Remotely & Secretly auditing a PC (without user intervention)

Entering WMIC as domain administrator

1. From Start -- Run "runas /domain\user cmd"
2. You'll be shown a new command prompt window - now you are ready to use the WMIC   
3. "Windows Command Line Interface" 

Pulling installed software, name and versions from Remote PC's

1. To list software installed on a remote machine use the following syntax

wmic /node"PCNAME"  product get name, version, vendor >c:\somename.csv

Or you can pipe to .txt file for easier import into xls.

You will be shown the list of software installed on a PC & their versions: ie: and this will be piped to your c drive




 Remote audit with a pipe out to c:\


The output file










http://isc.sans.edu/diary.html?storyid=1229

Ubuntu 10.04 - add a persistent route

route add [-net|-host] netmask gw dev X

Example

route add -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.1.1 dev eth0
route add -host 10.10.1.1 netmask 255.255.255.0 gw 192.168.1.1 dev eth0

Avaya Site Manager 5.0 - setup using Wine on Ubuntu 10.04

• Install Wine
• Install Winetricks
• Install Avaya Site Manager
• Open Winetricks

-- Click on "select a default wine prefix"
---- Click on "Install a windows .dll or component"
------- Select msdac32

If you don't install msdac32 you'll get this error:


marnast@ict-marna:~/.wine/dosdevices/c:/Program Files/Avaya/Site Administration/bin$ wine ASA.exe
fixme:atl:AtlModuleInit SEMI-STUB (0x100100b8 0x1000d1b0 0x10000000)
err:module:attach_process_dlls "odbc32.dll" failed to initialize, aborting
err:module:LdrInitializeThunk Main exe initialization for L"C:\\Program Files\\Avaya\\Site Administration\\bin\\ASA.exe" failed, status c0000005
marnast@ict-marna:~/.wine/dosdevices/c:/Program Files/Avaya/Site Administration/bin$ wine ASA.exefixme:atl:AtlModuleInit SEMI-STUB (0x100100b8 0x1000d1b0 0x10000000)
fixme:win:LockWindowUpdate (0x10200), partial stub!
fixme:win:LockWindowUpdate ((nil)), partial stub!
fixme:shell:MLSetMLHInstance (0x71590000,0x7ed40000) stub
fixme:shell:MLClearMLHInstance (0x71590000)stub
fixme:commdlg:ChooseFontW : unimplemented flag (ignored)
fixme:shell:MLSetMLHInstance (0x71590000,0x7ed40000) stub
fixme:shell:MLClearMLHInstance (0x71590000)stub

Check Path...............

ECHO $PATH  /usr/bin/python

SSH setup - between 2 linux boxes without passwords

On Nagios Server

I created /home/nagios/.ssh/

root@Nagi:/home/nagios# ssh-keygen -t dsa
Generating public/private dsa key pair.
Enter file in which to save the key (/root/.ssh/id_dsa): /home/nagios/.ssh/id-dsa
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/nagios/.ssh/id-dsa.
Your public key has been saved in /home/nagios/.ssh/id-dsa.pub.
The key fingerprint is:
d2:f1:3b:2e:8a:8c:3a:db:33:81:ec:57:7e:0a:88:37 root@Nagi
The key's randomart image is:
+--[ DSA 1024]----+
|                 |
|                 |
|        .        |
|       . o       |
|..    . S .      |
|o.o  . .   .     |
|o.Eoo     o      |
|.+o=.o ... .     |
|o++oo.+. ..      |
+-----------------+
root@Nagi:/home/nagios#

Nagios Error: Check command not defined anywhere!

Error: Service check command 'check_disk_remote' specified in service 'check_disk_remote' for host 'Nagios-CPT' not defined anywhere!







Location check:

** Plugin located in /usr/local/nagios/libexec/
** Commands.cfg --> is the service defined?
** services.cfg --> is the service defined to be used with a host?

Nagios - Examples check_disk_remote

superman@Nagi:/usr/local/nagios/libexec$ ./check_disk_remote -e ssh -H 10.0.0.110 -w 90 -c 95 -v
superman@10.0.0.110's password:
superman@10.0.0.110's password:
Filesystem         1024-blocks      Used Available Capacity Mounted on
/dev/sda1             73986264   1480204  68747724       3% /
percent = 3% warn=90 crit=95
none                    504728       236    504492       1% /dev
none                    508936         0    508936       0% /dev/shm
none                    508936       280    508656       1% /var/run
none                    508936         0    508936       0% /var/lock
none                    508936         0    508936       0% /lib/init/rw
none                  73986264   1480204  68747724       3% /var/lib/ureadahead/debugfs
OK: All Filesystems are below threshold (90/95%) | /=3%;;;0;100