{hier de naam van uw .nl domein}.be domein kopen voordat deze gekaapt wordt? (Deel 2)

Zie hier deel 1.

NU.NL bericht er over. Merk op dat Trademark Office niet enige is met dit soort praktijken.

Het .NET domein met dezelfde naam als mijn .COM domein kwam vrij nadat de vorige eigenaar de domeinnaam opgegeven had. Ik kreeg een email van een (andere) domain registrar dat het .NET domein vrij zou komen (hierdoor werd ik wakker!) en dat ik het domein van hen kon kopen voor $90 (ik wist, da's veel te duur). Bovendien kreeg ik niet eens de garantie dat ze het domein konden leveren! Geen slapende honden wakker maken dus verder niet gereageerd.

Ik heb de domein expiratie methode opgezocht en rustig gewacht totdat het domein geheel vrij was. Daarna het .NET domein online (!) bij mijn eigen domein provider geregistreerd voor EUR10/jaar.

Algemeen advies: aan alle email met een zekere urgentie is het altijd goed om de context uit te zoeken en voordat je tot handelen overgaat, eerst een nachtje te slapen.

Capacitor plague, deel 2

Lees hier deel 1.

Ik kocht op Marktplaats weer een paar managed ethernet switches en een was zo dood als een pier. Opengeschroefd en even naar mwo (meest waarschijnlijke oorzaak), de power supply, gekeken. Er zit een eenvoudige PWM powersupply in. De hoogspannings ELCO (100µF/400V) vertoonde electroliet lekkage.

Lekkage aan de hoogspannings ELCO

Na het vervangen van de ELCO: nog steeds geen licht of geluid. Even gemeten en de nieuwe ELCO werkte goed (300VDC) echter op de trafo (in de gele isolatie) geen wisselspanning. Conclusie: oscillator doet niet. Er zit een eenvoudige oscillator in met eigen ELCO (47µ/25V) die na demontage ook lekkage vertoonde.

Oscillator ELCO (hoogspannings ELCO is al verwijderd)

Na het vervangen van deze ELCO: succes!

Twee defecte ELCOs

Meteen even een weerstandje in de voeding van de ventilator geplaatst zodat 'ie niet zoveel lawaai maakt.

Het resultaat

De hoogspannings ELCO is rood en dus steekt 'ie ook weer mooi af bij de rest...

Naschrift: Het betreft hier een Dell PowerConnect 2724 switch. Deze voeding (Delta ADP-40VP) wordt in de PowerConnect 27xx en 28xx series gebruikt. In de 28xx is er een ander type hoogspannings ELCO gebruikt die geen last lijkt te hebben van Capacitor Plague.

Detect public IP address change and send email

I really, really should stop scripting in VBscript. It is boo, boo and is already 10+ years replaced by Powershell. Having said that, I needed a simple method to detect a change on a dynamic assigned public IP address. 

Note: for the SendMail function check this post.

This is the script:

    on error resume next

    dim fso, wsh
    set fso = Createobject("scripting.filesystemobject")
    set wsh = CreateObject("wscript.shell")

    const key = "HKEY_CURRENT_USER\SOFTWARE\getPublicIP\publicIPaddress"
    if isnull(wsh.regRead(key)) then wsh.Regwrite key,"0.0.0.0", "REG_SZ"
    Err.Clear
  
    '--- Get public IP address...
    Set objHTTP = CreateObject("Msxml2.XMLHTTP")
    objHTTP.open "GET", "http://ipinfo.io/json", False
    objHTTP.send
    t = split(Cstr(objHTTP.responseText),chr(34))
    currentIPaddress = t(3)

    '--- Read previous IP address...
    previousIPaddress = wsh.regRead(key)

    '--- Compare and when changed, send email with new IP address...
    if currentIPaddress <> previousIPaddress then

        s = "Public IP address has changed." & vbCrLF
        s = s  & "Previous IP address: " & previousIPaddress & vbCrLf
        s = s  & "Current IP address : " & currentIPaddress & vbCrLf
        wscript.echo "Sending email:" &vbCrLf & s
      
        if sendmail(s) = 0 then
            wscript.echo "*** Succesfully sent email."
            wsh.Regwrite key, currentIPaddress, "REG_SZ"
            wsh.LogEvent 0,s
        else
            wscript.echo "*** Error sending email"
        end if  
      
    else
        wscript.echo "*** Public IP address not changed: " & currentIPaddress
    end if

The 2018 Aubade calender...

...is here...

April 2018

Month calendar with vertical outlined weeks

VBscript is still boo, boo but some things are really simple to build in VBscript. Here is a calendar program with vertical outlined weeks, week numbers and even consideration for leap years (until the year 2100).

