Best posts made by IRJ

You cant serve two masters.

Either your loyalty lies with advertisers or with community.

@JaredBusch said in Extracting Hidden files from a JPG:

@IRJ said in Extracting Hidden files from a JPG:

I figured it out . I was able to extract the jpg to IMG file. Then I was prompted for a password. I found that the password was actually in the hexdump of the JPG file.

private key password too?

This a malicious payload for a crypto?

It was a challenge we had. First person to capture the flag got to keep contents of the wallet. I was first one to figure it out on our team.

It was only a few USD, but a fun little treasure

https://www.udemy.com/vim-essentials/

Project:
VSAQ

Github:
https://github.com/google/vsaq

Demo:
https://vsaq-demo.withgoogle.com/

OS:
CentOS 7

I could not find an installation guide anywhere for this installation online. The instructions on their github are incomplete and require additonal github repos. I am putting the install instructions here so you can quickly build this servers. I encourage you to check out the demo, and possibly have vendors fill out these forms as they will tell you alot about your vendor. They could possible save your company's ass from buying software that is insecure, or perhaps at a minimum cover your ass and force management to see potential risks.

Install required per-requisite software

sudo yum -y install unzip
sudo yum -y install ant 
sudo yum -y install git
sudo yum -y install curl
sudo yum -y install maven
sudo yum -y install wget
sudo yum -y install java-1.7.0-openjdk-devel

Install Apache

sudo yum -y install httpd
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload
sudo systemctl start httpd
sudo systemctl enable httpd

Clone Github Repos

cd /

sudo git clone https://github.com/google/vsaq

cd third_party/

sudo git clone https://github.com/google/closure-compiler

sudo git clone https://github.com/google/closure-library

sudo git clone https://github.com/google/closure-stylesheets

sudo git clone https://github.com/jleyba/js-dossier

sudo git clone https://github.com/google/safe-html-types

sudo git clone https://github.com/google/closure-templates

Install Dependencies

cd /vsaq/
sudo ./do.sh install_deps

Check Dependencies

sudo ./do.sh check_deps

Build VSAQ

sudo ./do.sh build

Move files to public website

sudo cp -r build . /var/www/html/

Start Server

sudo ./do.sh run

A really good writeup from the Fedora Team.

https://fedoramagazine.org/two-factor-authentication-ssh-fedora/

First install unattended-upgrades and postfix

sudo apt install unattended-upgrades
sudo apt install postfix

On postfix install select "Internet Site" and keep the default hostname in the next step.

Next edit the 50unattended-upgrades file

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Now uncomment the following lines

"${distro_id}:${distro_codename}-updates";

Unattended-Upgrade::Mail "[email protected]";

Unattended-Upgrade::Remove-Unused-Dependencies "true";

There are some other options you can configure such as automatic reboots, but I decided not to do so.

Now we need to configure /etc/apt/apt.conf.d/20auto-upgrades

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Paste the following text in /etc/apt/apt.conf.d/20auto-upgrades. The intervals below are set in days.

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";

Now save and test

sudo unattended-upgrades

You should get an email similar to this.

Unattended upgrade returned: True

Packages that were upgraded:
 

Packages that were auto-removed:
 libutempter0 tmux python3-newt run-one net-tools pastebinit


Package installation log:
Log started: 2019-04-11  14:29:09
Removing tmux (2.6-3ubuntu0.1) ...
Removing libutempter0:amd64 (1.1.6-3) ...
Processing triggers for libc-bin (2.27-3ubuntu1) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Log ended: 2019-04-11  14:29:13

Log started: 2019-04-11  14:29:14
Removing python3-newt:amd64 (0.52.20-1ubuntu1) ...
Log ended: 2019-04-11  14:29:16

Log started: 2019-04-11  14:29:16
Removing run-one (1.17-0ubuntu1) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Log ended: 2019-04-11  14:29:20

Log started: 2019-04-11  14:29:20
Removing net-tools (1.60+git20161116.90da8a0-1ubuntu1) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Log ended: 2019-04-11  14:29:23

Log started: 2019-04-11  14:29:24
Removing pastebinit (1.5-2) ...
Processing triggers for man-db (2.8.3-2ubuntu0.1) ...
Log ended: 2019-04-11  14:29:28



Unattended-upgrades log:
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=bionic, o=Ubuntu,a=bionic-security, o=UbuntuESM,a=bionic, o=Ubuntu,a=bionic-updates
Packages that will be upgraded:
Packages that were successfully auto-removed: libutempter0 net-tools pastebinit python3-newt run-one tmux
Packages that are kept back: 

