Security on Remko's Blog

Blog improvements

Tue, 07 Feb 2017 15:56:21 +0000

When I started this blog in 2007 (wow that’s almost 10 years ago) I went for a cheap web hoster with a reasonable performance to host it.

In the beginning performance was acceptable but over the years it has degraded and of course user experience standards have changed.

I decided it was time to do something about it so I’ve moved the blog from a shared platform to my own server.

This server is running on optimized flash storage where most writes are DeDuplicated and never actually hits the flash disks:

Shodan, search engine for IoT or hackers delight?

Sat, 14 May 2016 15:36:22 +0000

Today I stumbled upon Shodan, a search engine for devices and services.

I decided to search for Citrix and this was the first page of results:

It's interesting to see that we get details such as the name of published applications. But it's possible to get even more details:

Dumping passwords in a VMware .vmem file

Mon, 25 Nov 2013 08:54:34 +0000

Benjamin Delpy the author of the well known mimikatz toolkit has released a very cool extension to WinDbg today.

In summary the extension can extract Windows passwords from memory dumps, hibernation files and Virtual Machine .vmem files (paging, snapshots).

Especially the ability to extract passwords from .vmem files was very interesting. So I decided to to test this out, so let's see how it works!

Scriptable Citrix Password Encoder

Tue, 19 Mar 2013 16:27:49 +0000

A while ago I published a tool to Encode and Decode Citrix passwords. Today I am publishing a small update to this tool that makes it scriptable by adding a COM interface.

If you start the tool without parameters you will get the GUI, just like before:

To use the COM interface you first need to register the executable with the /regserver switch:

After the registration you can call it using any language that supports COM. To get you started I wrote a few examples

Java has discovered application components that could indicate a security concern

Tue, 19 Mar 2013 13:13:04 +0000

When starting a particular web based application Java popped up the following dialog:

The dialog asks us if we want to Block potentially unsafe components so to continue we should click no. However users tend to not really read such messages and click Yes which leads to this error:

Settings NTFS Permissions by SID in PowerShell

Fri, 02 Sep 2011 17:21:42 +0000

I am currently creating a PowerShell script that creates a user with all needed Active Directory attributes, Exchange mailbox, (TS) Home- and Profile directories and so on.

In such a script you can easily get failures because of Active Directory replication.