PowerShell

It’s been a while since posting and I do hope to sort that out but for now another quick mention of some work with Ruckus Cloudpath.

Although massively flexible in its design I’ve come into a few niche cases where administrators would like a single DPSK pool (which is bound to a single SSID) but where different users have different expiry dates on those DPSKs. Thus far I’m planning on interacting with the API via Node-RED to update these entries in the API as the provisioning process takes place – something for another blog post.

However for those who are just getting to grips with the API (using PowerShell in my case) I hope the short example in this GitHub repo can be of use: https://github.com/jamesfed/RuckusCloudpathAPI.

An issue that I’ve now run into a few times now so I thought it was worth a blog post – if you are using the REST Custom sensor within PRTG Network Monitor you may see the error below if you have generated your REST configuration using PowerShell.
XML: The returned XML does not match the expected schema. (code: PE233) — JSON: The returned JSON does not match the expected structure (Invalid JSON.). (code: PE231)
The cause is the default encoding from PowerShell is UCS-2 LE BOM as shown in Notepad++ below.
The fix is simple in that when generating your REST configuration append -Encoding utf8 at the end of the Out-File command. I’ve also seen this apply to a few other situations when using PowerShell to output some form of text – in particular feeds for Palo Alto Networks Next Generation Firewalls.

For some time there have been plenty of examples of backing up Palo Alto Firewalls with curl commands (extracting the files using the XML API) however that may not sit well with some Windows administrators who want to use PowerShell. As such I’ve put together the BackupPANNGFWConfig repo on GitHub which contains the scripts to get ahold of the API keys needed and then to perform the backups for a series of firewalls.

To get the scripts drop by the link below and for the configuration see the screenshot sequences in this post. You will need a basic understanding of Palo Alto Firewalls, PowerShell and Windows Server to work through these steps.

Super important note, this script is configured to use a TLS1.2 connection to the firewall as well as only allow connections to a firewall with a trusted security certificate – if you jump on the web management interface of the firewalls from the server that you are running the script from you should see the ‘secure’ padlock icon in the address bar.

https://github.com/jamesfed/BackupPANNGFWConfig

With the scripts all configured you will then want to configure a scheduled task on the server to take these backup files on a regular basis.

In this new blog post series I’ll be looking at (normally a selection of 3) cool articles, news and other blog posts that I find interesting during the day. For this week we have PowerShell tricks, a detailed article on securing the Windows Firewall and an (old but very interesting) write up on the woes of network administrators when everything goes wrong.

PowerShell tricks: Splatting
New to me (always learning!) this trick allows you to populate the parameters for a PowerShell cmdlet in a table (makes for much neater formatting) to then pass into the cmdlet as a single object.

Endpoint Isolation with the Windows Firewall
The Windows Firewall may seem like a bit of a beast from time to time but this article makes some great points on how to build out a set of secure policies that can apply to pretty much any environment.

All systems down
A true disaster story – quite old (2003) but really worth a read to see what lessons you can take home.

Having recently changed from using PowerShell ISE to VS Code I’m still discovering all the super awesome new features of it (be sure to get a copy of the Keyboard shortcuts from this page – https://code.visualstudio.com/docs/getstarted/keybindings). To get started I’ve changed the default new file language to PowerShell (not that you can’t change it to anything else though!).

To do this follow the short guide in the screenshots adding in the line shown in the gist below.

Thanks to the organising committee of the (Oxford and Cambridge) College IT Conference 2018 held at the RAF Museum (Hendon) for the invite to talk about PowerShell and Server Core! As promised the video from the presentation is now up on YouTube; in addition the slides as PowerPoint and PDF can be seen below.

  Presentation (PowerPoint) (28.5 MiB, 1,390 hits)

  Presentation (PDF) (4.9 MiB, 1,511 hits)

30/03/2018 Update

Microsoft have published this blog post – https://cloudblogs.microsoft.com/windowsserver/2018/03/29/windows-server-semi-annual-channel-update which clarifies the difference between the Long-Term Servicing Channel (Server 2016/2019/so on) against the Semi-Annual Channel. Do have a read!

With thanks to the 50 staff from across the University for attending please see below the links to the videos and PowerPoints of the day!