Use:

 C:\Scripts\> cscript //nologo calendar.vbs MM-YYYY

--- 8< ---------------------------------------------

Function Print(s)

    if len(s)=1 then wscript.stdout.write " "

    wscript.stdout.write s & "  "

end Function

Datum        = wscript.arguments(0)

dayOfTheWeek = DatePart("w",datum)

weekNumber   = DatePart("ww",datum, vbSunday ,vbFirstFourDays)

ArrayStart   = dayOfTheWeek - ((dayOfTheWeek -1) * 2)

monthNumber  = Month(Datum)

WeekDays     = Array("Su","Mo","Tu","We","Th","Fr","Sa")

DaysInMonth  = Array(31,28,31,30,31,30,31,31,30,31,30,31)

monthNames   = Array("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec")

'--- Adjust values...

if DaysInMonth(monthNumber-1) + (dayOfTheWeek-1) > 35 then NuOfWeeks = 6 else NuOfWeeks = 5

if Year(Datum) mod 4=0 then DaysInMonth(1)=29

wscript.echo vbCrLf & "Calendar of: " & monthNames(monthNumber-1) & "-" & year(Datum) & vbCrLf

'--- Print weeknumbers

Print " "

for w = 0 to (NuOfWeeks-1) : Print (weekNumber + w) : next

wscript.echo ""

for w = 0 to (NuOfWeeks) : Print "--" : next

wscript.echo ""

'--- Print calendar...

Column = 0

for i = ArrayStart to ArrayStart + 6

    Print Weekdays(Column)

    Column = Column + 1

    for j = 0 to 5

        dayNumber = i + (j * 7)

        if (dayNumber >= 1) and (dayNumber <= DaysInMonth(monthNumber-1)) then Print DayNumber else Print " "

    next

    wscript.echo ""

next

 

Automatic emailing of your scanned documents

Some document scanners have the capability to send an email with the scanned document attached. Maybe your scanner can only store scanned files on a NAS, network share or in a folder on your computer. In that case, the next script will detect new scans and email them to you.

Yes, it is VBscript and that is boo, boo, as I mentioned before. However, the email method here, although deprecated, is also used by PowerShell users since it can deal with implicit SSL.

This post consists of two parts:
1. The script
2. A method to start the script automatically if the user is not logged on

The script

Copy & paste all the lines between the markers to Notepad or so and save the script as "MailScan.vbs". Then modify the Recipient with your email address. Modify the SMTP parameters. You might want to create a Gmail address specifically for sending scans. Finally, configure the folder where your scanner stores the scans.

--- 8< -------------------------------------
on error resume next

sub SendMail(Recipient, PDFfile)
 
    Dim objEmail
    Set objEmail        = CreateObject("CDO.Message")

    objEmail.From         = "scannername@yourdomain.com"
    objEmail.To         = Recipient
    objEmail.Subject     = "Scanned document from scanner {scannername/location}"
    objEmail.Textbody     = now() & ", this email contains a scanned document from scanner {scannername/location}: " & PDFfile

'--- When you host your own mailserver, use this:   
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing")             = 2
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver")         = "192.168.1.13" ' IP address of your emailserver
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpusessl")         = 0
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate")     = 1
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusername")        ="smtpaccount@yourdomain.com"
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendpassword")        ="{Password}"
    objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport")     = 25
   
'--- Or you can use Google's SMTP service:   
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusername")        = aGoogleAccount
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendpassword")        = theGooglePassword
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver")         = "smtp.gmail.com"
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpusessl")         = 1
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpauthenticate")     = 1
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing")             = 2
    REM objEmail.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport")     = 465

    objEmail.AddAttachment PDFfile
    objEmail.Configuration.Fields.Update
   
    objEmail.Send
    SendMail = Err
   
end sub

'--- Main ----------------------------------------------------------------------------------------------------

const emailReceipient = "your@email_addre.ss"
const intInterval = "5" 'check every 'intInterval' seconds for new file(s)...

dim fso
set fso=CreateObject("scripting.FileSystemObject")

'--- Split up the drive and the scan folder. Needed for WMI...
strDrive     = "M:"
strFolder    = "\\ProgramData\\MailScan\\"

wscript.echo "Scanning folder for files to arrive: " & replace(strDrive,"\\","\") & replace(strFolder,"\\","\")

'--- Set up event WMI handler...
Set objWMIService = GetObject( "winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2" )
strQuery =  _
    "Select * From __InstanceOperationEvent"                             _
    & " Within "                                     & intInterval         _
    & " Where Targetinstance Isa 'CIM_DataFile'"                         _
    & " And TargetInstance.Drive='"                 & strDrive &  "'"    _
    & " And TargetInstance.Path='"                     & strFolder & "'"
Set colEvents = objWMIService. ExecNotificationQuery (strQuery)

