The DMZ

Mark Buffalo

21:01

@Ohnana Well he isn't Chuck Noris

Xander

21:41

Oh. Yays. 20K. Finally. Unfortunately it came on my 257th answer. So close.

JukEboX

My questions never get answered :(

MickLH

That's the price of your answers never being questioned.

diagprov

@MarkBuffalo Because the NSA already hired them?

Xander

@JukEboX Well, you should ask easier questions, maybe.

Iszi

@MarkBuffalo I wanna see the FBI take him up on it. And then sue his ass when he either gets the thing permanently locked/wiped or ends up missing the deadline. Or both.

JukEboX

21:47

@Xander I though basic access to a c$ share was easy enough. I thought everyone on SE was WAY smarter than me. THey all act like it

Xander

@JukEboX "Act" is the key word there.

Ohnana

Well, your question is now on SU where they're actually good at system stuff

Xander

@JukEboX Is there anything in logged in the security event log when access is denied?

Iszi

@Ohnana Know what's great? With that post, and as much as I'm sure it'll be cross-pollinated in short order, he's got a lovely little self-fulfilling prophecy right there.

JukEboX

Yes Xander

Ohnana

21:50

@Iszi yeah i realized that a little while after

fucker.

JukEboX

@Xander Event 4656 An handle to an object has been requested - Audit Failure

Xander

@JukEboX Ah, sorry, I missed that on reading your question first time through. I see it now.

JukEboX

@Xander am I missing something stupid. I have double checked it at least 20 times by now. I mean I know I am not a newb at this stuff. been doing it for almost 2 decades

Iszi

Nothing more in that event that says why it was a failure? Usually there should be.

JukEboX

@Iszi let me check. Looking for anyting specific

It does say Write Data (or AddFile: not Granted

Write EA: Not granted

Write Attributes: not granted

Object is Compmgmt.msc

Iszi

21:56

Hang on. Lemme find a local example for my reference.

JukEboX

process is mmc.exe

It also says "Privileges Used for Access Check: - "

Iszi

Huh? Doesn't sound like something you'd be trying to get into C$ with.

JukEboX

That is the weird part

With all the other machines on the domain it opens an explorer window when I do \\computer\

this one gives me a security box and says Access Denied

When I put in my account info it throws a 4656 Audit Failure

I mean Security Event

Iszi

You're sure the event is from that action, and not something else? No other audit failures nearby? All other relevant logging is enabled?

JukEboX

Yes. That is the only AUdit Failure in that time span. Let me sanitize it and I will show you

O'Niel

22:02

Does it have any benefit in your learning process, to get tests/exams about SQL on paper instead of Notepad?

JukEboX

That is event 4656 that it gives me when I try to login

I know that is the only one because it has my username on it.

Iszi

Hm.

Ohnana

@O'Niel no cheating

Iszi

Double-checked all local security groups, and User Rights Assignments against a known-working system?

Ohnana

paper exams make me sad though

O'Niel

22:04

@Ohnana besides that, none? Thanks.

JukEboX

@Iszi I did find 2 other events. 1 for a special login success for me. ANd 1 for a logoff for me all within the same like 30 milliseconds

@Iszi both computers are using the exact same group policy

Iszi

@JukEboX Yeah, but did you double-check what's actually in effect, on each setting? Group Policy can get effed up in weird ways sometimes.

JukEboX

@Iszi check using rsop or just straight GPEDIT? Justing what? User rights assignments?

Iszi

I usually just peek in secpol.msc.

David Freitag

Sometimes windows pisses me off to no end

Someone installed Firefucks and forgot to uncheck all of the "yes, please install this malware"

JukEboX

22:08

@DavidFreitag ooo I hate that >_<

David Freitag

And now I can't delete it despite the fact that I'm a fucking administrator.

JukEboX

@Iszi let me check

Iszi

@JukEboX I'm actually trying to troubleshoot something that may end up not too dissimilar. Got one scanner that can't do credentialed scans with domain credentials for some reason all of a sudden (used to work fine), but manually performing the same things that the scanner needs for its scans works fine and all our other scanners work fine.

Rory Alsop

@Xander yay - congratulations

David Freitag

> I'm sorry, but I don't know why it doesn't work the same for you as it does for me.

Ready to shove that up every windows power user at this point.

Iszi

22:11

Rory Alsop

@Iszi is that an approved security icon?

JukEboX

@Iszi my audit software uses this to copy the logs and because of this issue it won't pull a copy of the log off the machine

David Freitag

It will let me change permissions with icacls in safe mode but it still won't let me delete

Iszi

Speaking of Windows auth issues... Someone 'splain to me why Wireshark is excluding the final response from a filter of "NTLMSSP"?

David Freitag

Seems to me like all of these "safety features" windows has are really for malware developers to leverage so that once their malware gets installed it's impossible to remove.

JukEboX

22:13

@Iszi just double checked against working machine. THey are the same

@DavidFreitag that is what Malwarebytes if for. To clean your messy room.

