Update to Hashing Post

Just decided to make the CMDLet in the article: PowerShell File Hashing , a little more clear by renaming it to Get-FileHash, it makes more sense in the long run in my head, and explains what the CmdLet does.

Git to Azure

Just a quick guide on publishing web content to Windows Azure using Git!

First things first, make sure you have TortoiseGit and its dependencies installed, and create a new Windows Azure web site in the management console.

For this example, we will be publishing out own mirror of the http://isitup.org site. The sites code is available from GitHub here: https://github.com/sjparkinson/isitup

Let's begin!

Part 1 - Configuring Windows Azure for Git

1. Visit https://manage.windowsazure.com
2. Select the website you wish to use Git to publish to
3. Select "Setup Git publishing"
4. If you have never specified deployment credentials, select "reset deployment credentials" and specify a username and password
5. Note down the Git Clone URL

Part 2 - Pulling and Pushing with Git

1. In your local working copy folder, right click and select "Git Clone"
2. The URL will be "https://github.com/sjparkinson/isitup"
3. The directory will be the base URL for the Git working copy/repository for me "c:\users\defaultusername\workinprogress"
4. Hit ok
5. wait for a sucess message, and hit close
6. Right click on the isitup folder, select TortoiseGit, and then Push
7. select "Arbitary URL" enter the URL noted earlier
8. Hit OK
9. Enter your password
10. Wait for completion
11. DONE!!!

One I prepared earlier http://isitup.azurewebsites.net

PowerShell file hashing

So, I was reading the Microsoft Security Response Centres post on verifying your Windows Update files, available here, and saw their comments about using PowerShell to verify the upates. They used some code from Mike Wilbur's Blog, here, which is a nice simple little bit of code to get your SHA256 hashes for files.

I decided that the world needed something a bit more, and started to see if we could make a cmdlet that used the pipeline, and also checked the faile we were passing to the cmdlet actually existed. Whilst I was pokeing around in the .Net framework, I also noticed that SHA1, SHA384, SHA512, MD5 and RIPEMD160 was also available to us.

So I spent some time, and have developed the following piece of code:

To use the code, copy the code above into a .ps1 file, and then import-module yourfile.ps1, the function is called get-hash.

As you can see, I am using the comment based help, and there are some nice examples included.

Infrastructure Saturday 2012

I loved presenting at Infrastructure Saturday, as promised to you all, my presentations are available from the links below (and from the infrastructuresaturday.org website). 

PowerShell

Malware - What!

And as a bonus, my 2011 presentation!

Certificate Services

What is coming up:

• I will be talking about Web access and PowerShell
• Web Functions Library
• PushOver.Net and PowerShell
• Malware, malware, malware!
• new base template script with huge amount of extensibility for other notification types!

Azure Powered External IP Address Returning Pages!

In my last post, we made 4 different pages that all did one thing, tell you your external IP address, now lets introduce the power of Microsoft Windows Azure!

Azure will let us run any or all of the 4 pages I showed you how to make earlier! Yes even PHP!

We will do this in 8 easy steps!

1. Signup for a Windows Azure trial (or in my case active my AWESOME MSDN subscription's Azure Subscription)
2. Go to the account management portal, and signup for the Website Beta Program http://account.windowsazure.com
3. Once accepted for the Web Site program (you will get an email, or just keep checking the management portal), go to the management portal, http://manage.windowsazure.com/ and create a new website using the Quick Create option. I called mine whatismyip, which will result in the FQDN of http://whatismyip.azurewebsites.net
4. Open the dashboard for your website, select "Reset Deployment Credentials". Enter appropriate username and password.
5. Still in the dashboard, make a note of the "Deployment User" and "FTP Hostname"
6. Open up your favorite FTP client, the server name will be the previously noted hostname, username will be the previously noted down username, password will be what you specified earlier.
7. Copy up the file or files for the IP returning page that you wish to use, I uploaded all 4!
8. Use the pages!

Here are mine:

http://whatismyip.azurewebsites.net/getip.php

http://whatismyip.azurewebsites.net/getip.aspx

http://whatismyip.azurewebsites.net/getip.ashx

http://whatismyip.azurewebsites.net/getip.asp

Making your own external IP address returning page

In my last post, I mentioned a number of web sites you can go to where you can find out what your external IP Address is.

Well below is PHP, ASP, C# - ASPX and ASHX.

PHP

ASP

ASPX

ASHX

Accessing the Internet from PowerShell: Getting Page Content

In this post, I am going to cover some more of the DownloadString() method of the .Net WebClient that we briefly touched on in my earlier post.

I am going to show you a function that will return your current external/public IP address.