Direct link to Playlist – https://www.youtube.com/watch?list=PLRxbdlgJzwyjAf820T0u4GpP0E01a9LEX&v=u-GVJ_0VuRM

Slides as PowerPoint

  1 Intro (4.3 MiB, 1,548 hits)

  2 MDT (85.2 MiB, 1,925 hits)

  3 PowerShell (27.5 MiB, 1,668 hits)

  4 PRTG Network Monitor (47.5 MiB, 1,735 hits)

  5 OpenVAS (32.9 MiB, 1,568 hits)

  6 WSUS and Chocolatey (60.3 MiB, 1,779 hits)

  7 NPS and VLANs (10.7 MiB, 2,656 hits)

Slides as PDF

  1 Intro (2.0 MiB, 1,674 hits)

  2 MDT (2.2 MiB, 2,030 hits)

  3 PowerShell (1.8 MiB, 2,147 hits)

  4 PRTG Network Monitor (3.2 MiB, 1,596 hits)

  5 OpenVAS (2.3 MiB, 1,733 hits)

  6 WSUS and Chocolatey (2.9 MiB, 1,957 hits)

  7 NPS and VLANs (1.4 MiB, 2,114 hits)

Stay tuned over the coming days for the scripts that are mentioned through the video which will be linked to from this post.

A little bit of fun today with Milestone XProtect (in our case the express version) today; with the goal of improving our documentation I wanted to somehow obtain a list of all of the hardware devices (and to some degree the cameras) including there names, MAC addresses and IP addresses from our XProtect server.

Lone behold the configuration.xml file typically stored at “C:\ProgramData\Milestone\Milestone Surveillance\configuration.xml” held just the information I wanted; a little bit of PowerShell later and I had CSVs with the information in a human readable form.

To do the same on your server follow the guide using the Export-MilestoneConfig.ps1 script show below.

Download Export-MilestoneConfig.ps1 (download from GitHub)

This entry is part 2 of 4 in the series A Windows SysAdmin installs and uses OpenVAS

Following on from the previous post (A Windows SysAdmin installs and uses OpenVAS – End to end guide – Simple Beginnings) in this post we’ll be using PowerShell, OpenVAS and the OMP (Open Management Protocol from Greenbone) to create a Target (a machine/device) to conduct some Pen Testing against, create a Task to scan the target and then generate a report.

The final step is quite possibly the most important though; it’s worth pointing out (hopefully the obvious) that you could have the most amazing Pen Testing software package on the planet but unless you then absorb the reports and take action to Mitigate/Resolve/Eliminate the risks identified it’s all just a horrible waste of CPU cycles.

A quick note – this guide is shown as only a small example of how you can get started with OpenVAS, stay tuned for more in depth guides!

Getting Ready

In this first stage we will download the OMP client for Windows (from http://docs.greenbone.net/GSM-Manual/gos-4/en/tools.html#omp), get it into the right place on our computer as well as create a omp.config file (you can download an example from below) which will provide settings and credentials to the OMP client.

Example OMP File (hosted on GitHub – https://gist.github.com/jamesfed/4ed9be7de2adb83d1d442cc06ea1dbeb).

In addition to follow through with this guide you should download the .ps1 file below which contains the PowerShell code for the steps shown in the screenshots.

OpenVAS-Simple-Example.ps1 (hosted on GitHub – https://gist.github.com/jamesfed/6a5c6634abc12c180f125e25c2764d1f).

Creating a Target

Creating and kicking off a Task

Exporting the Report

Reading the Report

There’s more!

To discover more about the omp.exe tool take a look here – http://docs.greenbone.net/GSM-Manual/gos-4/en/omp.html#access-with-omp.

In the next post of this series I’ll be covering how we can take these simple beginnings and start to build something more in depth through OMP and PowerShell.

If you are running (or use) the Sympa Mailing List but also use Windows PowerShell then you may want to be aware of PSSympa which recently went v1.0 on GitHub and the PowerShell Gallery.

In this release we have…

Functions

  • Get-SympaLogin (to login and get a session cookie – the result of which is used with all other functions)
  • Get-SympaMailingListMember (get the members of a list or list(s))
  • Add-SympaMailingListMember (add a member(s) to a list)
  • Remove-SympaMailingListMember (removes a member(s) from a list)
  • Test-SympaMailingListMember (checks to see if someone is a Subscriber, Owner or Editor of a list)
  • Sync-SympaMailingList (based on the contents of a reference CSV makes changes to the membership of a list)

Samples

  • How a CSV storing credentials might look (samplecredsfile.csv)
  • How a CSV that is used to Add/Remove members in bulk to/from a single list (samplememberslist.csv)
  • How a CSV that is used with the Sync- function would look (samplesynclist.csv)

Super Awesome Features

  • Credentials can be stored in a CSV to avoid them being typed in as part of a wider script
  • Pipeline support for members in lists

How to get it

The PowerShell Gallery is the best route to get your hands on the Module, see this link – https://www.powershellgallery.com/packages/PSSympa for the full details in short though you should only need to run the following command at your PowerShell prompt (assuming you are running a recent version of PowerShell) to install the module on your PC.

Install-Module -Name PSSympa

Continue reading