Random Musings - Day #356

Well couple days off and should do some shopping but that's hardly happening.
For now some computer links that may have put on in the past year...

LSA is the Local Security Authority. According to Microsoft, "LSA Authentication describes the parts of the Local Security Authority (LSA) that applications can use to authenticate and log users on to the local system. It also describes how to create and call authentication packages and security packages."

You come dump lsa secrets (which doesn't allow access from the administrator) using oxid.it's abel or nirsoft's lsasecretsdump.

The security identifier (sid) is Microsoft's way of uniquely defining things. Here's some well known SIDs.

LMHash is an old school Microsoft format that should be stopped and later editions of Windows do not have by default.

Random Musings - Day #255

Unbelievably, Serena Williams erupted on a line decision at 15-30, losing the point which made it 15-40. Consequently, she confronted and abused the line judge and earned a penalty point, which gave Kim Clijsters, the game, the set and match.

I didn't know that a supergroup of divas is forming for Christmas. Here comes the (old) girls features the talents of Lulu, Chaka Khan and Anastacia. The first two are coincidentally in the Thank you for the music concert in Hyde Park.

Apparently, you can disable LMHASH with nolmhash value of "HKLM/SYSTEM/CurrentControlSet/Control/Lsa". This is opposed to the previously mentioned "LMCompatibilityLevel".

Don't forget the port numbers and ascii table

Random Musings - Day #247

The Security Accounts Manager (SAM) can be stored in LANMAN hash and/or NTLM. LANMAN makes passwords brute-force attacks easy if the SAM is retrieved.

There is a registry setting to look for under "HKLM\System\CurrentControlSet\Control\LSA", there is a key "LMCompatibilityLevel" which has acceptable range of 0-5. 0 is usually default, which means all hashing is acceptable. You should really set it to 4 or 5. Microsoft discuss this on their support site

More useful links include: arp-scan, introduction to steganograhpy, XSS in the Cisco Ironport and how to look up reverse zones for ip addresses in DNS.

The well known SMB vulnerability ms09-001 does have POC exploits but they only crash the concerned system best demonstrated by 4xunderground.