There a numerous services out there that allow a user to get their external IP Address, most have two flavours, one which will return a nicely formatted page with text like “Your IP address is 123.123.123.123” whilst others are designed for automation and will simply return a plain text formatted page with only the IP address 123.123.123.123. Of course, you could make your own service and host it somewhere yourself. It is very simple to make your own page which can do this with a single line of C# in a ASP.Net page (.ASPX),  C# code in a Web Event Handler (.ASHX), PHP page or even classic ASP (.ASP) page.

A later post will cover making your own page, for today, we will test with one of the already existing services listed below:

• http://whatismyip.com –> These guys provide a good service, they make use of a separate automation page located at http://automation.whatismyip.com/n09230945.asp
• http://icanhazip.com/ 
• http://whatismyip.Akamai.com/ 
• http://b10m.swal.org/ip

WARNING NOTES

1. Some malware uses these sites to work out your IP address, some proxy servers and antivirus solutions may block access to their site.
2. Don’t hit this page more than once every 300s or you might get blocked.

The Function

Let’s start by writing a function that will perform the following:

1. Take an optional value of the URL, this will be the URL of a service which returns our external IP address as plain text. Like any of the ones listed above. If we don’t specify one, use icanhazip.com
2. Set the UserAgent to be that of an Internet Explorer User
3. Call the DownloadString function with the URL

Let’s take a look at a function which would return our current IP address:

So we can see this is a pretty standard PowerShell Function. The function starts off with a param definition, there is a single parameter $ipcheckurl, for once I am being a nice programmer and specifying the type as a String. This is an optional parameter,  and if there is no value for this parameter provided we will use the value of http://icanhazip.com .

The body of the function is pretty simple. Let’s make a WebClient object, then we will set the UserAgent header to that of a Windows Internet Explorer UserAgent, and finally, we call the DownloadString method, specifying our URL and return it to the calling code.

That’s all pretty simple right?

Before we continue, notice I didn’t add any error handling? That is because if anything goes wrong, I want the calling code to know that something has gone wrong. anything calling this will need to handle any errors that might occur (for example, page not found, name could not be resolved, server busy etc).

The Script

Now lets look at a script we could use to monitor our external IP address, it will perform the following:

1. Read a file containing the previously recorded external IP address, if non exists, the script should continue.
2. Call our previously defined function and store the returned IP address in a variable. We will also safely handle any errors that occur.
3. Compare the two, if they match, then the external IP address hasn’t changed, we don’t need to do anything, but we might want to. If they don’t match, then the external IP address has changed and we should make a fuss!
4. If the address has changed, we need to store the IP address back into the file.

Lets Take a look:

I am not going to go into much detail, this is a pretty simple script. I am assuming that the function that was previously discussed is available, you could put it into either a module or just defined in the script file.

So, now you know how to watch for your external IP address changing!

Enhanced Mitigation Experience Toolkit (EMET) V2 Config script

I was asked how I managed my Microsoft Enhanced Mitigation Experience Toolkit (EMET) V2.1 deployment, its not very important now as V3 is so much easier to manage.

Code contained in this post isn't pretty, there is a long story behind why this script is so bad, and why it is no where near the quality of my code that I write these days. Whilst I am embarrassed by this codes quality, people need ideas for managing EMET v2, whilst 3 is now out, I still wanted this code to be out there for people to use.

There are two things you need to realise when configuring EMET, is that applications are stored in different spot depending on if they are on a 32bit or 64bit machine.

In the script  there is a function which has two parameters, it will then try and configure a small list of apps. For a 32bit workstation, send that function c:\windows\system32 and c:\Program Files, but for a 64bit machine, send it those 32bit locations and c:\windows\syswow64 and c:\program files (x86). In that function you place lines calling emet_conf.exe sending it a parameter to the path of the executable you want to protect.

The main core code of the script is pretty simple. First we determine where EMET is installed to, we CD to its directory, we then delete any current configuration that might exist within EMET.

Next we will configure the system protection levels to be:

• DEP = ApplicationOptOut
• SEHOP = ApplicationOptOut
• ASLR = ApplicationOptIN

These were the settings we found worked best in our environment, but there is documentation from Microsoft on what you can set these to.

Continuing on with the script, Media Centre gains some protection, its always installed to the same place.

We then configure EMET for known apps in c:\windows\system32 and c:\program files

If the system is 64bit, we will then configure EMET for known apps in c:\windows\syswow64 and c:\program files (x86).

The function configure-apps simply contains lines calling emet_conf.exe, here are some examples:

Services and Microsoft Apps:

3rd Party apps

Office

As you can see, its all rather simple.

So there you have it, one of my quick and dirty scripts to configure EMET V2 (and it will work on 3 but you should switch to group policy or the profile xml files).