If
 
            If description Is Nothing Then
                description = String.Empty
            End If
 
            Dim plainTextBlob As DATA_BLOB = New DATA_BLOB
            Dim cipherTextBlob As DATA_BLOB = New DATA_BLOB
            Dim entropyBlob As DATA_BLOB = New DATA_BLOB
 
            Dim prompt As  _
                    CRYPTPROTECT_PROMPTSTRUCT = New CRYPTPROTECT_PROMPTSTRUCT
            InitPrompt(prompt)
 
            Try
                Try
                    InitBLOB(plainTextBytes, plainTextBlob)
                Catch ex As Exception
                    Throw New Exception("Cannot initialize plaintext BLOB.", ex)
                End Try
 
                Try
                    InitBLOB(entropyBytes, entropyBlob)
                Catch ex As Exception
                    Throw New Exception("Cannot initialize entropy BLOB.", ex)
                End Try
 
                Dim flags As Integer = CRYPTPROTECT_UI_FORBIDDEN
 
                If keyType = keyType.MachineKey Then
                    flags = flags Or (CRYPTPROTECT_LOCAL_MACHINE)
                End If
 
                Dim success As Boolean = CryptProtectData( _
                                                plainTextBlob, _
                                                description, _
                                                entropyBlob, _
                                                IntPtr.Zero, _
                                                prompt, _
                                                flags, _
                                                cipherTextBlob)
 
                If Not success Then
                    Dim errCode As Integer = Marshal.GetLastWin32Error()
 
                    Throw New Exception("CryptProtectData failed.", _
                                    New Win32Exception(errCode))
                End If
 
                Dim cipherTextBytes(cipherTextBlob.cbData) As Byte
 
                Marshal.Copy(cipherTextBlob.pbData, cipherTextBytes, 0, _
                                cipherTextBlob.cbData)
 
                Return cipherTextBytes
            Catch ex As Exception
                Throw New Exception("DPAPI was unable to encrypt data.", ex)
            Finally
                If Not (plainTextBlob.pbData.Equals(IntPtr.Zero)) Then
                    Marshal.FreeHGlobal(plainTextBlob.pbData)
                End If
 
                If Not (cipherTextBlob.pbData.Equals(IntPtr.Zero)) Then
                    Marshal.FreeHGlobal(cipherTextBlob.pbData)
                End If
 
                If Not (entropyBlob.pbData.Equals(IntPtr.Zero)) Then
                    Marshal.FreeHGlobal(entropyBlob.pbData)
                End If
            End Try
        End Function
 
    End Class
 
    Sub Main(ByVal args As String())
        Try
            Dim text As String = args(0)
            Dim encrypted As String
 
            encrypted = DPAPI.Encrypt(DPAPI.KeyType.MachineKey, text, Nothing, "psw")
 
            Console.WriteLine("{0}" &amp; Chr(13) &amp; Chr(10), encrypted)
 
        Catch ex As Exception
            While Not (ex Is Nothing)
                Console.WriteLine(ex.Message)
                ex = ex.InnerException
            End While
        End Try
    End Sub
 
End Module
'======EOF

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

'======SOF

Imports System

Imports System.Text

Imports System.Runtime.InteropServices

Imports System.ComponentModel

Imports Microsoft.VisualBasic

Public Module RdpEncrypt

Public Class DPAPI

<dllimport> _

Private Shared Function CryptProtectData( _

ByRef pPlainText As DATA_BLOB, _

ByVal szDescription As String, _

ByRef pEntropy As DATA_BLOB, _

ByVal pReserved As IntPtr, _

ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _

ByVal dwFlags As Integer, _

ByRef pCipherText As DATA_BLOB _

) As Boolean

End Function

<dllimport> _

Private Shared Function CryptUnprotectData( _

ByRef pCipherText As DATA_BLOB, _

ByRef pszDescription As String, _

ByRef pEntropy As DATA_BLOB, _

ByVal pReserved As IntPtr, _

ByRef pPrompt As CRYPTPROTECT_PROMPTSTRUCT, _

ByVal dwFlags As Integer, _

ByRef pPlainText As DATA_BLOB _

) As Boolean

End Function

<structlayout> _

Friend Structure DATA_BLOB

Public cbData As Integer

Public pbData As IntPtr

End Structure

<structlayout> _

Friend Structure CRYPTPROTECT_PROMPTSTRUCT

Public cbSize As Integer

Public dwPromptFlags As Integer

Public hwndApp As IntPtr

Public szPrompt As String

End Structure

Private Const CRYPTPROTECT_UI_FORBIDDEN As Integer = 1

Private Const CRYPTPROTECT_LOCAL_MACHINE As Integer = 4

Private Shared Sub InitPrompt _

( _

ByRef ps As CRYPTPROTECT_PROMPTSTRUCT _

)

ps.cbSize = Marshal.SizeOf(GetType(CRYPTPROTECT_PROMPTSTRUCT))

ps.dwPromptFlags = 0

ps.hwndApp = IntPtr.Zero

ps.szPrompt = Nothing

End Sub

Private Shared Sub InitBLOB _

( _

ByVal data As Byte(), _

ByRef blob As DATA_BLOB _

)

' Use empty array for null parameter.

