Menu > Articles de la revue de presse : - l'ensemble [tous | francophone] - par mots clé [tous] - par site [tous] - le tagwall [voir] - Top bi-hebdo de la revue de presse [Voir]

---

S'abonner au fil RSS global de la revue de presse

---

Présentation : After listening to Larry's excellent technical segment on dumping the event logs from a large list of computers, I decided to try it out on my own. If you missed the technical segment, you can find the notes here. To do my own testing I needed to start with a large list of computers. For my list, I want to have the names of every computer in the domain. So I turned to dsquery computer to get a list of all computers. C WINDOWS dsquery computer CN CONTROLER1,OU Domain Controllers,DC subdomain,DC domain,DC com BLA BLA BLA... Truncated CN WORKSTATION1,OU ORGUNIT1,OU OrgUnit2,OU OrgUnit3,DC Subdomain,DC Domain,DC com BLA BLA BLA... Truncated again The length of the results changes because of the variable number of subdomains, but fortunetly for us the workstation name is always the first part of the string. It is always between the CN and the first comma. We can strip out the workstation name with the DELIMS and TOKENS option of the FOR loop. Also, by default DSQUERY will only return the first 100 results. This can be changed using the -LIMIT option. Setting the LIMIT to 0 returns all result. For now lets check our output looking at only two entries. C WINDOWSfor F delims , tokens 1 pourcentsi in 'dsquery computer -limit 2' do echo pourcentsi C WINDOWSecho CN WORKSTATION1 CN WORKSTATION1 C WINDOWSecho CN WORKSTATION2 CN WORKSTATION2 We are almost there. I need to strip the first 4 characters of the line. For this I stole a page or two from Ed Skoudis' play book. We can strip the first four characters with the SET command using the expression variable pourcentsvariable 4pourcents. But, since we are in a FOR loop we have to turn on delayed variable expansion and use instead of pourcents. C WINDOWScmd.exe v on c for F delims , tokens 1 pourcentsi in 'dsquery computer -limit 2' do set name pourcentsi set name name 4 echo name Dsquery has reached the specified limit on number of results to display use a different value for the -limit option to display more results. C WINDOWSset name CN WORKSTATION1 set name name 4 echo name WORKSTATION1 C WINDOWSset name CN WORKSTATION2 set name name 4 echo name WORKSTATION2 Now we have all the computer names in the domain being printed one at a time. I can dump all the names of the machines in the domain to file to feed Larry's event dumper. C WINDOWScmd.exe v on c for F delims , tokens 1 pourcentsi in 'dsquery computer -limit 0' do set name pourcentsi set name name 4 echo name c temp machines.txt Better yet, we could combine it with a WMIC command and other commands to do various useful tasks on our machines. For example, if I want to query every machine in my network for an instance of a process that starts with CMD I could run the following remember that pourcents is a wild card in wmic C WINDOWScmd.exe v on c for F delims , tokens 1 pourcentsi in 'dsquery computer -limit 2' do set name pourcentsi set name name 4 wmic node name process where name like 'cmdpourcents' list brief Dsquery has reached the specified limit on number of results to display use a different value for the -limit option to display more results. C WINDOWSset name CN WORKSTATION1 set name name 4 wmic node name process where name like 'cmdpourcents' list brief HandleCount Name Priority ProcessId ThreadCount WorkingSetSize 33 cmd.exe 8 2308 1 1654784 C WINDOWSset name CN WORKSTATION2 set name name 4 wmic node name process where name like 'cmdpourcents' list brief HandleCount Name Priority ProcessId ThreadCount WorkingSetSize 33 cmd.exe 8 2368 1 1626112 So there you go. Now using this basic syntax... cmd.exe v on c for F delims , tokens 1 pourcentsi in 'dsquery computer -limit 0' do set name pourcentsi set name name 4 Any command here based on name ... you can run any command you want on every machine in your domain. Join me for SANS 504 June 21-26






Les derniers articles du site "PaulDotCom" :

- Post Exploitation OS X Style
- Smartphone Attacks Overdramatized
- PaulDotCom - Security Weekly - Episode 232 - February 24th - 2010
- Bind DNS - The new Internet Kill Switch
- Episode 232 tonight with Murray Murr The keys to phishing success
- 7 ways to not get hacked by Anonymous
- PaulDotCom - Security Weekly - Episode 231 part 2 - February 17th 2011
- EXACTLY Why Your Network Needs to be Resilient Against the 0Day Threat
- Brute Forcing Passwords Part 2 with JTR, CeWL and the US Census
- PaulDotCom - Security Weekly - Episode 231 Part 1 - February 17th 2011

---

S'abonner au fil RSS global de la revue de presse

---