Page 1 of 1 1
Topic Options
#208355 - 2014-01-22 11:36 PM Talk to me like I'm 12... Please. Startup Script
dataspike Offline
Getting the hang of it

Registered: 2005-03-09
Posts: 89
Loc: San Diego, CA
Hey guys... can someone refresh my memory, or teach me because I just don't remember.

I've got a script which basically looks like this. This script will be converted to an EXE using AdminScriptEditor. This is done for a couple reasons. Inside the EXE, I include a couple of files; Screensaver, Kixforms.dll, an updated copy of wkix32.exe. The EXE is then used as a Startup Script via GPO.

 Code:
If InStr(@PRODUCTTYPE, "Server") InStr(@PRODUCTTYPE, "Domain Controller") @TsSession = "1"
	Quit ;Exit script if it detects a server or terminal service session.
EndIf

$sAdmin = GetAdministratorName
Shell 'net.exe user ' + $sAdmin + ' Password'

Function GetAdministratorName()
  Dim $sUserSID, $oWshNetwork, $oUserAccount
  $oWshNetwork = CreateObject("WScript.Network")
  $oUserAccounts = GetObject("winmgmts://" + $oWshNetwork.ComputerName + "/root/cimv2").ExecQuery("Select Name, SID from Win32_UserAccount" + " WHERE Domain = '" + $oWshNetwork.ComputerName + "'")
  For Each $oUserAccount in $oUserAccounts
    If Left($oUserAccount.SID, 9) = "S-1-5-21-" And Right($oUserAccount.SID, 4) = "-500"
      $GetAdministratorName = $oUserAccount.Name
    EndIf
  Next
EndFunction



This is all fine, and works for what I intend, however, it appears that the AdminScriptEditor package doesn't really convert it to a full fledged EXE, but rather a package with a runtime engine of some sort. Meaning the code above is in clear text at some point during the process. Now in some cases the temp files that the EXE creates does not remove the script leaving my password in clear text for someone to find.

My question; What would be the best way to encrypt or otherwise obfuscate the password so that it can't be simply read in the event the EXE leaves the temp files.

Suggestions, sample code, etc would be fantastic.

Thanks!

Top
#208357 - 2014-01-23 12:05 AM Re: Talk to me like I'm 12... Please. Startup Script [Re: dataspike]
Robdutoit Offline
Hey THIS is FUN
***

Registered: 2012-03-27
Posts: 363
Loc: London, England
You can tokenise the scripts to obfuscate the script so that the password should not be visible and I believe that there is a program call kixcrypt which probably does something similar.

However, while I don't entirely understand what your script is doing as my scripting skills are nothing to write home about, I don't agree with your putting any passwords into the script. This is bad policy. I wrote an article called step by step guide to running a script with elevated or admin privileges.

http://kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=205798#Post205798

This may not help you, as I am not entirely clear what you want your script to do although I am guessing that you want to get the domain admin username based on the name of your function! Like I said my scripting is nothing to write home about!

There are other people on this forum who are far better qualified than I to help you with your actual query as in how to obfuscate your script, but I wanted to highlight that if you can find a way to write your script without putting in usernames and passwords, then you should do that. My step by step guide allows you to elevate the privileges of the script by using task scheduler, so the password to elevate script is never within the script. I realise thats not what you are doing here, but I just wanted to highlight that putting passwords into scripts equals a bad idea!

Hope this helps somewhat.

Top
#208358 - 2014-01-23 12:25 AM Re: Talk to me like I'm 12... Please. Startup Script [Re: Robdutoit]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
Dataspike,

If you're using GPO to run this script to set the local admin password on the workstations, why not just use a GPO to set the workstation's local admin password directly?

If you can't use policy for whatever reason, the Secure Admin Install Suite can do this for you without exposing any credentials.. look in the Script Vault here on KORG.

Another option is to encrypt the password in an external file, and decrypt it in the script, which is tokenized. The CYPHER() UDF can be found here on KORG and downloaded from my web site from that page. It's pre-tokenized to insure the security, so needs to be loaded into your scripts via a CALL statement. It's a cross between the WW-II Germam Inigma code, updated from 8 to 2048 codewheels, and a code used by an episode of Mission: Impossible in 1968. The cool thing about this is you can't crack the code based on character frequency - with the right key, something like "cat" can be written as "GGG".

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#208359 - 2014-01-23 12:36 AM Re: Talk to me like I'm 12... Please. Startup Script [Re: Glenn Barnas]
Robdutoit Offline
Hey THIS is FUN
***

Registered: 2012-03-27
Posts: 363
Loc: London, England
I must have a look at this cypher udf. Thats actually a very good idea. Thanks Glenn. And also good to know exactly what dataspike was trying to do in his script. WMI is not an area that I am particularly good at.
Top
#208360 - 2014-01-23 12:42 AM Re: Talk to me like I'm 12... Please. Startup Script [Re: Robdutoit]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
 Code:
Shell 'net.exe user ' + $sAdmin + ' Password'
is the clue.. This syntax of the NET command sets the password for a local user.. you can run NET USER /? on your PC for full info.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
#208362 - 2014-01-23 05:43 AM Re: Talk to me like I'm 12... Please. Startup Script [Re: Glenn Barnas]
dataspike Offline
Getting the hang of it

Registered: 2005-03-09
Posts: 89
Loc: San Diego, CA
Thanks Robdutoit. No issues with privileges, since the script will be running under the "System" account.

