Symantec Endpoint Protection RPC Server is Unavailable Error

Symantec Endpoint Protection  RPC Server is Unavailable Error
SEP RPC Server is Unavailable Error

After performing so many tests I noticed that altough Windows Firewall is being managed and it is disabled by SEP, windows firewall still prevents RPC traffic.

You can disable Windows firewall by executing the command below on relevant client computers.

netsh advfirewall set allprofiles state off





Read more...

Prevent Exchange Server 2010 Direct File Server Access

By Default Exchange Server 2010 allows internal hyperlinks access by using Android smart phones.
Users can access hyperlinks that indicates internal file server in your organization by clicking hyperlinks in emails.

In order to prevent this type of access follow the steps below;

Open Exchange Management Console -> drill down to server configuration -> Client Access -> Exchange ActiveSync (middle tab) -> right click on the name (default website in my case) properties -> Remote file servers tab. From here, you can allow or deny access.
Read more...

Decrypt files encrypted by cryptolocker

https://decryptcryptolocker.com/



Read more...

Portless File transfer by using Hping

PC1: Server that will receive file.
PC2: Host that will send file to PC2

On PC1, you should execute the command below;

Hping3 PC1_IP_Address  --listen fire --icmp -I eth0 > received_file.txt

Parameters that is using in command.

--icmp: Protocol 

-d: FileSize(Excluding Heading Information)

--sign: Word that will trigger file transfer

--file: File_Name

-c: Number of Packet

-I: Network Interface

--listen: Listening Mode

Because of trigger word "fire" ,While sending the packet we are losing 4 bytes data. It means when you want to send 35byte file, you will send 39 byte totaly.


On PC2, you should execute the command below;

Hping3 PC1_IP_Address --icmp -d 73 --sign fire  --file sendingfile.txt -c 1 –I eth0





Read more...

There was an error uploading the file Symantec DLP

If you are getting "There was an error uploading the file" while trying to upgrade your DLP to newer version from Systems-->Overview-->Upgrade menu by using .jar file try the steps below. It's worked for me.

1) Create a folder named enforceupgrade under c:\Vontu\Protect\Updates
2) Extract the jar file by using winrar or winzip into this folder.
3) Run the start_upgrade_wizard.bat
4) Wait approximately 60 seconds for Tomcat to initialize properly
5) Open web browser and go to the URL https://yourenforceipadderss:8300
6) Log in by using administrator credentials and start the upgrade process.
Read more...

Stenography using Alternate Data Stream (ADS)

1) Embbeding secret.txt file into test.txt file

• In the command prompt execute the command "notepad.exe test.txt:secret.txt" (without quotas) and press enter. You will see a popup that wants you to confirm of creating new file, press yes.
• You will not be able to see your new file even if you enable showing hiden files option. You will just see test.txt file.
• Execute notepad.exe test.txt:secret.txt to open your secret.txt file and write anything and save.
• You will see that the size of test.txt file will not increase even if you type millions of characters in secret.txt file. (It is really important bug in NTFS file system.)

2) Command below will embed anyfile.exe to calc.exe. And when you execute calc.exe, anyfile.exe will execute in the background and you will not be able to see anyfile.exe process in the Task manager.

type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe


3) Command below will embed hacker.exe into a test.txt file.
C:\type c:\hacker.exe > test.txt:hacker.exe

Syntax

Create type textfile > visible.txt:hidden.txt
■ View more < visible.txt:hidden.txt


Freeware programs like lads.exe by Frank Heyne (www.heysoft.de) and crucialADS by CrucialSecurity can be used to manually audit your files for the presence of Alternate Data Streams. Alternatively, the action of moving a file into another file system that doesn’t support ADS will automatically destroy any Alternate Data Streams.


This program lists all alternate data streams of an NTFS directory including the ADS of encrypted files
http://www.heysoft.de/en/software/lads.php?lang=EN

 

Other Programs that can reveal ADS files.

LNS:
http://ntsecurity.nu/toolbox/lns/

GMER
http://www.gmer.net/index.php

Visual ADS Detector
http://www.codeproject.com/KB/shell/csadsdetectorarticle.aspx

Read more...

