Information Technology | Miguel A Vallejo

How To Change Network Location On Windows Server 2012 R2

This is one of those quick posts designed more as a note, I had fun trying to find the way to update the network location on my 2012 Server sandbox so I figured I would create a short post on the matter…

It can be found by following:

Server Manager>Tools>Local Security Policy>Network List Manager Policies>Network

This is of course assuming that you have a fresh install with GUI.

—

If you’re using PowerShell you will want to run the following command (this requires PowerShell 4)

Get-NetConnectionProfile | Set-NetConnectionProfile -NetworkCategory Private

nVidia Shield Tablet Diagnostic Mode On Android Lollipop

I found the Diagnostic mode for the nvidia shield tablet, you can find it at the following path…

Settings > About Tablet

At this screen you want to scroll down to “Kernal version” and tap it numerous times until it goes into diagnostics.

This is what it will looks like…

Hope this helps anyone…

Updating To PHP 5.4 On Ubuntu Server 12.04 LTS

If you use php web applications then your know a lot are now demanding to be updated to php 5.4 or higher. To do this in Ubuntu 12.04LTS simply do the following…

If you haven’t already used ppa then you will have to first install python software properties, make sure you’re the root user… ( sudo bash )

apt-get install python-software-properties

PHP 5.4.x run:

add-apt-repository ppa:ondrej/php5-oldstable

PHP 5.5.x run:

add-apt-repository ppa:ondrej/php5

Once you’ve added the repo simply update and upgrade current packages & distribution packages with one simple command :)

apt-get update && apt-get upgrade -y && apt-get dist-upgrade -y

Installing USB Wireless Card On Kali Linux VMware

So I ran into this problem, I installed a fresh copy of Kali Linux onto a VM (VMware) so I could do some pen-testing on my local network without booting into Linux but couldn’t get Kali to use my external wireless card (I needed packet injection capabilities ;))

To make this short and sweet all you have to do to use your external USB wireless card (In My Case an Alfa Card) is just install updated vmware tools (I am assuming you have already added USB Controller in your VM settings…) you can do this by using the following commands on your shell/terminal:

apt-get update
apt-get install open-vm-tools

Once installed you should see your wireless card detecting new networks. This worked on Kali Linux x64 and because its based on Ubuntu Its safe to assume it will work with Ubuntu. Good luck and good hunting ;)

Listing The Last Modified Files In Debian Or Ubuntu

You might be asking yourself why would I care to list the last modified file/s right? Well if your in the security world then you know sometimes it’s important especially in a compromised server/workstation. It’s important to check what files may have been modified to help the attacker, for example, the editing of native configurations or scripts can facilitate permanent access to a system. It’s also important when trying to identify the potential root of the problem.

This command will list all files that were recently modified by without any real order.

ls -t

This command will list all files that were recently modified separating all file names by line by line.

ls -1t

This command will list all files that were recently modified separating all file names by line by line and limiting the amount displayed by 10

ls -1t | tail -10

I am sure there are more aggressive methods but this is a simple one that works pretty solid on any Linux distribution with bash.

How To Spot A Malicious Email

Today I get an email that looks like it came from GoDaddy except for a few things that don’t look right…
Email Headers are not correct, this was obviously a shitty job as the malicious user tried to make the email look like it was coming from godaddy but was actually coming from a compromised wordpress install on Hostgator.

From: Godaddy <donotreply@m.godaddy.com>
Message-Id: <E1YXF6r-0008QX-BX@gator4163.hostgator.com>

The Email:

Dear Customer MIGUEL VALLEJO. Confirm Your Identify.
An unknown user was trying to login your GoDaddy account with an incorrect password on Sunday 15 March , 2015 1:05 GMT, and with an unknown DNS IP Location:
(China) ip=36.250.74.87, as a result of that we partially blocked your GoDaddy accounts due to major security protocols.
Kindly visit our GoDaddy account Re-Activation Center Click here :
https://accounts.godaddy.com/do.php?check=e3251075554389fe91d17a794861d47be3251075554389fe91d17a794861d47b
We are sincerely sorry for any inconvenience.
GoDaddy Customer Support.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Copyright (c) 1999-2015 GoDaddy.com, LLC. All rights reserved.

Except for the fact that there is no administrative contact info, phone, business address in the signature it looks somewhat legit. Now Lets look at body of the email specifically at the url and where the link points to…
http://someweirddomain.com/wp-includes/css/nvldigkoua.htm?nvldigkoua=e3251075554389fe91d17a794861d47b

So this is obviously a malicious email, a targeted one because the user had to go through some effort to put this type of attack together. Sadly this is someone trying to dupe you into coughing up your password or in my case a sad attempt at doing so.
It’s a good idea to go over some security logs after events like this as it could be a sign of someone already in your network and trying to escalate their access.
In my case it was just some noob who though he was dealing with a end user, my response… <^>-_-.

