All posts by bsdman

Currently working as an IT Manager. Worked for an OIT company as a Network Engineer in 2011. Worked for a Medical IT company as the Network Administrator 2009-2011. Worked as the Senior Systems Administrator at a computer reseller from 2005-2009. Worked as a Computer Consultant for several small companies from 2007-2009. Worked as a Computer Technician at a computer reseller from 2002-2004.

PDF Exploits

I usually don’t do this, but since not all the information seems to be in a single spot I’m compiling a bit.

Adobe released the following:
http://www.adobe.com/support/security/advisories/apsa09-01.html

A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe is planning to release updates to Adobe Reader and Acrobat to resolve the relevant security issue. Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Updates for Adobe Reader 8 and Acrobat 8 will follow soon after, with Adobe Reader 7 and Acrobat 7 updates to follow. In the meantime, Adobe is in contact with anti-virus vendors, including McAfee and Symantec, on this issue in order to ensure the security of our mutual customers. A security bulletin will be published on http://www.adobe.com/support/security as soon as product updates are available.

All documented security vulnerabilities and their solutions are distributed through the Adobe security notification service. You can sign up for the service at the following URL: http://www.adobe.com/cfusion/entitlement/index.cfm?e=szalert

It affects all versions of Adobe’s Acrobat (Pro, Standard, and Reader) version 9, 8, 7, and potentially 6/5. Currently the exploit uses JavaScript to call on memory that hasn’t been allocated properly and causes exceptions and an application failure. So, at a minimum, this exploit will crash out your Adobe Acrobat. At a maximum, it can open up your entire system to “bad things”. The exploit in the wild, as of right now, only uses javascript. Therefore, one can simply follow these steps:

Open Adobe Acrobat Reader (version 8 or 9)
Click Edit >> Preferences
Scroll down to JavaScript and uncheck Enable Acrobat JavaScript
Click OK

Or if you would prefer to use registry keys (and if you’re like me and use GPO’s to deploy the registry key imports at startup) here they are:

Add the key HKCU\software\adobe\acrobat reader\x.0\JSPrefs
Add a DWORD "bEnableJS", set value to 0
also make sure you look in HKCU\software\adobe\adobe acrobat\.. as well. The same thing applies to all versions.

It should be noted that JavaScript is merely used as the compiling tool in this case. Without JS enabled, the exploit STILL EXISTS, it’ll just be harder (in theory) to write for.

ESXi Enable SSH

This is one of those topics that is very easy to find on google, but I’m posting anyway.

Go to the console of your VM ESXi machine
Press Alt + F1
The password is “unsupported”
vi /etc/inetd.conf
Find the #SSH, and move the cursor over the #
x
X will delete the character under the cursor. i for insert before cursor. r for replace the current character with the character typed next.
:wq
: puts the vi editor into the command mode, w for write, q for quit.
Reboot your server

Reprogram Your ATT Phone

I don’t recommend doing this as it may actually make your phone unusable. I recently acquired an iPhone (November 2008) and have been itching to mod it a little bit. No, I haven’t tried the jailbreak technique as I prefer to keep everything simple on my phones. But as soon as the warranty is up, you betcha.

Anyway, I just signed up for a service called TrapCall (TrapCall.com) and it required me to setup my phone to do automatic forwarding of voicecalls. So I decided to write down the steps required to undo and redo this setup (in case this company goes bye bye).

Program:
All you have to do is dial *004*18669676590*11# and hit SEND!

Unprogram:
All you have to do is dial ##004# and hit SEND!

That got me to thinking, what if I typed in 1800XXXXXXX*11# instead? Can I actually get this to forward anywhere I want? That’s pretty cool actually.

Format Large HD FAT32

If anyone has done disk backups using the DOS Ghost client (or other DOS based clients) you have probably had some issues with NTFS. Don’t get me wrong, NTFS is a pretty decent file system, but FAT32 is noticeably more compatible.

Getting a drive that’s NTFS to work on DOS/MAC/Pre-Windows 98/Linux is sometimes a PITA.

Most external drives come preformatted as FAT32 for this very reason. If you need it NTFS that’s no big deal – just open up the disk manager in Windows and blast away (diskmgmt.msc). Windows, however, has a limit on formatting for FAT partitions: 32GB. Whoopie.

The easiest way is to use a disk formatting utility (Hiren’s has some good ones on there). The second easiest is to use DOS style commands.

Start
Run
CMD
format /FS:FAT32 G:
Y

The command can be broken down as follows:
Format – this is the actual command
/FS:FAT32 – Filesystem Fat32
G: – the drive letter of the drive you want to reformat

***EDIT***
Apparently you can also use several freeware programs. One that was given to me is called Swissknife.

VMWare HA ESXi

I’ve been reading a ton about high availability servers. A ton. And since we’ve been using the vmware free servers since 1.0, I guess it’s about time to get caught up on them again.

VMWare server 1.* was great – it’s free, ran reasonably well, and is free. The problem, however, was no native 64bit support, horrible RAM management, and no USB 2.0 support.

Welcome to VMWare server 2.*. Runs fairly well, is still free, and has 64bit support. No other options/features though.

So then I wanted to dabble in with HA – I need ESX right? ESX server costs money. My budget is pretty low at the moment so not-free is out of the question.

ESXi is free, however, so we’ll use that. Unfortunately you need to have at least 3 full-time servers for this to work (1 as a server manager, 2 as the mirrored servers)

First, download ESXi 3.5.*.
Then, burn the image to a CD
Load said CD into a server
Install on said server
Repeat on at least one other server

You should now have two fully functioning ESXi servers.