Script for anyone who is interested

#***********************************************************
# Install postfix and Unattended Upgrades
#***********************************************************

apt install -y unattended-upgrades
apt install -y postfix

#***********************************************************
# Edit Config file
#***********************************************************

sed -i '/Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true"/a\\Unattended-Upgrade::Mail "[email protected]";
' /etc/apt/apt.conf.d/50unattended-upgrades

sed -i '/Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true"/a\\Unattended-Upgrade::Remove-Unused-Dependencies "true";' /etc/apt/apt.conf.d/50unattended-upgrades

sed -i '/Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true"/a\\        "${distro_id}:${distro_codename}-updates";
' /etc/apt/apt.conf.d/50unattended-upgrades


#***********************************************************
# Create additonal config file
#***********************************************************

cat > /tmp/20auto-upgrades <<\EOF
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "1";
EOF

#***********************************************************
# Copy Config file
#***********************************************************


cp /tmp/20auto-upgrades /etc/apt/apt.conf.d/20auto-upgrades
rm /tmp/20auto-upgrades

#***********************************************************
# Enable and run Unattended-Upgrades
#***********************************************************

systemctl enable unattended-upgrades
apt update
unattended-upgrades

Enjoy

Create Scan User and Scan Group

sudo useradd -m scan_user
sudo groupadd scan
sudo usermod -aG scan scan_user

Create .ssh directory and set permissions

sudo mkdir /home/scan_user/.ssh
sudo chown -R scan_user:scan_user /home/scan_user

Generate key and set permissions

sudo -u scan_user ssh-keygen -f /home/scan_user/.ssh/id_rsa -t rsa -N ''
sudo -u scan_user mv /home/scan_user/.ssh/id_rsa.pub /home/scan_user/.ssh/authorized_keys
sudo -u scan_user chmod 0600 /home/scan_user/.ssh/authorized_keys
sudo -u scan_user chmod 0700 /home/scan_user/.ssh

Enable Public Key Authentication

sudo echo '' >> /etc/ssh/sshd_config
sudo echo '' >> /etc/ssh/sshd_config
sudo echo '#***********************************************************' >> /etc/ssh/sshd_config
sudo echo '# Enable RSA Key Authentication ' >> /etc/ssh/sshd_config
sudo echo '#***********************************************************' >> /etc/ssh/sshd_config
sudo echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config
sudo echo 'RSAAuthentication yes' >> /etc/ssh/sshd_config

Set minimum permissions for scanning

sudo echo '' >> /etc/ssh/sshd_config
sudo echo '' >> /etc/ssh/sshd_config
sudo echo '#***********************************************************' >> /etc/sudoers
sudo echo '# Set minimum permissions for scanning ' >> /etc/sudoers
sudo echo '#***********************************************************' >> /etc/sudoers
sudo echo '%scan    ALL= NOPASSWD:/usr/sbin/dmidecode, /bin/netstat, /bin/uname' >> /etc/sudoers

Restart SSH

sudo systemctl restart sshd

Copy key file to your PC for upload to Nessus
Commented out so you can run manually.

# sudo scp /home/scan_user/.ssh/id_rsa remoteusername@remoteserver:servername_scan_key

Test Logging in via SSH Key from your box.
Commented out so you can run manually.

# ssh -i servername_scan_key scan_user@server

Got it working. I had to set the user to nobody instead of guest. Oddly enough it would mount as guest, but just not be readable.

At least their name isn't shady....

@garak0410 said in Online IT eduction sites?:

@Pete-S said in Online IT eduction sites?:

I've seen a couple of sites mentioned for training in the IT field.
I probably missed a ton though. What others are worth looking at?

This is the list so far (in alphabetical order):

• linuxacademy.com
• pluralsight.com
• udemy.com

Udemy is pretty good...they run sales often (if they are really "sales") and most of the purchased courses I've taken have been very good.

I like that you own the class for life. Some other places strictly use subscription model, and if you do not use for a couple months, it costs you money. With Udemy you can go back anytime and view your course with no out of pocket expense once purchased.

https://i.imgflip.com/u8gsg.jpg

@DustinB3403 said in Virtual team ideas?:

Time sensitivity is important, people have a hard time showing up on time for a meeting physically. Making people wait with a headset on is just additional irritation that they won't take well.

I personally always show up early 1-5 minutes for a meeting. If I had to wait an additional 15 I'd be using collage rules and counting my attendance as there even if the host isn't.

I think putting a headset on is easier than going to room a people honestly.