How I Fell In Love With My NVIDIA Shield Tablet…

So I totally ripped myself off, it wasn’t suppose to be that way lol… I traded my ps4 with 2 controllers and two games for what was suppose to be a #nvidia shield tablet from some guy on craigslist with all accessories. I chatted with the guy for about half an hour and sounded totally legit. When I got home I had more time and light to inspect the tablet which ended up being a 16GB tablet instead of the 32GB version so I was like fml… as I continued I came to two corners which were also cracked, it looked like it had been dropped… FML~… Once I had it reset I tried to play a song and the damn speaker is blown, which sounded fine at low volume… Of course this sucked, I tried calling him back and texting and would get no answer. After about 30 minutes I found out who his name was and where he lived. I decided to say fuck it it’s not worth the drama and the cops would be like “dude! seriously for a ps4?”. So far the tablet is one of my favorite of all tablets I’ve ever owned it’s super fast and running the lollipop OS which is super smooth and responsive. I really want to upgrade to the 32GB so I can have some more room to do some native application development. It sucks that I got jacked but I am happy that I ended up with this tablet it’s perfect :*)

P.S. Hook me up with a 32GB version NVIDIA, I heard it rains tablets at HQ ;) @nvidia #nvidia

Checking Total Disk Usage in Ubuntu Or Debian From Terminal

If you need to check how much space is used up on all Filesystems/Drives You can simply run

df -h

Don’t forget to sudo or be root.

Increase In Brute Force Attacks on American Networks By Chinese Networks on 4th of July.

I started to track my security logs a lot more since I began to notice the amount of alerts I was getting via email on holidays. There is definitely a connection, American networks are under attack during American holidays specifically from 00:00 to 14:00, this time the attacks weren’t just coming from Chinese networks but Mexico & France.

Here is a list of the latest culprits…

inetnum: 61.174.51.192 – 61.174.51.255
netname: HANGZHOU-SRT-TECHNOLOGY-CO-LTD
country: CN
descr: HANGZHOU SRT TECHNOLOGY CO., LTD

inetnum: 115.239.248.0 – 115.239.248.255
netname: MOVEINTERNET-NETWORK
country: CN
descr: MoveInternet Network Technology Co.,Ltd.
descr:
admin-c: CJ1872-AP
tech-c: CS64-AP
mnt-irt: IRT-CHINANET-ZJ

inetnum: 183.0.0.0 – 183.63.255.255
netname: CHINANET-GD
descr: CHINANET Guangdong province network
descr: Data Communication Division
descr: China Telecom
country: CN
admin-c: IC83-AP
tech-c: IC83-AP

inetnum: 111.72.0.0 – 111.79.255.255
netname: CHINANET-JX
descr: CHINANET JIANGXI PROVINCE NETWORK
descr: China Telecom
descr: No.31,jingrong street
descr: Beijing 100032
country: CN

inetnum: 117.21.0.0 – 117.21.255.255
netname: CHINANET-JX
descr: CHINANET Jiangxi province network
descr: China Telecom
descr: No.31,jingrong street
descr: Beijing 100032
country: CN

inetnum: 202.109.128.0 – 202.109.191.255
netname: CHINANET-JX
descr: CHINANET Jiangxi province network
descr: Data Communication Division
descr: China Telecom
country: CN

inetnum: 89.248.162.128 – 89.248.162.255
netname: NL-ECATEL
descr: AS29073, Ecatel LTD
country: NL

inetnum: 212.83.128.0 – 212.83.153.255
netname: FRWOL
descr: Tiscali France
country: FR

NetRange: 168.243.0.0 – 168.243.255.255
CIDR: 168.243.0.0/16
OriginAS:
NetName: LACNIC-ERX-168-243-0-0
NetHandle: NET-168-243-0-0-1

Its probably nothing to worry about…

It’s Official, China Is Undeniably Attacking US Networks 400% Increase In Network Attacks Over Holiday Weekends.

Ok so I am not here to point fingers because both governments pretty much do the same thing duh… I will also add that Chinese attacks on US networks have increased in the past few months since the conflicts in Ukraine. Over this memorial weekend I have been monitoring many server nodes across different data centers and have definitely had in increase in brute force and scan attacks.

Today I have noticed a 400% increase in additional log records related to these attacks. Coincidence I think not, how else do you explain an increase in attacks a day before a major US holiday? Chinese PLA will obviously deny anything but if you analyze the data it definitely looks like a coordinated attack on US networks .Chinese Intelligence Assumes that no IT personal will be working over the weekend so they amp their attacks. Let let me say something to Chinese Intel… YES WE WORK ON HOLIDAYS TOO!… lol

P.S. I have logs to prove that too… xD

Here is a list of their most popular attack networks…

inetnum: 61.174.51.192 – 61.174.51.255
netname: HANGZHOU-SRT-TECHNOLOGY-CO-LTD
country: CN
————————————————————————–
inetnum: 42.62.0.0 – 42.62.127.255
netname: Forest-Eternal
descr: Forest Eternal Communication Tech. co.ltd
descr: Rm.902,North Real Estate Building, Build. No.3,
descr: #81Yuan,Haidian District,Beijing
country: CN

————————————————————————–

inetnum: 116.8.0.0 – 116.11.255.255
netname: CHINANET-GX
descr: CHINANET Guangxi province network
descr: Data Communication Division
descr: China Telecom
country: CN

————————————————————————–

inetnum: 61.191.0.0 – 61.191.255.255
netname: CHINANET-AH
descr: CHINANET Anhui province network
descr: China Telecom
descr: A12,Xin-Jie-Kou-Wai Street
descr: Beijing 100088
country: CN

————————————————————————–

inetnum: 117.79.80.0 – 117.79.95.255
netname: SANXIN
descr: Beijing Sanxin Shidai Co.Ltd
descr: 1513 Xinjishu building Beijing link west road
descr: Haidian District, Beijing, PRC
country: CN