Embedding secret file or program into a Picture File

Put the all the files (Innocent picture file, secret file) into a folder. Compress the secret file by using winrar.

Open command prompt and navigate the folder.

Execute the command below;

copy /b Innocentpicture.jpg+secret.rar  noninnocentpicture.jpg

After executing the command new file named noninnocentpicture.jpg will be created on the same folder with new size.

You can see your secret.rar file by opening noninnocentpicture.jpg using WINRAR.


Read more...

Juniper SSG Prevent Brute Force and Dictionary Attack

Open Management Console

Under Configuration --> Admin --> Management

Configure the "Max Login Attempts" value.
Read more...

Securing the Cisco IOS image file

You can hide the your Routers Cisco IOS by using Cisco IOS Resilient Configuration. Users can not view IOS information by using after "Show flash" command after this configuration.  By using this property you can hide the IOS and These secure files cannot be removed by the user. No extra space is required to secure the primary Cisco IOS image file.

The Cisco IOS Resilient Configuration feature is mainly intended to speed up the recovery process.

In Global Configuration Mode, use the commands below;

 secure boot-image    'Enables Cisco IOS image resilience

 secure boot-config    'Stores a secure copy of the primary bootset in persistent storage.

 end

 show secure bootset ' Displays the status of configuration resilience and the primary bootset filename

Note: This feature is available only on platforms that support a Personal Computer Memory Card International Association (PCMCIA) Advanced Technology Attachment (ATA) disk. There must be enough space on the storage device to accommodate at least one Cisco IOS image (two for upgrades) and a copy of the running configuration.

Read more...

SET(Social Engineering Toolkit) ile Gmail Hesap Bilgilerinin Ele Gecirilmesi

Social Engineering ToolKit Gmail Hacking.

This video has been prepared for to inform users about this type of attack and direct them to take care about this attacks. Do not use  this method to steal somebodys account information or personal informations. 

SET kullanılarak Phishing yontemi ile gmail hesap bilgilerinin ele gecirilmesi.

Read more...

Testing MS12-020

Testing MS12-020 on Windows 7 + Up-to-date SEP.

This video has been prepared for to inform users about this type of attack and direct them to take care about this attacks. Do not use this method to damage any systems.


Read more...

Metasploit & MS08_067

This video has been prepared for to inform users about this type of attack and direct them to take care about this attacks. Do not use this method to steal somebodys account information,  personal informations or damage systems.

Bu video, Sadece antivirus kullanımının yeterli olmadığı, bilgisayarlarımız üzerinde güvenliğinin sağlanması için kişisel güvenlik duvarı kullanılması gerektiğini ve tüm işletim sistemi ve yazılımların güncellemelerinin yapılması gerektiği konusunda bilgilendirmek için hazırlanmıştır.
Read more...

How to open Wikileaks Insurance File.

Download AESCRYPT from www.aescrypt.com.
Change the insurance file extension to .aes

But first you need password!
Read more...

Symantec Endpoint Encryption Upgrade Commands.

These commands are Valid for Upgrading from 7.0.4 to 7.0.6.

msiexec /i "path\new packet name.msi" REINSTALL="ALL" REINSTALLMODE="vomus"

Firstly, you should install framework, then others(FD, RS)
Read more...

Fatal error. Machine will need to be restarted. Brief description: The application returned a status of [0x80000001] in the state State_Initialized.

This error is bug of Symantec Endpoint Encryption 7.0.3 & 7.0.4
If you are getting tihs error, you should decrypt disk by using Recovery CD, uninstall old SEE FD software and upgrade it to 7.0.6.
Read more...

Application Deploy Parameters-1

Acrobet Reader 9.x Install Parameter = /sAll
Java Runtime Environment Install Parameter = /s ADDLOCAL=ALL IEXPLORER=1 MOZILLA=1 REBOOT=Suppress
Flash Player Install Parameter = -install
Firefox Install Parameter = -ms -ma
Read more...