If data Is Nothing Then

data = New Byte(0) {}

End If

' Allocate memory for the BLOB data.

blob.pbData = Marshal.AllocHGlobal(data.Length)

' Make sure that memory allocation was successful.

If blob.pbData.Equals(IntPtr.Zero) Then

Throw New Exception( _

"Unable to allocate data buffer for BLOB structure.")

End If

' Specify number of bytes in the BLOB.

blob.cbData = data.Length

Marshal.Copy(data, 0, blob.pbData, data.Length)

End Sub

Public Enum KeyType

UserKey = 1

MachineKey

End Enum

Private Shared defaultKeyType As KeyType = KeyType.UserKey

Public Shared Function Encrypt _

( _

ByVal keyType As KeyType, _

ByVal plainText As String, _

ByVal entropy As String, _

ByVal description As String _

) As String

If plainText Is Nothing Then

plainText = String.Empty

End If

If entropy Is Nothing Then

entropy = String.Empty

End If

Dim result As Byte()

Dim encrypted As String = ""

Dim i As Integer

result = Encrypt(keyType, _

Encoding.Unicode.GetBytes(plainText), _

Encoding.Unicode.GetBytes(entropy), _

description)

For i = 0 To result.Length - 1

encrypted = encrypted & Convert.ToString(result(i), 16).PadLeft(2, "0").ToUpper()

Return encrypted.ToString()

End Function

Public Shared Function Encrypt _

( _

ByVal keyType As KeyType, _

ByVal plainTextBytes As Byte(), _

ByVal entropyBytes As Byte(), _

ByVal description As String _

) As Byte()

If plainTextBytes Is Nothing Then

plainTextBytes = New Byte(0) {}

End If

If entropyBytes Is Nothing Then

entropyBytes = New Byte(0) {}

End If

If description Is Nothing Then

description = String.Empty

End If

Dim plainTextBlob As DATA_BLOB = New DATA_BLOB

Dim cipherTextBlob As DATA_BLOB = New DATA_BLOB

Dim entropyBlob As DATA_BLOB = New DATA_BLOB

Dim prompt As _

CRYPTPROTECT_PROMPTSTRUCT = New CRYPTPROTECT_PROMPTSTRUCT

InitPrompt(prompt)

Try

InitBLOB(plainTextBytes, plainTextBlob)

Catch ex As Exception

Throw New Exception("Cannot initialize plaintext BLOB.", ex)

End Try

Try

InitBLOB(entropyBytes, entropyBlob)

Catch ex As Exception

Throw New Exception("Cannot initialize entropy BLOB.", ex)

End Try

Dim flags As Integer = CRYPTPROTECT_UI_FORBIDDEN

If keyType = keyType.MachineKey Then

flags = flags Or (CRYPTPROTECT_LOCAL_MACHINE)

End If

Dim success As Boolean = CryptProtectData( _

plainTextBlob, _

description, _

entropyBlob, _

IntPtr.Zero, _

prompt, _

flags, _

cipherTextBlob)

If Not success Then

Dim errCode As Integer = Marshal.GetLastWin32Error()

Throw New Exception("CryptProtectData failed.", _

New Win32Exception(errCode))

End If

Dim cipherTextBytes(cipherTextBlob.cbData) As Byte

Marshal.Copy(cipherTextBlob.pbData, cipherTextBytes, 0, _

cipherTextBlob.cbData)

Return cipherTextBytes

Catch ex As Exception

Throw New Exception("DPAPI was unable to encrypt data.", ex)

Finally

If Not (plainTextBlob.pbData.Equals(IntPtr.Zero)) Then

Marshal.FreeHGlobal(plainTextBlob.pbData)

End If

If Not (cipherTextBlob.pbData.Equals(IntPtr.Zero)) Then

Marshal.FreeHGlobal(cipherTextBlob.pbData)

End If

If Not (entropyBlob.pbData.Equals(IntPtr.Zero)) Then

Marshal.FreeHGlobal(entropyBlob.pbData)

End If

End Try

End Function

End Class

Sub Main(ByVal args As String())

Try

Dim text As String = args(0)

Dim encrypted As String

encrypted = DPAPI.Encrypt(DPAPI.KeyType.MachineKey, text, Nothing, "psw")

Console.WriteLine("{0}" & Chr(13) & Chr(10), encrypted)

Catch ex As Exception

While Not (ex Is Nothing)

Console.WriteLine(ex.Message)

ex = ex.InnerException

End While

End Try

End Sub

End Module

'======EOF

2 Comments

Filed under: Uncategorized

New home for Jedi Apilib and Jedi Security Library

Author: Remko Weijnen

3 Mar

A new website (blog) was opened for the Jedi Apilib and Jedi Security Library. I invite you all to take a look!

You can find it here

0 Comments

Filed under: Uncategorized

Softpedia

Author: Remko Weijnen

25 Jan

Today I received an e-mail from Softpedia telling me that they have listed one of my commandline tools, LaunchRDP. I don’t know how they found or why they think that it should be listed, but it’s nice to see that they respect the author and informed me. If you want to rate it, here’s your chance!

0 Comments

Filed under: Uncategorized

IDA 4.9 released as freeware

Author: Remko Weijnen

9 Dec

Datarescue has release IDA 4.9 as freeware. IDA Pro is the de-facto standard for the analysis of hostile code, vulnerability research and reverse engineering in general. You can find IDA freeware here: http://www.datarescue.com/idabase/idadownfreeware.htm

1 Comment

Filed under: Uncategorized

Even more undocumented Terminal Server API’s uncovered

Author: Remko Weijnen

21 Nov

I was contact by Danila Galimov a while ago because he was working with my JwaWinsta unit. Together we were able (and are still working on) uncovering more of the undocumented API’s in winsta.dll.

We found several new classes for WinStationQueryInformationW that return lots of information:

The user’s password (under special circumstances).
The Windows Product ID (server and client’s).
Client Info such as Timezone information.

We got the following API’s working:

WinStationGetAllProcesses
WinStationGetTermSrvCountersValue (“QWinsta /Counter”)
WinStationFreeGAPMemory
WinStationSendMessage
WinStationCloseServer
WinStationDisconnect
WinStationReset
WinStationShutdownSystem

Further testing is needed to determine if the functions work on different OS versions and produce the same results.

6 Comments

Filed under: Uncategorized

Multiple Terminal Sessions in Windows Vista

Author: Remko Weijnen

21 Nov

There were 2 ways (known to me) of extending Windows XP to offer mulitple concurrent Terminal Sessions. One with the RC1 version of XP SP2 and one that patches Winlogon and Termsrv.dll. The latter offers not only multiple sessions but also multiple sessions under the same account and sessions to the local machine.

Seems like the someone hacked Windows Vista Terminal server too by patching Termsrv.dll. Read more at source.

3 Comments

Filed under: Terminal Server, Uncategorized, Vista

Post Views

Author: Remko Weijnen

2 Nov

I was curious how many times my posts are viewed. So I installed this plugin which was made by Lester ‘GaMerZ’ Chan. If you use WordPress take a look at his other plugins, there are some good ones there!

0 Comments

Filed under: Uncategorized

Dear Visitor

Author: Remko Weijnen

1 Nov

If this is your first visit, take your time and look around. Here are some things you might be looking for:

SasLibEx: a library that can simulate the Secure Attention Sequence (Ctrl-Alt-Del) but it can even unlock a workstation or session without entering or needing the user’s credentials (and many more things).
Who locks my file?
Patch 32 bit Windows to use the full 4 GB (and even more) memory
Patch Terminal Server to allow more Concurrent Sessions: 2003, Windows XP X64, 2003 X64, 2008, Vista
Some of my freeware tools such as LaunchRDP, RDP Password Encryption, Active Directory Excel Addin, RDP Clipboard Fix (well this list can go on and on, see also the Downloads section).

Do you like my work? Did my work help you?

Leave a comment and tell me how it was usefull to you.
If you want you can make a donation with the Paypal Donate Button in the right Sidebar.

Thank you!

Comments Off

Filed under: Uncategorized

Entries (RSS)
Comments (RSS)

Remko Weijnen's Blog (Remko's Blog)

Archive for the ‘Uncategorized’ Category

Configuring IBM Raid controller with Altiris

Script to logoff all Terminal Server sessions

Encrypting RDP Passwords in VB.NET

New home for Jedi Apilib and Jedi Security Library

Softpedia

IDA 4.9 released as freeware

Even more undocumented Terminal Server API’s uncovered

Multiple Terminal Sessions in Windows Vista

Post Views

Dear Visitor

Profile

Top Posts

Recent Comments

Featured Downloads

Blogroll

Categories

Archives