Sponsored Content
Top Forums Shell Programming and Scripting NTLMv2 Verification Using Linux(rpcclient&regshell) Post 302687327 by metallica1973 on Thursday 16th of August 2012 11:03:42 AM
Old 08-16-2012
NTLMv2 Verification Using Linux(rpcclient&regshell)

I am writing a script and am trying to figure out what tool I can use to verify that a windows system is using NTLMv2 using linux? I have been using tools like:

Code:
rpcclient
regshell

I now know what the exact registry key string to look for for verification:

LmCompatibilityLevel
http://atc.caltech.edu/node/402

Code:
regshell -b rpc -R "ncacn_np:192.168.1.155" -U "TESTNETWORK.local\testadmin" 
Password for [TESTNETWORK.LOCAL\testadmin]:
HKEY_CLASSES_ROOT\> predef HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\> ck "SYSTEM\CurrentControlSet\Control\Lsa"
New path is: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa> list
K AccessProviders
K Audit
K Data
K GBG
K JD
K Kerberos
K MSV1_0
K Skew1
K SSO
K SspiCache
V "Authentication Packages" REG_MULTI_SZ (null)
V "Bounds" REG_BINARY 0030000000200000
V "Security Packages" REG_MULTI_SZ (null)
V "ImpersonatePrivilegeUpgradeToolHasRun" REG_DWORD 0x00000001
V "LsaPid" REG_DWORD 0x000002d0
V "SecureBoot" REG_DWORD 0x00000001
V "auditbaseobjects" REG_DWORD 0x00000000
V "crashonauditfail" REG_DWORD 0x00000000
V "disabledomaincreds" REG_DWORD 0x00000000
V "everyoneincludesanonymous" REG_DWORD 0x00000000
V "fipsalgorithmpolicy" REG_DWORD 0x00000000
V "forceguest" REG_DWORD 0x00000001
V "fullprivilegeauditing" REG_BINARY 00
V "limitblankpassworduse" REG_DWORD 0x00000001
V "lmcompatibilitylevel" REG_DWORD 0x00000000
V "nodefaultadminowner" REG_DWORD 0x00000001
V "nolmhash" REG_DWORD 0x00000000
V "restrictanonymous" REG_DWORD 0x00000000
V "restrictanonymoussam" REG_DWORD 0x00000001
V "Notification Packages" REG_MULTI_SZ (null)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa> print "lmcompatibilitylevel"
REG_DWORD
0x00000000

Now my question is, how can I print this in a oneliner? I have tried:
Code:
regshell -b rpc -R "ncacn_np:192.168.0.155" -U "TESTNETWORK.local\testadmin" -c "predef HKEY_LOCAL_MACHINE;ck SYSTEM\CurrentControlSet\Control\Lsa; print "lmcompatibilitylevel" "

but to no evail. Any ideas?? Is there a perl module for querying and checking registry entries?
 

10 More Discussions You Might Find Interesting

1. UNIX Desktop Questions & Answers

what is the difference between Unix & linux, what are the advantages & disadvantages

ehe may i know what are the difference between Unix & Linux, and what are the advantages of having Unix as well as disadvantages of having Unix or if u dun mind i am dumb do pls tell me what are the advantages as well as the disadvantages of having linux as well. thanks (1 Reply)
Discussion started by: cybertechmkteo
1 Replies

2. UNIX Desktop Questions & Answers

ATI && XFree86 (Linux)

Anyone who have any ideas how-to make X faster. I have a ATI Rage Mobility P/M AGP 2x card and I wanto get it fast, mostly for movie playback and so. Is there OpenGL and GLX support? regards Esaia (1 Reply)
Discussion started by: Esaia
1 Replies

3. UNIX for Dummies Questions & Answers

verification?

