Infrastructure Security on vanstechelman.eu

Managing Windows firewall with PowerShell

Wed, 21 Apr 2021 09:38:13 +0000

To check the status of the Windows firewall with PowerShell, type the following:

$FWProfiles = (Get-NetFirewallProfile);
Write-Host "Windows Firewall Profile Statuses" -Foregroundcolor Yellow;
$FWProfiles | %{
    If($_.Enabled -eq 1){
        Write-Host "The Windows Firewall $($_.Name) profile is enabled"  -Foregroundcolor Green
        }Else{
        Write-Host "The Windows Firewall $($_.Name) profile is disabled" -Foregroundcolor Red
        }
    };

To disable the Windows firewall for all profiles with PowerShell, type the following:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

Testing for CVE-2018-11784 - Apache Struts 2 Open Redirect vulnerability

Thu, 04 Oct 2018 07:57:17 +0000

On Wednesday 3 October 2018 the Apache Software Foundation has released information about an Open Redirect vulnerability in Apache Struts 2. The vulnerability received identifier CVE-2018-11784.

The vulnerability announcements describes the vulnerability as follows:

When the default servlet returned a redirect to a directory (e.g. redirecting to ‘/foo/’ when the user requested ‘/foo’) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Testing for impact of Infineon's vulnerable RSA generation (CVE-2017-15361)

Tue, 17 Oct 2017 14:19:45 +0000

A security vulnerability exists in the firmware of certain Infineon Trusted Platform Module (TPM) chipsets. The vulnerability weakens key strength. It is weakened so much that it is possible to derive the private key from the public key for RSA key pairs of up to 2048-bit. This page contains a number of manners in which you can verify whether your computer contains an affected Infineon TPM chip that generates vulnerable RSA key pairs.

How to run the WSUS Server Cleanup Wizard from command-line

Thu, 13 Jul 2017 18:34:06 +0000

When running the WSUS Server Cleanup Wizard from the MMC snap-in, it can occur that you receive the following WSUS database error:

Error: Database Error
An error occurred when trying to perform a database operation. This can happen if the database is very busy, if the database service is stopped, if the connection to the database is lost, of if the Post-Installation task is not completed successfully. Please contact your system administrator if the problem persists.

Click Reset Server Node to try to connect to the server again.

If you haven’t performed the cleanup in a long time, then this can happen. So you might decide to read through the manual of the wsusutil.exe tool where you think that the deleteunneededrevisions switch will resolve all your problems, however, it seems that the wsusutil.exe parameter deleteunneededrevisions doesn’t exist on WSUS 3.1.

Luckily, you can achieve the same thing using powershell. The advantages here are:\

Scanning for CVE-2017-0143 (EternalBlue) using nmap (MS17-010)

Sat, 01 Jul 2017 08:30:00 +0000

With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. This vulnerability has been assigned CVE-2017-0143. The vulnerability is also often nicknamed EternalBlue. This page explains how you can scan for it from a Windows machine using nmap.

The SMBv1 server in many Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets, aka “Windows SMB Remote Code Execution Vulnerability.” This vulnerability is actively being exploited.

Scanning for CVE-2017-5638 using nmap

Tue, 14 Mar 2017 21:00:00 +0000

On March 6, 2017, Apache disclosed a vulnerability in the Jakarta multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on the targeted system using a crafted Content-Type header value.
This vulnerability has been assigned CVE-ID CVE-2017-5638.
This page explains how you can scan for it from a Windows machine using nmap.

Scan for FREAK using nmap

Sun, 08 Mar 2015 19:56:11 +0000

Not everyone is vulnerable to the potential attack vector that researchers from INRIA, a French research institute, and Microsoft disclosed recently. In order to be vulnerable, the computer or server must support a class of deliberately weak export cipher suites. Support for these weak algorithms has remained in many implementations, however they are typically disabled by default. Nevertheless, the researchers discovered that several implementations incorrectly allow the message sequence of export ciphersuites to be used even if a non-export ciphersuite was nogotiated. This post shows how you can test a server to detect if it has been configured to allow export cipher suites to be used.
\

Prevent spammers from sending mails that abuse your domain name using an SPF record

Sun, 26 Oct 2014 06:49:46 +0000

All mail server administrators will have encountered the following problem: spammers send out spam and they spoof the mails so that the sender appears to be a user in the domain you are managing. Unfortunately there is not a lot that can be done to prevent spammers from sending such these spam mail. There is however a way in which receiving mail servers can check whether the mail was send from your mail server or whether is was a spammer who used a mail server that is not authorized to send mails from your domain. This can be accomplished with SPF (Sender Policy Framework).

Scan for POODLE using nmap from a Windows machine

Wed, 15 Oct 2014 10:17:34 +0000

Researchers from the Google Security Team have published findings about a vulnerability in SSL 3.0. CVE-2014-3566 has been allocated for this protocol vulnerability. It is possible to use nmap to scan for the presence of this vulnerability by doing a scan on the supported SSL/TLS protocols. This post shows how to scan for the POODLE weakness using nmap.

Scan for Heartbleed using nmap from a Windows machine

Thu, 10 Apr 2014 08:01:14 +0000

You may have heard of “Heartbleed”, a flaw in OpenSSL that could allow the theft of data normally protected by SSL/TLS encryption.

It is possible to scan for the presence of this vulnerability using different methods.
This page explains how you can scan for it from a Windows machine using nmap.

Doing a DNS zone transfer

Wed, 16 Jul 2008 09:55:14 +0000

This article shows how you can perform a DNS zone transfer using nslookup on Windows and using dig on Linux.