Saturday, January 27, 2018

Setting Up RDP on Machine with Firewall, Proxies, AntiVirus, File Blockers and other Security Apps. How to RDP with minimal privs:


Using RDP Tools on highly secure laptop : Hosting Procedures for my Fav 2 Remote Tools on Machines with Strict VPN’s

DeskRoll

    Start
         1. Disonnect VPN
         2. Start CMD as Admin
         3. net start DeskRollUnattendedAccess
         4. UI Start: C:\Windows\system32>"C:\Program Files (x86)\DeskRoll Unattended Access\DeskRollU.exe"
         5. Verify is Connected
         6. Connect VPN
         7. Await UI,
         8. Set Proxy to http://prntscr.com/i6ao1n

    Stop
         0. kill DeskRollU.exe
         1. net stop DeskRollUnattendedAccess
         2. Drop VON

Any Connect


     Start
         1.Connect VPN
         2. Run cmd as Admin, enter smart card creds
         3. execute "C:\temp\SharePointAny\SharePointAny.exe"

    Stop
         1. Kill SharePointAny.exe
         2. Disconnect VPN

  

  Netstat for RDP Debug

     https://apttech.wordpress.com/2009/12/23/using-netstat-to-resolve-rdp-issues/
   
            

   Netstat:   


             Poll outgoing, poll every 1 sec for port listening
         netstat -an 1 | find "3333"
        
         Poll incoming
         netstat -an 1 | find "4444" | find "ESTABLISHED"
            

     Network Port Scan


         netstat -a -n
         Now you want to go into Start > Run > cmd > look for ESTABLISHED connections
         "netstat -ano"
        
        
        

     Firewall Check/ Commands


         Run:
         wf.msc
            
         netsh firewall show state
         netsh firewall show config
        
         Enable Port
         netsh firewall add portopening TCP 80 "Open Port 80"
        

     Port Usage:


         Check If Listening:


             >netstat -an |find "3306"

         Check any other firewalls are blocking any ports


             netstat -ano | findstr -i SYN_SENT
        

         Test Port


             to test all open ports:

            portqry.exe -n #.#.#.#  
             To test a specific port:

            portqry.exe -n #.#.#.# -e #
             For example to test the Web interface of a router at 192.168.1.1:

            portqry.exe -n 192.168.1.1 -e 80
             Which returns:

            TCP port 80 (http service): LISTENING
             Where as testing on a local machine with no HTTPD running returns:

            TCP port 80 (http service): NOT LISTENING
             Using a PortScan utility you will get one of 3 results.

            Listening means the server is listening on the specified port
             Filtered means it received a TCP acknowledgement packet with the Reset flag set which likely indicates a firewall or software issue
             Not Listening means it didn't receive a response at all
             telnet is another command line option that is usually installed on the OS by default. This command line utility can be used a quick way to see if a port responds to a network request.

            To use telnet you would simply issue the following command from a command prompt:

            telnet localhost 3306'

     Save Commands History


         doskey /history > commands.log
        

     difference between [::] 0.0.0.0 and 127.0.0.1


         0.0.0.0, in this context,  "all IP addresses on the local machine"
         127.0.0.1 the service is only bound to the loopback interface
         [::] IPv6
        

     Use NetStat for Remote


         https://apttech.wordpress.com/2009/12/23/using-netstat-to-resolve-rdp-issues/
        
 

Change Service Names:

Rename Service Image Path w/ sc

        https://stackoverflow.com/questions/3663331/when-creating-a-service-with-sc-exe-how-to-pass-in-context-parameters

    binPath= "\"PATH WITH SPACES \COMMAND.EXE\" --param-with-quotes=\"a b c\" --param2"
          ^ ^                 ^           ^                      ^       ^         ^
          | |                 |           |                      |       |         |
      opening     escaped      regular     escaped                    escaped       closing
        quote     quote       backslash    closing                    quotes          quote
          for     for            in         quote                      for              for
        whole     path          path       for path                  parameter        whole
      command                                                                       command

or
         Stop the service. You will probably confuse the service control manager if you do this on a running service. (You may confuse it anyhow, this is very hacky.)
         Open regedit.exe (Registry Editor).
         Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and find the subkey with your service's name.
         Right-click the key you found in step #3, and select Rename. Enter the new name for the service.
         Restart the computer. Services.exe, the process that hosts the service control manager, won't see the change unless you do; attempts to start the renamed process (or otherwise interact with it at all, actually) will fail.
        
         or
        
         sc config "Old service name" displayname= "New service name"
         To change the executable you can run:
        
         sc config "Service name" binpath= "C:\path\to\executable\here"
         For both of those commands, make sure you have a space between the = and the new name (ie. displayname= "New Name", NOT displayname="New Name")
        
         or
        
         sc config "Name of Service" start= disabled
         sc stop "Name of Service"
        

    Change File Properties


        Verpatch to change via cmd line


        Office file via code:


         OleDocumentPropertiesClass
              //creates new class of oledocumentproperties
                 var doc = new OleDocumentPropertiesClass();
            
                 //open your selected file
                 doc.Open(pathToFile, false, dsoFileOpenOptions.dsoOptionDefault);
            
                 //oyu can set properties with summaryproperties.nameOfProperty = value; for example
                 doc.SummaryProperties.Company = "lol";
                 doc.SummaryProperties.Author = "me";
            
                 //after making changes, you need to use this line to save them
                 doc.Save();



    

Some Browser Based Remote Tools

   

    http://www.ammyy.com/en/

    https://www.remotepc.com/rpcnew/home
     https://www.screenconnect.com/
         https://flasponge.screenconnect.com/host#Support/All%20Sessions

    https://www.cybelesoft.com/download/#trdp

    https://www.screenleap.com/?newSignUp=true

    https://www.mikogo.com/confirm-registration/

    http://www.aeroadmin.com/en/