|
Sickening posted:Its not really interesting. We acquired some companies and one of them have a few of these ancient shitters. I have researched this a bit before, but outside of the cve's posted by Microsoft, I feel like vulnerabilities of EOL servers just goes dark from the community at large when they go EOL. Have fun: https://nvd.nist.gov/vuln/search/results?adv_search=true&form_type=Advanced&query=cpe:/o:microsoft:windows_2003_server I think CIS or NIST might have some benchmarks or something at least published out there if you do have to keep using it for some dumb reason.
|
#
?
Mar 22, 2021 19:33
|
|
|
|
| # ? May 26, 2024 04:21 |
|
|
Sickening posted:Its not really interesting. We acquired some companies and one of them have a few of these ancient shitters. I have researched this a bit before, but outside of the cve's posted by Microsoft, I feel like vulnerabilities of EOL servers just goes dark from the community at large when they go EOL. Microsoft has released patches for Server 2003 past End of Support for some of the known scary stuff, but for example something like SigRED affects 2003 w/o available patch (but theres a reg key mitigation) https://media.defense.gov/2020/Jul/16/2002458198/-1/-1/0/CSA_CVE20201350-V_1_0%20-%20COPY.PDF You’d have to go CVE by CVE on someplace like https://www.cvedetails.com/ to see what MS did and did not patch for 2003. I would wager that this server is probably unpatched against the things that do have a solution tho, would probably start there.
|
|
#
?
Mar 22, 2021 19:37
|
|
|
honestly it looks like you can destroy that system yourself at any time
|
|
#
?
Mar 22, 2021 19:49
|
|
|
"oh poo poo you guys lost the 2003 box and everything associated with it? aw heck sorry folks"
|
|
#
?
Mar 22, 2021 19:50
|
|
|
Tryzzub posted:Microsoft has released patches for Server 2003 past End of Support for some of the known scary stuff, but for example something like SigRED affects 2003 w/o available patch (but theres a reg key mitigation) https://media.defense.gov/2020/Jul/16/2002458198/-1/-1/0/CSA_CVE20201350-V_1_0%20-%20COPY.PDF It's actually substantially worse than that, because there are plenty of CVEs from even the last year that absolutely do impact 2003 but won't list 2003 as an affected platform because they don't support it. Microsoft's own page for CVE-2020-1350 doesn't list 2003, but that NSA advisory does correctly report that 2003 is affected. Sickening is correct in that they just go dark. It's safe to assume that a significant fraction of CVEs affecting newer versions of windows since they went dark do in fact silently affect 2003. If the bug is in code old enough to hit Win7, and it wasn't a feature new to Win7 go ahead and assume the worst.
|
|
#
?
Mar 22, 2021 20:42
|
|
|
Moving all our production stuff to Win3.1 and Trumpet Winsock
|
|
#
?
Mar 23, 2021 13:09
|
|
|
Martytoof posted:Moving all our production stuff to Win3.1 and Trumpet Winsock Run all our production on WinNT 4.0 boxes. For eternity.
|
|
#
?
Mar 23, 2021 15:10
|
|
|
Just use exploit-db .com to search for all the exploits that have in-the-wild exploitation code.
|
|
#
?
Mar 23, 2021 16:16
|
|
|
If your tech is old enough, the tools for hacking it have all died out too
|
|
#
?
Mar 23, 2021 16:49
|
|
|
Finally my investment in A/UX pays off.
|
|
#
?
Mar 23, 2021 16:53
|
|
|
Brb, firing up BackOrifice.
|
|
#
?
Mar 23, 2021 17:12
|
|
|
BlankSystemDaemon posted:Brb, firing up BackOrifice. Laughs in bitrot
|
|
#
?
Mar 23, 2021 17:15
|
|
|
RFC2324 posted:If your tech is old enough, the tools for hacking it have all died out too I wonder if there are still young nerds out there feeling all badass for sharing the plans for the various-colored phone phreaking boxes, even though none of them have worked since last century.
|
|
#
?