 Originally Posted By: Glenn Barnas
Dataspike,

If you're using GPO to run this script to set the local admin password on the workstations, why not just use a GPO to set the workstation's local admin password directly?

If you can't use policy for whatever reason, the Secure Admin Install Suite can do this for you without exposing any credentials.. look in the Script Vault here on KORG.

Another option is to encrypt the password in an external file, and decrypt it in the script, which is tokenized. The CYPHER() UDF can be found here on KORG and downloaded from my web site from that page. It's pre-tokenized to insure the security, so needs to be loaded into your scripts via a CALL statement. It's a cross between the WW-II Germam Inigma code, updated from 8 to 2048 codewheels, and a code used by an episode of Mission: Impossible in 1968. The cool thing about this is you can't crack the code based on character frequency - with the right key, something like "cat" can be written as "GGG".

Glenn

Hi Glenn.

Thanks for the response.

Using GPO to set password isn't very secure, the password is stored inside the GPO folder on your DC and is using an encrypted format that is well known and easy to crack. In addition, it doesn't work as well as expected. I tried.

Sorry, the "Secure Admin Install Suite", hadn't heard about it. I took a quick look and while this would work for some situations, I don't think it'll fit for my needs, as the sample code above is just a portion of my overall script which I intend on using as a startup script. Since it's running as a startup script, it has the appropriate credentials, so I don't have an elevation issue.

The encrypt option is more my thought for this. The tokenized process is what is escaping me at the moment. I'm not really sure how this whole process works. I really hate to ask, but based on my example above, would you be able to give me an example of how to tokenize?

 Originally Posted By: Glenn Barnas
 Code:
Shell 'net.exe user ' + $sAdmin + ' Password'
is the clue.. This syntax of the NET command sets the password for a local user.. you can run NET USER /? on your PC for full info.

Glenn

Sorry, not sure who this portion was directed to? If me, then yup. I know all these. I grew up on DOS and related commands. The big part I'm missing or don't know is the tokenized functions; how to do, use, read, etc.

Top
#208364 - 2014-01-23 01:39 PM Re: Talk to me like I'm 12... Please. Startup Script [Re: dataspike]
Glenn Barnas Administrator Offline
KiX Supporter
*****

Registered: 2003-01-28
Posts: 4403
Loc: New Jersey
WHAT?!?!?! You know DOS???

My hat's off to you! When I taught parts of the MCSE course, the students had been in the class for about 8 months before I started teaching Networking and IIS. The first two days of Networking actually had to be an Intro to DOS because nobody had EVER seen a command prompt, and they had no idea that you actually had to TYPE the Ping command! \:\)

The "clue" was directed at Robdutoit.. I pretty much ignored your function as it just identifies the admin name and feeds it to the Net command.

The User Admin Serviice is a recent addition and might have been useful if this was all you were doing. It's advantage is that you can use the user's login process to detect if an action is needed, and then push it out with the desired credentials for implementation.

As for the Cypher UDF, I'm sure the uber-geeks at the NSA could crack it, but the typical hacker likely could not. Here's the basic idea for using it:
 Code:
; Load the cypher UDF
Call 'path\cypher.k61'  ; NOTE - This is pre-tokenized - use the correct version!
; rest of your code inits go here...


; Read and decrypt the password from an INI file
; Note that the extension is .CFG and not .INI, the section is "NETCMD", and 
; the value read is "PVal". This simply makes the data less obvious as
; the file is plain text.
$Password = ReadProfileString('path\startup.cfg', 'NETCMD', 'PVal')

; decrypt the password using a pre-defined key.
; Permanent/embedded key - the  script must be edited, tokenized, and distributed to change this
;$CypherKey = 704
; Stored Key - can be written when the password is encoded and can be changed anytime
; When I use this method, I don't use this value directly but have some permanent
; value in the scripts that adds, subtracts, or otherwise alters this by a fixed amount,
; thus, this external value is only part of the key. In this example, I treat the key
; as a string and add a digit to the beginning and end
$CypherKey = Val('8' + ReadProfileString('path\startup.cfg', 'NETCMD', 'CVal') + '5')

; Cycle Length (# of "codewheels") - set to 0 for default of 2048
$Len = 0

; Set the direction (1=encode,0=decode in this example, must be opposite of value used when encoding)
; This can also be read from the .CFG file
$Dir = 0

; Now we can decrypt the Password
$Password = Cypher($Password, $CypherKey, $Dir, $Len)

; with the password now stored in the variable in clear text, the rest of your script
; can continue here..
You would then tokenize your script using KIX32 -T myscript.kix, which would generate a tokenized .KX file. That file is called like any other, it just isn't in a viewable or editable form.

There's also a CODEC UDF here in source that uses a complex ROT13 based algorithm that will give some idea of what's going on in data encoding/decoding, although cypher is much more complex.

Glenn
_________________________
Actually I am a Rocket Scientist! \:D

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
1 registered (Henriques) and 2516 anonymous users online.
Newest Members
fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users

Generated in 0.235 seconds in which 0.159 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org