Warning: Constant ABSPATH already defined in /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php on line 24 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 Warning: Cannot modify header information - headers already sent by (output started at /customers/0/c/e/ogenstad.net/httpd.www/wp-config.php:24) in /customers/0/c/e/ogenstad.net/httpd.www/wp-includes/rest-api/class-wp-rest-server.php on line 1673 {"id":59,"date":"2006-09-13T16:14:14","date_gmt":"2006-09-13T15:14:14","guid":{"rendered":"http:\/\/ogenstad.net\/2006\/09\/13\/the-tale-of-the-disgruntled-employee-part-11\/"},"modified":"2006-09-13T16:14:15","modified_gmt":"2006-09-13T15:14:15","slug":"the-tale-of-the-disgruntled-employee-part-11","status":"publish","type":"post","link":"http:\/\/ogenstad.net\/2006\/09\/13\/the-tale-of-the-disgruntled-employee-part-11\/","title":{"rendered":"The Tale of the Disgruntled Employee – Part 11"},"content":{"rendered":"

n3m0 inserted the power cord again and started the machine. He placed his CD in the tray and made sure the server booted from it. The boot process seemed to take forever. He jumped when a tape robot came alive behind him and started rotating tapes.<\/p>\n

“Damn”, n3m0 screamed. If he was lucky, and the sysadmins sloppy, they might not notice that the server had “crashed” during the night, but if the backup failed someone would check it out. I have to get the server back up again.<\/em><\/p>\n

Finally the system was done loading, he configured the network, opened up a command prompt and typed:
\n
\nc:
\ncd temp
\nmd temp
\ncd temp
\ncopy c:\\windows\\system32\\cmd.exe<\/strong><\/p>\n

He opened the Opera browser and downloaded srvany.exe which he placed in the C:\\temp directory. n3m0 grabbed another tool and double clicked on the application, RegistryEditorPe<\/a>. When the registry loaded, he browsed to the HKLM\\_REMOTE_SYSTEM\\ControlSet001\\Services key. He added a new key and called it revenge. Under his revenge service he filled in Type, Start, ErrorControl, ObjectName, ImagePath. This will be perfect<\/em>, n3m0 was humming to himself as he added a new key; Parameters.<\/p>\n

Under it he created two entries Application with the value ‘C:\\temp\\cmd.exe’ and AppParameters with the value ‘\/k dsadd user “cn=root,cn=users,dc=exibice,dc=com” -samid root -pwd Password13 -memberof “cn=Domain Admins,cn=users,dc=exibice,dc=com”‘<\/p>\n

n3m0 closed the registry editor and clicked start, shutdown options, reboot (eject CDs). Again the boot process took an eternity. He wished he had a blue pill<\/a> to feed the server. When Windows was done booting, n3m0 issued the three finger salute, and entered root and password Password13. The instant he hit enter he was presented with a message box.<\/p>\n

Logon Message<\/strong>
\nThe system could not log you on. Make sure your User name and domain are correct, then type your password again. Letters in passwords must be typed using the correct case.<\/p>\n

n3m0 just stared at the message box, this is not happening<\/em>. He knew he had typed it in right, but tried again anyway. The same message was returned.<\/p>\n

Something inside n3m0 clicked and he started swearing and shouting at the server. After a few minutes he calmed down, he was sitting on the switch again talking to the server.<\/p>\n

“You know, I wish someone would develop artificial intelligence. That way you’d understand how much I hate you.”<\/p>\n

In his imagination the server answered him. “I might be slow, but you’re not the sharpest tool in the box either.”<\/p>\n

Slow, of course<\/em>, n3m0 pulled the power cord and booted from the CD again. He added a parameter to his revenge service; DependOnService with the value; dns netlogon.<\/p>\n

After another long reboot n3m0 logged as root, the newly created domain administrator on the Exibice network.<\/p>\n

0wned!<\/em><\/p>\n

[tags]security, stories, fiction, insider threat, disgruntled employee, physical security[\/tags]<\/p>\n","protected":false},"excerpt":{"rendered":"

n3m0 inserted the power cord again and started the machine. He placed his CD in the tray and made sure the server booted from it. The boot process seemed to take forever. He jumped when a tape robot came alive behind him and started rotating tapes. “Damn”, n3m0 screamed. If he was lucky, and the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":""},"categories":[2],"tags":[],"_links":{"self":[{"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/posts\/59"}],"collection":[{"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/comments?post=59"}],"version-history":[{"count":0,"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/posts\/59\/revisions"}],"wp:attachment":[{"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/media?parent=59"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/categories?post=59"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ogenstad.net\/wp-json\/wp\/v2\/tags?post=59"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}