Mar 23, 2021 17:18
|
|
|
Powered Descent posted:I wonder if there are still young nerds out there feeling all badass for sharing the plans for the various-colored phone phreaking boxes, even though none of them have worked since last century. I still love explaining rainbox boxes to people I think thats the one where you just hook a phone line up to a 120v power line, right?
|
|
#
?
Mar 23, 2021 17:34
|
|
|
Powered Descent posted:I wonder if there are still young nerds out there feeling all badass for sharing the plans for the various-colored phone phreaking boxes, even though none of them have worked since last century. I used to build various colored boxes in high school in like 2001 even though almost none of them worked (beige box being a big exception, but that's just a phone with alligator clips instead of rj11)
|
|
#
?
Mar 23, 2021 17:52
|
|
|
BlankSystemDaemon posted:Brb, firing up BackOrifice. Isn't it called TeamViewer these days?
|
|
#
?
Mar 23, 2021 18:13
|
|
|
Holy shiy I just had a flashback to someone recommending back orifice as a remote sysadmin tool
|
|
#
?
Mar 23, 2021 18:28
|
|
|
Powered Descent posted:I wonder if there are still young nerds out there feeling all badass for sharing the plans for the various-colored phone phreaking boxes, even though none of them have worked since last century. Uses Asterisk to emulate an old-school telephone network where various boxes work.
|
|
#
?
Mar 23, 2021 18:52
|
|
|
Pablo Bluth posted:Just use exploit-db .com to search for all the exploits that have in-the-wild exploitation code. Yep. Even greater to install the tool and search for exploits for the system exactly and then use other options to filter for types of exploit (ie unauth vs auth user vs admin) code:code:
|
|
#
?
Mar 23, 2021 20:00
|
|
|
RFC2324 posted:Holy shiy I just had a flashback to someone recommending back orifice as a remote sysadmin tool
|
|
#
?
Mar 23, 2021 21:22
|
|
|
EVIL Gibson posted:
|
|
#
?
Mar 23, 2021 21:30
|
|
|
Pablo Bluth posted:Or just use Kali Linux and it's all there... You mean broken Linux.
|
|
#
?
Mar 23, 2021 22:23
|
|
|
Powered Descent posted:I wonder if there are still young nerds out there feeling all badass for sharing the plans for the various-colored phone phreaking boxes, even though none of them have worked since last century. If you whistle into an Exchange server it opens right up.
|
|
#
?
Mar 23, 2021 23:16
|
|
|
Ojjeorago posted:If you whistle into an Exchange server it opens right up. if the exchange server doesn't want to get pwned, the server has ways to shut that down Arivia fucked around with this message at 00:56 on Mar 24, 2021 |
|
#
?
Mar 24, 2021 00:50
|
|
|
wolrah posted:http://www.projectmf.org/ That is easily the most awesome thing I have seen all day. And it somehow makes me feel incredibly old, even though phone phreaking was already pretty much over, well before my time.
|
|
#
?
Mar 24, 2021 01:45
|
|
|
CommieGIR posted:You mean broken Linux.
|
|
#
?
Mar 24, 2021 01:48
|
|
|
Pablo Bluth posted:I only use Kali inside a VM for playing HackTheBox but I can't say I've found it broken in any sense. Wildly inappropriate as a main OS but fine for it's niche. I was mostly joking, its good for that sort of stuff, but it does have some issues.
|
|
#
?
Mar 24, 2021 02:39
|
|
|
CommieGIR posted:I was mostly joking, its good for that sort of stuff, but it does have some issues. I seem to recall someone exposing that its security is broken, and all I could think was "why are you running it somewhere exposed on a R/W platform? LiveUSB only please
|
|
#
?
Mar 24, 2021 16:39
|
|
|
the biggest issue with the old distros of kali was that it used root for everything, and people were using it as a daily driver it despite it saying everywhere not to do that. that's the most significant change with kali 2020.
|
|
#
?