I'm really new at this and wondering how I would go about adding code to my script to verify that all records loaded successfully? (I am loading a file into a table) i'm using the Korn shell. I'm also having trouble verifying parts in the header as i do not really understand the header and... (3 Replies)
Discussion started by: sheranjem
3 Replies

4. Programming

htable + verification

hello every body, I have to verifiy if the param_key is selectionned twice or more and to print only one occurence i'm using htable what's the good implementation to add to the code to verify this. code : { char *tmpStr = NULL; ght_iterator_t iterator_param; void... (0 Replies)
Discussion started by: kamel.seg
0 Replies

5. Shell Programming and Scripting

Script Verification

Hi eveyone I am planning to use crontab to delete all files in my donwloads directory that are older than one hour I will be using crontab to run this script find /home/kee/downloads/* -daystart -mmin +59 -type f -name -exec rm -r {}\; could you please let me know if the above... (1 Reply)
Discussion started by: k33k00
1 Replies

6. UNIX Desktop Questions & Answers

Can't mount samba on AIX with ntlmv2

Hi guys, I'm trying to mount a share from Win2003 on AIX with ntlmv2. It doesn't seem to work as Windows keep complaining about a wrong username/password. I've added "client ntlmv2 auth = yes" to smb.conf. I have tested the account/username/hostname/ip address with smbclient and it seems... (4 Replies)
Discussion started by: kress
4 Replies

7. Shell Programming and Scripting

Linux Platform - NDM Script - && Operator

Hi All, I have a requirement where i need to NDM 3 files from LINUX to Mainframe system & trigger a job in mainframe once the 3 files are transmitted successfully. I am getting an error message in the && operator (the code component where i am checking whether step 1/2/3 are completed). ... (2 Replies)
Discussion started by: dsfreddie
2 Replies

8. Shell Programming and Scripting

Help about comment verification

Hello, I have a file, in which line 40 is commented. It is basically a cron job, #05,35,50 * * * * /usr/local/scripts/my.sh how i can i verify the line 40 is commented, if not then give me message not commented, otherwise provide us message it is commented. (5 Replies)
Discussion started by: learnbash
5 Replies

9. Programming

ECDSA verification

Using ECDSA, how do you verify integrity of Data (D), Given the value for the following: Random number (r) Signature (s) ECpublic Key (K) Thanks. (0 Replies)
Discussion started by: dragonpoint
0 Replies

10. UNIX and Linux Applications

Xalan & Xerces issues for Oracle Linux 6.6 & Solarisstudio12.3 C++ compiler for Linux

Hi Team, I am facing issue while using Xalan & Xerces for my application. Below are my environment details i am using :- Platform:- Oracle Linux 6.6 Compiler :- solarisstudio12.3 C++ compiler for Linux Below are the versions of Xalan & Xerces source code used to build the shared object... (0 Replies)
Discussion started by: agrachirag
0 Replies
registry(n)						       Tcl Bundled Packages						       registry(n)

__________________________________________________________________________________________________________________________________________________