@dustinb3403 said in So Windows 11??:

@hobbit666 said in So Windows 11??:

@scottalanmiller said in So Windows 11??:

Not that easy currently, either.

I find it very easy, just don't have it connected to the internet when installing. You then select offline account.

Assuming you're using something other than Windows Home edition (possibly). I would assume Microsoft wouldn't force this on businesses, but I see them trying to lead people down the path of the "Desktop as a Service" route and charging a routine fee.

Microsoft is likely seeing how this pans out and if there is an appetite to spend additional monies on something that has traditionally been a "non-seen cost" of the home PC.

I disagree. Desktop as a service has no money in it. The way they license to OEM is the only way to make money on most users. I don't believe people are willing to pay monthly subscription for an OS. There are so many platforms that are better for users, and they don't/won't pay. Google and Apple would never charge for an OS because the real money is on selling software / apps and getting a cut of every sale. Providing the OS just gives the user an easy path to their store.

@dafyre said in Spreadsheet background image:

Is Microsoft Word an option?

@gjacobse said in Whack a mole: Dealing with Spam/Phishing:

It seems that this has become a really bad habit and a poor solution to the over all problem. What is a better way to deal with this?

Awareness training and actual testing is thr best way to handle this. Blocking random Gmail addresses one by one is complete waste of time.

You should be training and testing your employees with your own phishing campaign. Once they get fooled a few times and see their stats being recorded, they will become more cautious.

Good for ML. This site should have had ads a long time ago. I would like to see Google Adsense implemented as well. This site deserves some revenue from ads.

It's funny how people accept ads on a website that starts out with them, but they don't accept them on a website that ads them later on

RAM,

I left a stable government IT job and started to work for an MSP that really worked themselves up to be something they werent. I moved and everything to start the job. The first week I was thee they had me recycle computer components and UPS batteries and the Second week I sat on a PC waiting for a client to call. Sometime in the 3rd week they laid me off. I was insulted, and I was extremely pissed off. They knew they pulled me away from a stable job and laid me off in 3 weeks. I then started doing contract work. Alot of my friends did this, but It was never something I had done. I really hated it. No employer was the same. IT department skill levels varied.

About a year later, I was getting desperate to get an employee job for a company. I paid to have my resume professionally done. I started applying at jobs with my new Resume and got offered interviews like crazy. In a week, I did 4 interviews and 3 of the employers gave me a job offer. I was able to pick my place of employment and now I couldnt be more happy.

Everyone who is working for a great employer, put their time in with the shitty ones. I see it on Spicworks all the time, IT professionals posting about their backwards IT dept. and employers. That was me. No appreciation by co-workers and superiors. Set your sights high, and dont stop until you get what you want. There are good employers out there and you are a good employee. One day soon, you will find the right fit.

I created a new job, when I try to kick it off I get this :

The job failed. The owner (mydomain\sqluser1) of job "jobname" does not have server access.

I am able to kick off the job under an admin account, but I am trying to schedule this job using "sqluserq" I would like to make this account a sysadmin so I ran this command:

exec sp_addsrvrolemember 'mydomain\sqluser1', 'sysadmin';

Even after running that command, the job is still failing...

Cloud At Cost System Message:

03/25/2015 12:37 PM

Cloud at Cost is Hiring Technical Support Staff.

Cloud at Cost is the fastest growing cloud provider and has openings for 10 support staff to work ether local or remote.

If interested please send your resume to [email protected] with subject [“Your Name - Resume”]

Responsibilities

• Answer Technical Support & Sales questions related to Cloud at Cost services.

• Working customers issues through support ticket system.

• Follow up with customers and clients to ensure product satisfaction

• Must be able to investigate, troubleshoot, and resolve technical issues customers may experience

• Perform other duties as required

Must be able to

• Multitask & manage time effectively.

• Thrive and succeed in a rapidly changing environment.

• Handle challenging customers in a professional manner.

• Work both in a team environment and independently (remote) as required.

Essential skills

• Understanding of popular versions of Linux, Windows and TCP/IP networking.

• Experience with LAN/WAN networking technologies including vlans.

• Demonstrated troubleshooting and diagnostic skills.

View More: http://goo.gl/55ULBn
We would like to thank all of you for your consideration.

CloudAtCost Team.

Too many variables. I myself have been overall more than happy with my career progress so far. I have seen and heard many horror stories, but I myself have had smooth sailing, salary increases, and new higher positions along the way.

I used to post on SW all the time to help these people out, but most of the time they are a lost cause. If they are too intimidated to stand up for themselves are pursue a career in their early days, then why would they all the sudden change?