David Freitag

I'm so fucking done with windows right now

JukEboX

@Iszi what really confuses me more is that with "net use" I can connect to the share but with explorer I can't using the local domain account

Iszi

Hm. Are you sure C$ is even there? (Seriously. Seen it happen.)

Oh, well that answers that.

JukEboX

@Iszi yes because I am remoted to the offending machine through RDC as well

Iszi

@JukEboX Probably not your problem, but if you NET USE from the client you're having trouble with right now is the share mapped at all (with or without drive letter) or are there any other shares to the same system that are mapped?

JukEboX

22:17

@Iszi if I NET USE to offending system from working system using the local user account it says successfully accessed. If I NET USE to offending system from working system using my domain admin account it says error code 5 access denied

Iszi

I mean, if you run NET USE (no arguments) from the remote system to the problem system, do you see anything already mapped to the problem system?

'Cause Windows will pitch a fit if you try to connect to the same system with two different credential sets from one system.

JukEboX

Actually sorry with the local admin account it says access denied

And no using a working system there are no shares on any of them. But I can access their c$ share

Xander

@RoryAlsop Thanks! :-)

Now 5K more to go for my final privilege.

Mark Buffalo

@DavidFreitag You must take ownership of the files and or folders, and you must do so recursively

Iszi

I dunno, man. Still trying to troubleshoot my own thing and having about as much luck. Scanner generates a failed logon attempt - bad username or password - whenever it tries to connect, but a manual connection with the same credentials (re-entered to the scanner several times to be sure) works just fine. And scan engines on other systems don't have the same problem.

Mark Buffalo

22:21

Icacls will not work

JukEboX

@Iszi is the scanner using a service account or service with a user account?

Iszi

@JukEboX Scanner uses whatever credentials I provide in the scan config.

JukEboX

Does your audit logs show access denied or failure?

Rоry McCune

@Xander so you might say you're on the countdown... to something final....

Europe - The Final Countdown (Official Video)

►

Iszi

@JukEboX Logon failure, bad UN/PW.

Xander

22:24

@RоryMcCune Ha ha.

Rоry McCune

any excuse for a bit of classic Europe!

Rory Alsop

@RоryMcCune that hair!

Rоry McCune

Hair Metal FTW!

Rory Alsop

@RоryMcCune that's the main reason my mask has all the cyberlox attached

Mark Buffalo

Back then, everyone looked so plain.

Iszi

22:26

@JukEboX And trust me, if a bad UN/PW was really the problem we'd have it fixed.

Rory Alsop

so I can haz hair metal

Mark Buffalo

I like that

Xander

@RоryMcCune Since you're not in the U.S., you may not have seen this then.

Countdown ft. Europe: It's What You Do - GEICO

►

Rоry McCune

@Xander lolz, well I guess everyone's gotta get paid!

Iszi

@Xander Heh. Yeah. That one.

Rory Alsop

22:28

@Xander "and my name is Mic..."

Iszi

Van Canto - The Final Countdown (Lyric Video)

►

JukEboX

argh this is updsetting

Iszi

@JukEboX Don't you mean udpsetting?

(Although, we are working over TCP.)

JukEboX

yup

Iszi

Damnit. Somebody told me this thing was only failing on domain credentials. Local credentials fail too.

Same error - bad UN/PW.

David Freitag

22:42

@MarkBuffalo Yeah like I haven't tried that 300 million times

Iszi

Another scanner is running just fine with the exact same credentials.

JukEboX

@Iszi same here

Iszi

Double-checked time-sync? I just did. No help there.

(Wasn't really expecting to find a problem. Still, one can hope.)

JukEboX

@Iszi just shared the C drive to EVERYONE and it is still throwing a "Access Denied" error at me

David Freitag

Yay fuck you windows and your permissions nightmares.

Iszi

22:54

@JukEboX What's weird with yours is that you're not seeing any Logon events nearby that are failing. So for you it's (presumably) some sort of permissions issue.

JukEboX

@Iszi if that were the case my account would be locked out after 3 times but it isn't

Iszi

Me, there's something weird borking the credentials in transit so far as I can tell.

@JukEboX Could be wrong, but I think logon failures only lockout for bad UN/PW. It won't kill your account over permissions or other weird stuff.

JukEboX

oh

Mark Buffalo

Windows permissions are bad. But you're doing it wrong

JukEboX

@MarkBuffalo I am?

David Freitag

22:58

Thank god for FileASSASSIN

But since it only works on one file at a time it's pretty useless

JukEboX

@DavidFreitag I was always a fan of KILLBOX

David Freitag

for /r %f in (*.*) do "C:\Program Files (x86)\FileASSASSIN\FILEASSASSIN.exe" /assassinate /silent %f

That did the trick though ^

Also, it's a bit crap that FileASSASSIN doesn't work on folders

kalina

diskpart

Iszi

Stupid Q: Is it not possible (or just not a good thing) to have two instances of Wireshark open, looking at two separate, previously-saved PCAP files?

Or is it maybe just that one of the ones I'm looking at is >100 MB?

David Freitag

@Iszi Stupid A: wut

kalina

23:06

yes

Iszi

I'm going with B: "Yo filez too damn big!"