NAME
registry - Manipulate the Windows registry SYNOPSIS
package require registry 1.1 registry option keyName ?arg arg ...? _________________________________________________________________ DESCRIPTION
The registry package provides a general set of operations for manipulating the Windows registry. The package implements the registry Tcl command. This command is only supported on the Windows platform. Warning: this command should be used with caution as a corrupted reg- istry can leave your system in an unusable state. KeyName is the name of a registry key. Registry keys must be one of the following forms: \hostname ootnamekeypath rootnamekeypath rootname Hostname specifies the name of any valid Windows host that exports its registry. The rootname component must be one of HKEY_LOCAL_MACHINE, HKEY_USERS, HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_CURRENT_CONFIG, HKEY_PERFORMANCE_DATA, or HKEY_DYN_DATA. The keypath can be one or more registry key names separated by backslash () characters. Option indicates what to do with the registry key name. Any unique abbreviation for option is acceptable. The valid options are: registry broadcast keyName ?-timeout milliseconds? Sends a broadcast message to the system and running programs to notify them of certain updates. This is necessary to propagate changes to key registry keys like Environment. The timeout specifies the amount of time, in milliseconds, to wait for applications to respond to the broadcast message. It defaults to 3000. The following example demonstrates how to add a path to the global Envi- ronment and notify applications of the change without requiring a logoff/logon step (assumes admin privileges): set regPath [join { HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control {Session Manager} Environment } "\"] set curPath [registry get $regPath "Path"] registry set $regPath "Path" "$curPath;$addPath" registry broadcast "Environment" registry delete keyName ?valueName? If the optional valueName argument is present, the specified value under keyName will be deleted from the registry. If the optional valueName is omitted, the specified key and any subkeys or values beneath it in the registry hierarchy will be deleted. If the key could not be deleted then an error is generated. If the key did not exist, the command has no effect. registry get keyName valueName Returns the data associated with the value valueName under the key keyName. If either the key or the value does not exist, then an error is generated. For more details on the format of the returned data, see SUPPORTED TYPES, below. registry keys keyName ?pattern? If pattern is not specified, returns a list of names of all the subkeys of keyName. If pattern is specified, only those names matching pattern are returned. Matching is determined using the same rules as for string match. If the specified keyName does not exist, then an error is generated. registry set keyName ?valueName data ?type?? If valueName is not specified, creates the key keyName if it does not already exist. If valueName is specified, creates the key keyName and value valueName if necessary. The contents of valueName are set to data with the type indicated by type. If type is not specified, the type sz is assumed. For more details on the data and type arguments, see SUPPORTED TYPES below. registry type keyName valueName Returns the type of the value valueName in the key keyName. For more information on the possible types, see SUPPORTED TYPES, below. registry values keyName ?pattern? If pattern is not specified, returns a list of names of all the values of keyName. If pattern is specified, only those names match- ing pattern are returned. Matching is determined using the same rules as for string match. SUPPORTED TYPES
Each value under a key in the registry contains some data of a particular type in a type-specific representation. The registry command converts between this internal representation and one that can be manipulated by Tcl scripts. In most cases, the data is simply returned as a Tcl string. The type indicates the intended use for the data, but does not actually change the representation. For some types, the registry command returns the data in a different form to make it easier to manipulate. The following types are recognized by the registry command: binary The registry value contains arbitrary binary data. The data is represented exactly in Tcl, including any embedded nulls. none The registry value contains arbitrary binary data with no defined type. The data is represented exactly in Tcl, including any embedded nulls. sz The registry value contains a null-terminated string. The data is represented in Tcl as a string. expand_sz The registry value contains a null-terminated string that contains unexpanded references to environment variables in the normal Windows style (for example, "%PATH%"). The data is represented in Tcl as a string. dword The registry value contains a little-endian 32-bit number. The data is represented in Tcl as a decimal string. dword_big_endian The registry value contains a big-endian 32-bit number. The data is represented in Tcl as a decimal string. link The registry value contains a symbolic link. The data is represented exactly in Tcl, including any embedded nulls. multi_sz The registry value contains an array of null-terminated strings. The data is represented in Tcl as a list of strings. resource_list The registry value contains a device-driver resource list. The data is represented exactly in Tcl, including any embedded nulls. In addition to the symbolically named types listed above, unknown types are identified using a 32-bit integer that corresponds to the type code returned by the system interfaces. In this case, the data is represented exactly in Tcl, including any embedded nulls. PORTABILITY ISSUES
The registry command is only available on Windows. EXAMPLE
Print out how double-clicking on a Tcl script file will invoke a Tcl interpreter: package require registry set ext .tcl # Read the type name set type [registry get HKEY_CLASSES_ROOT\$ext {}] # Work out where to look for the command set path HKEY_CLASSES_ROOT\$type\Shell\Open\command # Read the command! set command [registry get $path {}] puts "$ext opens with $command" KEYWORDS
registry registry 1.1 registry(n)
All times are GMT -4. The time now is 07:41 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy