Gather system details using BGInfo

I keep telling myself that I will write more blog posts but keep finding ways not to.  I keep getting more ideas to write about so I just need to kick myself into gear and get going on these.  The protip this February is a useful trick for getting quick and easy access to important server information using a tool written by Bryce Cogswell of the Sysinternals suite, called BGInfo.  This tool comes in handy when you begin to manage more than a handful of servers and need to keep your p’s and q’s straight.

So, to start things off I have made a quick guide for setting up a nice BGInfo background for Windows computers.

I found out that this script doesn’t update the background for users in Windows 7 unless you  explicitly tell it to write the background upon login.   So if you are interested, the color scheme  I have elected to use is R:29 G:95 B:122 (which happens to be the default Server 2008 background).

I have found it useful to gather a few extra   pieces of information through WMI as well as a few vb scripts to make my life as an administrator easier, plus these are kind of cool.  Adding to the basic information I have added free memory, number of processors, brand and  model.   I’m sure there are others but I haven’t had time to experiment with them yet.  Maybe you can come up with some suggestions?

Free Memory script:

winmgt = “winmgmts:{impersonationLevel=impersonate}!//”

Set oWMI_Qeury_Result = GetObject(winmgt).InstancesOf(“Win32_OperatingSystem”)

For Each oItem in oWMI_Qeury_Result
iFreeMemory   = oItem.FreePhysicalMemory
Next
iFreeMemory = Round(iFreeMemory/(1024))

Echo “” & iFreeMemory & ” MB”

Note: This will only check the amount of free memory when the script is run, either at logn or if the bginfotemplate is run manually.   It does not update itself otherwise.

Model:

SELECT Model FROM Win32_ComputerSystem

System Brand:

SELECT Manufacturer FROM Win32_Computer System

Processors:

SELECT NumberOfProcessors FROM Win32_ComputerSystem

We will need the following files for BGInfo to do its thing once we have adjusted our templates  to suit our needs.

To have the background populate when a   user logs in, we need to set up a group policy.  Call it BGInfo or something easy to remember.   Edit the policy to point at Users -> Windows Settings ->Scripts -> Logon

To create the script to run BGInfo when a user logs in, copy the following and create a file named bgscript.bat

%logonserver%\netlogon\bginfo\Bginfo.exe %logonserver%\netlogon\bginfo\servertemplate.bgi /Timer:0 /NoLicPrompt

I have applied this script to a user OU in active directory called ‘Admins’.   Members of this group are the only  set of users which this policy will apply to.   So for example, people that I have given   Admin rights  will all see this background when they log on.   Which, in my case is our sysadmin team.

That’s it!  Now we have a nice clean background on all of our servers (assuming we log on with admin priveliges) to quickly look up information that may be handy and to keep yourself from getting mixed up when working on multiple servers concurrently.

Resources:

http://jensolekragh.wordpress.com/2008/08/22/using-bginfo-exe-to-create-and-evaluate-wmi-queries/
http://www.zoutenbier.nl/ict-experience-kb/windows-servers/6-implement-bginfo-with-the-group-policys

Read More

What’s in Your Windows Toolboox?

I think the title explains what I will be talking about in this post pretty well. In my day to day work, as I have mentioned before, work primarily with Windows. I thought it would be a good idea to carve out a set of must have Windows administration tools, to have as a reference in the future. A good number of these tools are open source or freeware and some are people’s pet projects, so could become abandoned over time, that is why it will be good to come back and look at every now and then.  I would also suggest donating to the independent authors to help keep their efforts alive!

Since I will just be covering the essentials I don’t really feel a need to group or categorize them in any certain way. So let’s get Started.

Windirstat

This one is pretty handy for figuring out what is eating up all your disk space by organizing your drives visually.  But of course there are a number of really handy features, like organizing directories by largest size for a quick tree view of your disk, color coating based on file types.  This one kind of falls under the category, do one thing and do it well.  It also happens to be great for quickly analyzing disk and file sizes.


windirstat

RDTabs

I would like to shake the hand of the genius who created this piece of Windows goodness.  I honestly love this program.  It is an intuitive tool to help manage RDP sessions, which happens to work out very nicely since I am in Windows all day 😀  It has matured a great deal in its lifetime and offers things like tabbing (I hope that is obvious), favorite management, a handy dandy  built in  screenshot feature, detaching RDP sessions into separate windows, encrypted passwords, importing and exporting of favorites, a boatload of options for customization and many more I’m sure that I am forgetting.  Highly recommended.  You should seriously consider checking out this hidden gem.  I believe this one is freeware, so if you like you should hook the creator up!


BGInfo

What can I say, Mark Russinovich and Bryce Cogswell are kind of awesome.  This tool is really helpful for quickly looking up information and stats (I love stats) about the system you are working on.  Essentially it creates a custom bitmap image over top of your background desktop image based on the configuration information you feed it.  Fast, easy, clean.  This utility also gives you the ability to add custom queries to check for practically anything via WMI calls or registry entries. It also has command line options for scripting, so yeah.  Good stuff.  I can’t tell you how helpful something like this is if you have 5-10 remote connections open at a time to look at what server you are on quickly.


BGInfo configuration page

Wireshark

I don’t think I want to go into very much detail for this one at the risk of looking foolish, especially since I don’t use it that much and there is a vast amount of things that this program can do.  I mean, we’re talking about stuff like graphing TCP time/seq graphs or troubleshooting performance of certain types of network traffic, crazy stuff that I have no business looking at.  What I can say though, is that it has helped me a time or two when I have been otherwise clueless on network troubleshooting issues. It is a really powerful tool to have in your bag of tricks.


JavaRa

I just found this one today actually, which was sort of the inspiration for this blog post.  I don’t know about you but I absolutely hate dealing with Java, its updates, its previous versions, etc.  This tools is a quick and dirty way to purge old versions and update to the most current version.  That’s it.  And that is how it should be, I don’t know why Sun previously or Oracle now could have made a tool to do this a long time ago.  This one is all open source.


javara

mRemoteNG

I thought I would mention this tool as well.  Although it has fallen out of favor for me personally it was my go to remote administration tool when I had Mac’s, Linux and Windows to worry about.  This tool allows for administration through a number of remote protocols including SSH, VNC, RDP, ICA, telnet, etc.  So it really comes in handy for those admins that jump all over the board in terms of different platforms.  Completely open source, highly recommended.


mRemoteNG interface

OneNote

Now before you start to hate me for this one just hear me out.  I kind of felt the same way until I actually started using it.  I have searched a fair amount for a program that does what OneNote does and nothing comes even close.  To make my life and job easier, I love to take notes on things I do for projects for future reference.  In OneNote I can organize my thoughts and process easily.  As an example, we are in the middle of an Exchange migration and our setup will be fairly complex, so I have been keeping notes for everything I am doing.  This not only helps me to understand the process more clearly but gives me a reference if shit hits the fan later on as well.

Some nice features that OneNote provides for this type of note taking are things like the ability to copy in screenshots quickly for documenting my own steps via a built in snipping tool, pasting in website links instead of having to go to research Google later on down the road once I have already forgotten what I did  originally  saving time and energy, linking to network resources and scritps, exe’s, etc. from within OneNote.  This  program really is worth its weight in gold.  If you still turn your nose up at this product since it comes from Micro$oft you might check out Evernote, I have heard good things about it, though you won’t have nearly as much power with it.


Conclusion

I think this is just the tip of the iceburg.  As I get more comfortable in my current environment I’m sure I will continue to experiment many more tools for making my life as an admin easier.  I want to point out that this list only covers my favorite Windows tools for administration, as I know there are vastly more tools out there in both the Linux and Windows world.

What feedback do you have on these?  What sorts of tools do you like to make your life easier?  I would really like to hear your feedback.

Read More

Protip: January

I found this one a little while back and figured I might as well share it out since not that many people I talk to seem to know about it. For the longest time if I wanted to search through all my old commands I would do something like this:

history | less

and just kind of wade my way through previously executed commands not very efficient. Once I started getting lazier and the list of items in my history cache grew I started to use this one:

history | grep -i "bleh"

This is a little better, but still a lot more searching and typing than I want. Finally, thanks to the helpful folks over at reddit, I stumbled across this hidden gem:

Ctrl + r "bleh"

So, just press Ctrl then R keys and then a piece of the command you are looking for, bleh in this example, then just hit tab to pull the command up you were looking for once you have enough of the string matched. This is a shortcut that executes the “reverse-i-search” command, and it is freakin awesome. So if there was a command you ran a really long time ago and can’t remember the syntax 100% but know the general idea you can use this to capture the pieces you do remember, saving yourself all that extra time of having to go back through trying to figure out what the hell you were doing.

Read More

A Brief Overview of the Linux chattr Command

I recently watched a talk given by Raphael Mudge, the creator of Armita, entitled “Dirty Red Team Tricks”. In this talk he basically goes over the basics of how to play the hacker version of capture the flag from the point of view of the offensive team or attackers, the red team (pretty self explanatory right?). It was a really good watch, and he demonstrated some really neat little tricks to the audience, including how to use Armitage effectively. Here is the link If you would like to view the presentation.

There was one very curious trick he mentioned in his talk that I want to focus this post on and to save as a note to myself for future reference. That is the chattr command.

The main use case for this command is to essentially make a file immutable by setting the “+i” flag. This is similar to using the attrib command in dos on Windows.  So for instance, you could do something like change the attributes of a password file or any other important file that you didn’t want getting altered by issuing the following command:

chattr +i some_file_name

Note, you must be root or in the sudo group to use this. Until the flag to turn this off is issued, even the root user cannot change the file, how cool is that?! I see why Mudge likes to use this dirty little trick when competing in capture the flag games now. So to check what attributes a particular file has applied to it you can use the lsattr command as follows, notice that the i flag is now set for the file:

lsattr some_file_name
----i------------e- some_file_name

And finally, to switch this flag off use the following command:

chattr -i some_file_name

We can check again to see if the flag actually got turned off:

lsattr some_file_name
-----------------e- some_file_name

That’s it. I couldn’t believe how simple this nasty little trick was to use but how effective it may be in a given situation. I hope this post was helpful for you, and seriously, you should check out Armitage if you are messing around with penetration testing tools, Raphael Mudge is a really smart dude.

Read More

My favorite browser is Windows

So I’ve been getting acclimated to my new environment at work and have been thinking more and more about how much I miss Linux and the command line.  The new environment is nearly entirely a Windows based environment and I feel like my productivity has dropped without the option for using the command line, hence the title of this article.  It seems like the most productive aspect of my Windows experience is using a web browser.

At my previous place of employment I got so used to command line that I take it for granted now as I could do nearly all of my daily work from the command line (aside from web browsing, and email I never made that jump).  In this post I would like to highlight some of the command line tools that I am talking about and how they contributed to my productivity in a former life (although I still take advantage of them at home obviously).

The first and most important piece of the command line experience is getting a good terminal multiplexer, I have played with both screen and tmux but have to say out of the two I like using tmux more.  Both of them can do nearly identical things but I just became more attached to tmux the more that I played with it, one thing that drew me in was the quick and easy screen splitting functionality of tmux.

After much experimentation I finally have a .tmux.conf config file that I feel comfortable with that utilizes all of the settings I like and need as well as the bindings to match those in screen along with a few other neat tricks.

# This configuration file binds many of the common GNU screen key bindings to
# appropriate tmux key bindings. Note that for some key bindings there is no
# tmux analogue and also that this set omits binding some commands available in
# tmux but not in screen.#
# Note this is a good starting point but you should check out the man page for more
# configuration options if you really want to get more out of tmux

### Unbind existing tmux key bindings (except 0-9).

# Set the prefix to ^A.
unbind C-b
set -g prefix ^A
bind a send-prefix

# Bind appropriate commands similar to screen.
# lockscreen ^X x
unbind ^X
bind ^X lock-server
unbind x
bind x lock-server

# screen ^C c
unbind ^Cbind ^C new-window
bind cbind c new-window

# detach ^D d
unbind ^D
bind ^D detach

# displays *
unbind *
bind * list-clients

# next ^@ ^N sp n
unbind ^@
bind ^@ next-window
unbind ^N
bind ^N next-window
unbind " "
bind " " next-window
unbind n
bind n next-window

# other ^A
unbind ^A
bind ^A last-window

# prev ^H ^P p ^?
unbind ^H
bind ^H previous-window
unbind ^P
bind ^P previous-window
unbind p
bind p previous-window
unbind BSpace
bind BSpace previous-window

# windows ^W w
unbind ^W
bind ^W list-windows
unbind w
bind w list-windows

# quit \
unbind \
bind \ confirm-before "kill-server"

# kill K k
unbind K
bind K confirm-before "kill-window"
unbind k
bind k confirm-before "kill-window"

# redisplay ^L l
unbind ^L
bind ^L refresh-client
unbind l
bind l refresh-client

# More straight forward key bindings for splitting
unbind %
bind | split-window -h
bind v split-window -h
unbind '"'
bind - split-window -v
bind h split-window -v

# History
set -g history-limit 10000

# Terminal emulator window title
set -g set-titles on
set -g set-titles-string '#S:#I.#P #W'

# Status Bar
set -g status-bg black
set -g status-fg white
set -g status-interval 1
#set -g status-left '#[fg=green]#H#[default]'
set -g status-left '#[fg=green](#S) #(whoami)@#(host `hostname` | cut -d " " -f 4)'
set -g status-right '#[fg=yellow]#(cut -d " " -f 1-4 /proc/loadavg)#[default] #[fg=cyan,bold]%Y-%m-%d %H:%M:%S#[default]'

# Notifying if other windows has activities
setw -g monitor-activity on
set -g visual-activity on

# Highlighting the active window in status bar
setw -g window-status-current-bg red

# Clock
setw -g clock-mode-colour green
setw -g clock-mode-style 24

# Hostname and IP address
#set -g status-right '#[fg=white]#(hostname)@#(host `hostname` | cut -d " " -f 4)'
#set -g status-right '#[fg=white]#(host `hostname` | cut -d " " -f 4)'

The most important part of how you utilize your tmux experience is the management of your sessions.  Within tmux I usually have at least four terminals open for various different tasks.  At least one term for bash, one for Irssi command line IRC client, one for ipython python interpreter and one for editing text files (I use Vim but that is separate topic).   Once you get comfortable with the key combinations for navigation and other tasks, tmux can increase your productivity a great deal. As I stated, in my daily work the only things I don’t use the command line for are email and web browsing, which I know is possible I just never tired to make the switch. I would still like to do at some point in the future.

If you have any command line-fu you would like to share let me know or post in the comments section I always love hearing about what others are doing and incorporating it into my own bag of tricks.

Read More