David Freitag

@Iszi I've done that before with no issues.

TildalWave

yeah dunno what he's talking aboot

Iszi

@DavidFreitag Yeah, but you don't know the POS I'm on.

David Freitag

@Iszi I don't care about what starbase you're on.

TildalWave

23:08

@Iszi are you sure one is not in capture mode?

Iszi

Holy mother-F. I knew I should have just cut the scan off after the login attempt, instead of capturing the whole damn thing.

David Freitag

@Iszi Well there's your problem

Mark Buffalo

Damn

I need a new car

This is bs.

David Freitag

@MarkBuffalo You didn't already know that?

FFS I just want to install dotPeek

I mean, at least the installer is real pretty

TildalWave

so I tried Bioshock (the original one) at toughest level and damn that's hard, where's the bloody ammo??

I thought oh since I beat the shit out of it like 20 years ago doing it again and spicing things up will be easy

kalina

23:13

the ammo is found by not propelling so much of it at walls

David Freitag

But did you see that wall move?! I had to be sure.

TildalWave

I swear I don't

I'm like really really trying to save it

kalina

the ammo is found by not propelling so much of it at armor

TildalWave

I don't do that either, and I have the armor mod

AviD

@kalina don't I what

kalina

23:15

do you even read

it's like the line above

AviD

run as admin?

I think I missed some context.

are we talking about exploits, or just regular usage?

kalina

clearly

AviD

cuz thats just silly.

kalina

we're talking about your face

TildalWave

rekt

David Freitag

23:16

@kalina Is that why I went blind?

AviD

ah of course.

then yes.

JukEboX

@Iszi I found something interesting

HI @kalina

kalina

I am the interesting something you found?

David Freitag

This recent trend of using spinny wheel loading bars instead of proper progress bars is annoying.

kalina

I am not happy about being referred to as a thing

Iszi

23:18

@JukEboX Eh?

kalina

@DavidFreitag pls throbbers 4 lyfe

David Freitag

@kalina Throbbers? Is that like a sex toy manufacturer?

JukEboX

@Iszi When I went to User Accounts in Control panel to check UAC it didn't open. It will not open at all. Sounds to me like corrupt windows install

kalina

no that's what the spinny things are called

JukEboX

@kalina you have always been an interesting thingy

kalina

23:19

Throbber

A throbber is an animated graphical control element used to show that a computer program is performing an action in the background (such as downloading content, conducting intensive calculations or communicating with an external device). In contrast to a progress bar, a throbber does not convey how much of the action has been completed. == Typical characteristics == Usually the throbber is found on the right side of a program's toolbar or menu bar. The form the throbber takes varies, but it is common for it to be the logo of the program it is part of. Most of the time the throbber is a still image...

TildalWave

I'll get popcorn

JukEboX

Either that or you have interesting thingies

David Freitag

@JukEboX What, a female?

kalina

hey I don't like where this conversation is going

let's talk about throbbers instead

JukEboX

Throbbers thingies? @kalina

Iszi

23:20

@JukEboX Hm. Could be. Really hoping that's not the case for me.

David Freitag

I bet @kalina likes it when the throbbers throb.

@Iszi @JukEboX sfc

kalina

oh yes if throbbers don't throb then it's most likely some kind of bandwidth problem

JukEboX

@DavidFreitag already started

David Freitag

Yeah I've got some serious bandwidth problems.

JukEboX

@DavidFreitag you mean when the thingies throb?

Iszi

23:22

@kalina I hear they make pills for that.

kalina

@Iszi probably, I wouldn't know

David Freitag

@Iszi Yeah but they're just sugar pills

JukEboX

@kalina @DavidFreitag I agree with you though. BUt it would make more sense if people actually made loading bars that actually showed the real status. Windows ones just start over whenever they feel like it

SFC found nothign

kalina

there's nothing wrong with throbbers

if your application takes more than a couple of seconds to load then it sucks anyway

Mark Buffalo

@kalina Is that a euphemism?

kalina

23:26

hello mister late to the party

it's ok we can go over last minute's jokes just for you if you'd like?

Mark Buffalo

@kalina Is that a euphemism?

kalina

there's no intrigue if you know for sure

Iszi

Damn. Friggin' load time for this PCAP is >15 minutes with a filter.

kalina

I would love you and leave you, but I don't love you... so... bye...

AviD

@kalina did I miss something again?

a whole lot of somethings.

kalina

23:30

yes I decided to go to sleep

-.-

AviD

@kalina gnite! sweet dreams!

kalina

pls I don't dream

well...

what I dream about the rest of you wouldn't call dreams...

people screaming for mercy and dying, fires everywhere, faces exploding, aliens...

Iszi

@kalina No, the proper response is: "You're a sweet dream!"

Thomas Pornin

Eurythmics - Sweet Dreams (Are Made Of This) (Official Video)

►

AviD

o_O

@kalina and llamas?

Iszi

23:46

Well, I'mma have to give up on this one for now. Catch y'all later.

Transcript for