On your third server, install some version of Windows. I know, I know, windows blows. But in this case it’s not bad. Hard to break windows if you only use it for 1 single purpose. I ended up installing a VL version of Windows Server 2003 Enterprise R2 SP2.

Then, here’s where it gets a little expensive, you need to acquire a copy of VMWare Infrastructure. And by little expensive I really mean you should buy some lube to prepare for the… nevermind.

Without Infrastructure you cannot HA your vmware machines.

Install Infrastructure.

Tricky part: DNS settings. If you have only a few virtual hosts, you may as well hand edit your DNS hosts settings. If you have several hundred, a DNS server is more handy.

Power on one of your VMWare ESXi servers – then press alt + F1
Now type in “unsupported” without the quotes
Then type in your root password when prompted

vi /etc/hosts
Shift + I
Scroll down to the last line, hit enter to start a new line, and then type in your OTHER server’s IP information:
192.168.2.101 host2.localdomain host2
:wq!

Test the settings by pinging the host:
ping host2
If you get a response that’s a good thing. No response is a bad thing.

Now, do the same thing on the other host:
Press alt + F1
Now type in “unsupported” without the quotes
Then type in your root password when prompted

vi /etc/hosts
Shift + I
Scroll down to the last line, hit enter to start a new line, and then type in your OTHER server’s IP information:
192.168.2.100 host1.localdomain host1
:wq!

Ping test once again and it should work just fine.

Then, and only then, do we start to work on the infrastructure side of things.

Create a new datacenter
Right-Click and create new cluster. I’m choosing HA.
Right-Click and add a host. Type in the IP of the first host and root/password.
Right-Click and add the second host using the same method.
Infrastructure should automatically add them to the HA area.

Reset Cisco IP Phone

Reset the 7940 and 7960 IP Phones to the Factory Default

In order to perform a factory reset of a phone if the password is set, complete these steps:

1. Unplug the power cable from the phone, and then plug in the cable again.
The phone begins its power up cycle.

2. Immediately press and hold # and while the Headset, Mute, and Speaker buttons begin to flash in sequence, release #.
The Headset, Mute, and Speaker buttons flash in sequence in order to indicate that the phone waits for you to enter the key sequence for the reset.

3. Press 123456789*0# within 60 seconds after the Headset, Mute, and Speaker buttons begin to flash.
If you repeat a key within the sequence, for example, if you press 1223456789*0#, the sequence is still accepted and the phone resets.
If you do not complete this key sequence or do not press any keys, after 60 seconds, the Headset, Mute, and Speaker buttons no longer flash, and the phone continues with its normal startup process. The phone does not reset.

If you enter an invalid key sequence, the buttons no longer flash, and the phone continues with its normal startup process. The phone does not reset.
If you enter this key sequence correctly, the phone displays this prompt:

Keep network cfg? 1 = yes 2 = no
4. In order to maintain the current network configuration settings for the phone when the phone resets, press 1. In order to reset the network configuration settings when the phone resets, press 2.

If you press another key or do not respond to this prompt within 60 seconds, the phone continues with its normal startup process and does not reset. Otherwise, the phone goes through the factory reset process.

Exchange 2007 Not Reading All DCs

When people install programs without fully realizing what they are doing, bad things tend to happen. Installing Exchange can be a tedious process – it has so many prerequisites that it can take several hours just to get to the point that exchange actually starts to install.

As we all know, Exchange 2007 requires a 64bit operating system. At least it’s required in a production environment since Microsoft will not support 32bit 2007 servers. We also know that Exchange 2007 does not read from the Global Catalog if the GC is running on a Windows 2000 Server. The newest Exchange requires a minimum of 2003 standard in order to read fully from Active Directory. And we all know that AD is required for Exchange to be happy. These are things we know.

If you open the Exchange Management Console and navigate to Server Configuration. In the main reading pane you should see your Exchange Server(s). Right click on your Exchange Server and select properties. The bottom two text boxes will show you the current Domain Controller(s) and Global Catalog(s). If you have more than one Domain controller and Exchange is only showing one, you have a problem.

First thing to check is always the Eventviewer. Check the eventvwr!!!
Second thing to check is if you can ping your DC from the Exchange Server, and that you can ping your Exchange Server from your DC.
Third thing is to run the command “dcdiag” on the DC not showing up in Exchange:
Start - Run - CMD - dcdiag - press enter
IF all of those pass with flying colors, you can add the DC and GC manually to Exchange using the PowerShell.

PowerShell Fix Steps:

On the Exchange Server, open the Exchange Management Shell.
set-exchangeserver -identity Name_Of_Server -staticDomainControllers ‘dc.domain.com’, ‘dc2.domain.com’
set-exchangeserver -identity Name_Of_Server -staticglobalcatalogs ‘dc.domain.com’, ‘dc2.domain.com’

IMPORTANT NOTE!!!
the Name_Of_Server MUST BE the name of your server. If you named it exchange07, use that name!
the ‘dc.domain.com’ MUST BE the FQDN Fully Qualified Domain Name of your server. If the servername is exchange07, the FQDN would be something like exchange07.mydomain.local!

Then recheck in the Exchange Management Console to verify that the GC and DCs are properly imported.

If you ever need to remove the additions:
get-exchangeserver -identity Name_of_server -staticdomaincontrollers $NULL
get-exchangeserver -identity Name_of_server -staticglobalcatalogs $NULL
After roughly 15 minutes, the “real” GC and DC’s should be populating. If not, check the eventviewer!