'--- Loop endless with an interval of 'intInterval'...
Do    
    Set objEvent = colEvents.NextEvent()
    Set objTargetInst = objEvent.TargetInstance

    Select Case objEvent.Path_.Class
        Case "__InstanceCreationEvent"
            f=objTargetInst.Name
            WScript.Echo "*** New file received: " & f
           
            wscript.echo "*** emailReceipient : " & emailReceipient
            wscript.echo "*** Filename: " & f
           
            '--- Check for PDF file and email that...
            if Instr(lcase(f),".pdf") > 0 then
                call SendMail(emailReceipient,f)
                wscript.echo "*** Emailing of PDF file done"
                if Err <> 0 then wscript.echo "*** Error sending mail. Errormessage: 0x" & hex(Err) & " - " & Err.Description
            end if   
           
            '--- You can delete the PDF file after emailing. Uncomment the next lines...
            'fso.DeleteFile f,true
            'wscript.echo "File deleted: " & f
    End Select
Loop
--- 8< -------------------------------------

Testing the script

To test if everything works fine we manually start the script:

  c:\Scripts> cscript //nologo MailScan.vbs

Make a scan, or just copy a PDF file in the scanfolder, and check the output on the screen. If all goes well you see:

Scanning folder for files to arrive: M:\ProgramData\MailScan\
*** New file received: m:\programdata\mailscan\manual_en - copy (2) - copy - copy - copy.pdf
*** emailTo : your@email_addre.ss
*** Filename: m:\programdata\mailscan\manual_en - copy (2) - copy - copy - copy.pdf
*** Emailing of PDF file ready

If there is an error sending the PDF you will see:

Scanning folder for files to arrive: M:\ProgramData\MailScan\
*** New file received: m:\programdata\mailscan\manual_en - copy (5).pdf
*** emailTo : your@email_addre.ss
*** Filename: m:\programdata\mailscan\manual_en - copy (5).pdf
*** Emailing of PDF file done
*** Error sending mail. Errormessage: 80040211 - The message could not be sent to the SMTP server. The transport error code was 0x80040217. The server response
was not available

The Windows Service

 

You want to have this service 24x7 available, even when you are not logged on to your computer. When we use script in a Windows Service we can run the script automatically in the background. We need a utility to configure this for you: the Non-Sucking Service Manager. Download NSSM here.

Start NSSM and configure the scan service:

  C:\Scripts> nssm install MailScan

Configure the next two tabs. Configure in "Arguments" the folder where the script is stored.

When all is entered correctly press the "Install Service" button. We can start the service:

  C:\Scripts> net start MailScan

Now make a scan and check your mailbox!

Powershell ROCA test

This Powershell script tests a TPM based Public Key for the ROCA vulenerability (CVE-2017-15361).

Based on: https://github.com/crocs-muni/roca/tree/master/csharp

Prequisites:
- Bouncy Castle crypto DLL (https://www.bouncycastle.org/csharp/index.html).
- Windows 8, 8.1 or 10 OS (e.g. a USB stick with Windows to Go)

The comments below explains how to create a TPM based Public Key file.

--- 8< --------------------
<#
    Date:             5-Nov-2017
    Description:     This script tests if a Public Key is vulnerable for ROCA
                    Use a TPM based CSR or CRT, extract the Public Key and test
    Prerequisite:    Bouncy Castle DLL (http://www.bouncycastle.org/csharp/)
   
>>> Create and extract a Public Key on Windows 8, 8.1 and 10 through a CSR:
(if a PC runs W7 or older or does note even have a hard disk, use Windows-to-Go from USB)

1. Create TPMCSR.inf
    --- 8< -----------------------
    [NewRequest]
    Subject = "E=IFXTPMVSC"
    KeyLength = 2048
    Exportable = FALSE
    UserProtected = FALSE
    MachineKeySet = FALSE
    Providername = "Microsoft Platform Crypto Provider"
    ProviderType = 1
    RequestType = PKCS10
    KeyUsage = 0x80
    KeySpec=1
    --- 8< -----------------------
   
2. Create CSR:
    C:\> certreq -new -f TPMVSC.inf TPMCSR.csr >nul

3. Extract Public Key with OpenSSL:
    openssl.exe req -in TPMCSR.csr -noout -pubkey -out TPMCSR.csr-pubk.pem   
   
4. Configure the filename in this script and run the script
    c:\scripts> powershell -file testROCA.ps1 TPMCSR.csr-pubk.pem   
    Vulnerable: True
   
>>> Using a TPM based certificate:
1. Extract the Public Key with OpenSSL:
    openssl.exe x509 -in TPMCSR.crt -noout -pubkey -out TPMCSR-pubk.pem   
   
