cheet

joined 1 year ago
[–] cheet@infosec.pub 5 points 1 week ago

And if you have lots of windows machines at home, running enterprise for whatever reason, dont look up vlmcsd and definitely dont look up the kms srv records to put on your home domain

[–] cheet@infosec.pub 3 points 2 months ago

Youre talking about Linux containers on Windows, I think commenter above was referring to windows containers on Windows, which is its own special hell for lucky folks like me.

Otherwise I totally agree. Ive done both setups without docker desktop.

[–] cheet@infosec.pub 7 points 2 months ago (2 children)

Windows container runtime is free as well, simply install the docker runtime from chocolatey or winget along with the Windows Containers and Hyper-V windows features. This is what we do on some build machines for CI.

Theres no reason to use desktop other than "ease of use"

[–] cheet@infosec.pub 1 points 6 months ago (1 children)

Oh I'll have to check that out I thought I read something about that method being patched.

Tho I do like just booting a new install and its already activated automatically :P

[–] cheet@infosec.pub 1 points 6 months ago (3 children)

if you're in the know, check out vlmcsd on github and "test" windows enterprise with KMS. It can run on everything from a pi, to docker, to openwrt. If you're really gangster, you can set up SRV records and get auto activation on your lan

[–] cheet@infosec.pub 14 points 6 months ago (2 children)

Holy shit, that's actually hilarious, I imagine someone would have noticed when their paste/auto type password managers didn't work

For those confused, this sounds like instead of making a real website, they spin up a vm, embed a remote desktop tool into their website and have you login through chrome running on their VM, this is sooooo sketch it, its unreal anyone would use this in a public product.

Imagine if to sign into facebook from an app, you had to go to someone else's computer, login and save your credentials on their PC, would that be a good idea?

[–] cheet@infosec.pub 1 points 6 months ago* (last edited 6 months ago)

I think you could boil it down to something like Set-ADUser bob -otherattributes {uidNumber=1005, gidNumber=1005}

[–] cheet@infosec.pub 1 points 6 months ago (1 children)

sorry I don't have any real documentation but I have a snippet of powershell that explains it pretty well here this comes from a user creation script I wrote back when they removed the unix UI.

I was using Get-AdUser and discovered that the properties still existed but you have to manually shove those in, when an sssd "domain bound" linux machine has a user with these props login, they get the defined UID and GID and homefolder etc.

$otherAttributes = @{}
Write-Host -ForegroundColor Yellow "Adding Linux Attributes"

# get the next numeric uid number from AD
$uidNumber=((get-aduser -Filter * -Properties * | where-object {$_.uidNumber} | select uidNumber | sort uidNumber | select -Last 1).uidNumber)+1

$otherAttributes.Add("unixHomeDirectory","/homefolder/path/$($samAccountName)")
$otherAttributes.Add("uid","$($samAccountName)")
$otherAttributes.Add("gidNumber","$($gidNumber)")
$otherAttributes.Add("uidNumber","$($uidNumber)")
$otherAttributes.Add("loginShell","$($loginShell)")

$UserArgs = @{
    Credential = $creds
    Enabled = $true
    ChangePasswordAtLogon = $true
    Path = $usersOU
    HomeDirectory = "$homeDirPath\$samAccountName"
    HomeDrive = $homeDriveLetter
    GivenName = $firstName
    Surname = $lastName
    DisplayName = $displayName
    SamAccountName = $samAccountName
    Name = $displayName
    AccountPassword = $securePW
    UserPrincipalName = "$($aliasName)@DOMAIN.COM"
    OtherAttributes = $otherAttributes
}

$newUser = New-ADUser @UserArgs

basically the "OtherAttributes" on the ADUser object is a hashtable that holds all the special additional LDAP attributes, so in this example we use $otherAttributes to add all the fields we need, you can do the same with "Set-Aduser" if you just wanna edit an existing user and add these props

the @thing on New-ADuser is called a splat, very useful if you're not familiar, it turns a hashtable into arguments

lemme know if you have any questions

[–] cheet@infosec.pub 4 points 6 months ago (1 children)

I like ydotool, uses a systemd user service, but fulfills my needs of KB shortcuts to paste text into vnc sessions

[–] cheet@infosec.pub 6 points 7 months ago (3 children)

Microsoft pulled those from the UI, but if you're adventurous you can just shove those attributes in to user with power shell and it works the same.

Then just use sssd instead of NIS, surprised me at work when this worked.

[–] cheet@infosec.pub 4 points 9 months ago

What a great series that is, I should get the kit

[–] cheet@infosec.pub 10 points 9 months ago (1 children)

The thing is, if there's a wireless exploit/hack that can cause "patient harm" the FDA+Health Canada would force a recall the sec its publicly known.

The flipper wouldn't be the only thing able to exploit it, anybody with a radio and some software would be able to. It just so happens the flipper can also do it cause its a swiss army knife and has a general purpose radio.

Generally by the time an attack exists on the flipper, its already been mastered on laptops and raspberry pis and stuff, putting it on the flipper is more to make it available to test easily without having to lug out the laptop. Nobody is inventing new exploits for such underpowered hardware as the flipper. People are porting known exploits to it.

I can't say how concerned you should be, but this won't make her any safer than before, equal risk. Just as likely someone with a laptop in a backpack doing that. We don't make laptops illegal tho.

What I would be concerned about is the idea that the company that makes the implant would not be able to easily test for issues in the implant with such an "illegal" device. Yes they could use a laptop, but you don't use an xray machine to find a stud, you use a handheld studfinder cause its cheap and easy.

Hope that helps explain a bit

view more: next ›