Mar 24, 2021 17:10
|
|
|
I thought it was funny as hell that they described themselves as being hardened to the point of being unusable as a daily driver, but had that one rather noticable flaw
|
|
#
?
Mar 24, 2021 17:36
|
|
|
I, someone that did everything as part of a '600 users, 5 IT workers' company, have been officially absorbed into a very large corporation's 'Cybersecurity' department. I wasn't asked if I wanted to be silo'd into security specifically, but that's where they've put me. I haven't been told what they think I'm going to be doing for them. What are good questions I should be asking my new manager to suss things out and get the lay of the land? I have a personal interest in security, and liked to understand whether my old environment had huge gaps that needed improvement, but it wasn't my career path.
|
|
#
?
Mar 24, 2021 17:38
|
|
|
droll posted:I, someone that did everything as part of a '600 users, 5 IT workers' company, have been officially absorbed into a very large corporation's 'Cybersecurity' department. I wasn't asked if I wanted to be silo'd into security specifically, but that's where they've put me. I haven't been told what they think I'm going to be doing for them. What are good questions I should be asking my new manager to suss things out and get the lay of the land? I have a personal interest in security, and liked to understand whether my old environment had huge gaps that needed improvement, but it wasn't my career path. The best you can do is just open lines of communication and hope for the best. I would say the move is highly unusual and might have not even been your bosses idea or desire. Be flexible.
|
|
#
?
Mar 24, 2021 17:43
|
|
|
droll posted:I, someone that did everything as part of a '600 users, 5 IT workers' company, have been officially absorbed into a very large corporation's 'Cybersecurity' department. I wasn't asked if I wanted to be silo'd into security specifically, but that's where they've put me. I haven't been told what they think I'm going to be doing for them. What are good questions I should be asking my new manager to suss things out and get the lay of the land? I have a personal interest in security, and liked to understand whether my old environment had huge gaps that needed improvement, but it wasn't my career path. find out what the expected roles and responsibilities are and if you have skill gaps, negotiate for training on company dime. hell, ask for it even if you don't need it!
|
|
#
?
Mar 24, 2021 19:40
|
|
|
Does anyone know of a good web resource that kind of lays out the various roles/responsibilities typically seen so that I can be prepared to have those discussions? This company is not selling software / uses COTS internally. I'm also curious if there are red flags I can be on the look out for that might indicate that this particular cybersecurity team is awful to work in, specific to security not just general stuff I've already picked up on working in corporations for 20 years.
|
|
#
?
Mar 24, 2021 19:54
|
|
|
something like this could be useful for you: https://www.cyberseek.org/pathway.html
|
|
#
?
Mar 24, 2021 20:13
|
|
|
Yeah I would want to know what the expectations out of you are. SOC response type? Making big picture security policy decisions like a CISO? A bit of both? Are you expected to be hands on with firewalls, DLP, AV, etc?
|
|
#
?
Mar 24, 2021 20:36
|
|
|
Pablo Bluth posted:. Wildly inappropriate as a main OS but fine for it's niche. Too many people actually DO use it as a main OS though. I don't use use LiveUSB. I use it on an ancient Lenovo laptop and that thing is wiped when I am not using it. It's easier to reinstall than update funnily enough.
|
|
#
?
Mar 24, 2021 21:29
|
|
|
But why
|
|
#
?
Mar 24, 2021 21:56
|
|
|
Having got in to HackTheBox, it's amazing how much of the request for help in the official forum is "I want to do X and it's not working. WHY?" pleas. The sort of zero-detail help-ticket I'd expect my Mum to write. So I can believe that 75% of the Kali userbase is 14 year-olds who have mistaken themselves for Elliot Alderson.
Pablo Bluth fucked around with this message at 01:21 on Mar 25, 2021 |
|
#
?
Mar 25, 2021 01:12
|
|
|
|
| # ? May 26, 2024 04:21 |
|
|
75% of the entire drat industry
|
|
#
?
Mar 25, 2021 01:36
|
|