2. Configure the filename in this script and run the script
    c:\scripts>powershell -file testROCA.ps1
    Vulnerable: True
   
>>> Example Public Keys:
Vulnerable Pubk:
    -----BEGIN PUBLIC KEY-----
    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQECWSe1K6XmjIySaLuSGPN2
    c2FMplQY9HRbFDzU7lP5SRyaDhwvI6lRYwav+/OGZ7hxvAzILmD1uxqfoVpWcadl
    yfIblYfYARWWQ3Kjg8iDsNy/bHdXBrMer/Pj/UiFWaCM3qIPmpfExZtrio7spFfU
    qCDUlQn3WTNjAryho2kLCAkYEfhY8ujOpaYjVa1uBB0ZNe2lkom1l2g7c+JleudL
    /8dg5NUTzIfbk1WRjqoI05i75faDXchxJSEbmzazoLxwuZOmyz99LLQGHec9uXLJ
    Qq35lVtv5M2Q8A0IiuwErx9e/5HyGvXtRGF8fbgJP5U2bbJlgMSvOZ3rlPmxQTBb
    4QIDAQAB
    -----END PUBLIC KEY-----

NOT vulnerable Pubk:
    -----BEGIN PUBLIC KEY-----
    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr2WWdhl/HbBtp6wRGgoO
    wXW4t+8HGS/80fa4VMMneF8af9PbfaRc1KMbKy5c4Ngjpo4oyK3xdHMWvszh/ldo
    BkA5rSBiJgyNGjTgWG3Om8EwkPzJ+4uLLAjtOujWGymBimaWiafZwdqwU7VX+40/
    nET6rT4YxV5zmwDTyRJlWLyOmAzSrzdxJu9bE3QTZ3S4vTcOPBwUnbOVyPmWlrYo
    sQWUb+ogEG/iTRA6wGJmGpJI6MP2KOALMI0zlTqr5VUTLiGOdO9LV4cWtP5880Do
    5gSjGb9umVHhlCYB00KRAy21SZnQnl0Dbd41RK01JWu7l9Xj//04Fmwh6ukZlUiF
    OwIDAQAB
    -----END PUBLIC KEY-----
#>

if ($args.count -ne 1) {
    cls
    write-host "*** Usage: powershell -file testROCA.ps1 {public key file}"
    Break
    }
   
$pubKfile = $args[0]
if (-not (Test-Path $pubKfile)) {
    write-host "*** File not found."
    Break
}
   
add-type -path ".\BouncyCastle.Crypto.dll"

[Org.BouncyCastle.Math.BigInteger[]] $markers = @(
            "6",
            "30",
            "126",
            "1026",
            "5658",
            "107286",
            "199410",
            "8388606",
            "536870910",
            "2147483646",
            "67109890",
            "2199023255550",
            "8796093022206",
            "140737488355326",
            "5310023542746834",
            "576460752303423486",
            "1455791217086302986",
            "147573952589676412926",
            "20052041432995567486",
            "6041388139249378920330",
            "207530445072488465666",
            "9671406556917033397649406",
            "618970019642690137449562110",
            "79228162521181866724264247298",
            "2535301200456458802993406410750",
            "1760368345969468176824550810518",
            "50079290986288516948354744811034",
            "473022961816146413042658758988474",
            "10384593717069655257060992658440190",
            "144390480366845522447407333004847678774",
            "2722258935367507707706996859454145691646",
            "174224571863520493293247799005065324265470",
            "696898287454081973172991196020261297061886",
            "713623846352979940529142984724747568191373310",
            "1800793591454480341970779146165214289059119882",
            "126304807362733370595828809000324029340048915994",
            "11692013098647223345629478661730264157247460343806",
            "187072209578355573530071658587684226515959365500926"
)

[Org.BouncyCastle.Math.BigInteger[]] $primes = @( 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167 )

[System.IO.TextReader] $reader = [System.IO.File]::OpenText($pubKfile)

[Org.BouncyCastle.Crypto.Parameters.RsaKeyParameters] $rsaKeyParameters = [Org.BouncyCastle.OpenSsl.PemReader]::new($reader).ReadObject()

$isVulnerable = $true
for ($i=0; $i -lt $primes.length;$i++)
{
    if ([Org.BouncyCastle.Math.BigInteger]::One.ShiftLeft($rsaKeyParameters.Modulus.Remainder($primes[$i]).IntValue).And($markers[$i]).Equals([Org.BouncyCastle.Math.BigInteger]::Zero))
        {
            $isVulnerable=$false
            break
        }
}

write-host "Vulnerable ($pubKfile):" $isVulnerable