Good Ol' Oledump

Nothing quite like getting a Microsoft file to inspect and using a good old faithful tool, but in some cases it take more than a couple commands to get what you want. 

So I happened upon a request recently where I needed to quickly extract all the Macros from an XLSM file. One way would be to open the file in excel and just copy all the scripts out of it one by one using good old copy/paste, but I wanted something a little more elegant and it's been a while since I had to use any of my scripting skills so I went to work. Now keep in mind, I'm not much of a developer so I just wanted something to automate the macro extractions quickly and dirtily.  

Oledump only requires a couple steps to inspect a typical MS excel file:

1. Inspect the file to find the interesting contents:
2. Extract each interesting content to a file that can be inspected further
3. Profit! (or review and edit!)

But if there's 80+ macros in the file, we can use some simple bash scripting techniques to extract the files automatically. 

oledump.py <pathToFile/.xlsm> > oledump-summary.txt

Once you have the summary file, review it to find any contents with Macros (denoted with an M). Results may look similar to this:

• A: xl/vbaProject.bin
•  A1:        97 'FormSelectDate/\x01CompObj'
•  A2:       260 'FormSelectDate/\x03VBFrame'
•  A3:       263 'FormSelectDate/f'
•  A4:       364 'FormSelectDate/o'
•  A5:      1929 'PROJECT'
•  A6:       785 'PROJECTwm'
•  A7: M   30019 'VBA/SomeScript'

Then you can rifle through those items quickly with some simple bash scripting

for x in {2..6}; do python3 oledump.py -s A$x <pathToFile/.xlsm>  > <pathToResults>/oledump-A$x.txt; done  

(include -v for VBA compression - i.e. if there are VB Macros)

Now you should have a folder full of excel macros that you can safely review using your favorite file editor

Here's a list of some of the oledump parameters - it's useful for way more filetypes than just Excel

(run python3 oledump.py --help to get a full list)

•   -s SELECT, --select=SELECT
•                         select item nr for dumping (a for all)
•   -d, --dump            perform dump
•   -x, --hexdump         perform hex dump
•   -a, --asciidump       perform ascii dump
•   -A, --asciidumprle    perform ascii dump with RLE
•   -S, --strings         perform strings dump
•   -T, --headtail        do head & tail
•   -v, --vbadecompress   VBA decompression

I have done other weird stuff in the past with oledump to inspect and decompile outlook messages, but this simple script was still fun.  

Look forward to more technical posts in the future, but for now stay warm and keep learning!

Cheers

Null Modem Cables in a pinch

Ever have that issue where you are trying to connect to a serial device with a USB serial to console cable but the ends don't connect - if you're smart you might have adapters in your serial kit to get around this issue.  But if you're like me and a little less than prepared, you might be out of luck ... that is unless you hoard cables and happen to have a couple old Cisco terminal cables and some ethernet jacks laying around

Introducing the over engineered Null Modem Cisco cable adapter!

The way it works is pretty simple math:

A standard Serial DB9 to RJ45 Null modem connection requires the following pin mapping. 

DB9	RJ45
1	not used
2	3
3	6
4	7
5	4 & 5
6	2
7	8
8	1
9	not used

Each Cisco cable is wired this way but when you connect two of them together the pinouts cancel each other out which technically makes it a standard straight through serial connection, so in order for this hack to work the RJ45 ends needs to re-enable this pinout.  

So I went to work and carefully mapped the RJ45 ethernet jacks as shown, then connected each end of the Cisco cable to the USB to serial adapter connected to my computer and serial port on the target device. I was amazed to discover it worked, I now had local console access and could interact with the device.   

In the meantime I was looking on line and there are several inexpensive serial adapters available for order from the local electronics store that are intended to avoid all this hassle, but it wasn't really an option as I had limited time to complete the necessary work and couldn't leave my desk to go get them.  

This was a super fun project that helped me solve a work problem and let me think outside the box a little. I would recommend trying this hack out only if you're in a similar pinch and happen to have old cisco cables and ethernet jacks kicking around. I ended up purchasing the correct adapters after the fact, and who knows when I'll need them again, but chances are I'll never forget to keep them handy in case I do.

Money

 

Seems like the price of everything is going up and I don't know what to make of it. There's only so much of it we can make and I've never seen it grow on trees before, but wow I sure wish it did!

Start the year off with a positive attitude and make the most of the money you got because it goes faster than it comes.

Cheers

Love

As the Sublime song goes....

Lovin' is what I got
I said, remember that
Lovin' is what I got
And remember that
Lovin' is what I got
I said, remember that
Lovin' is what I got
(I got, I got, I got)

I don't have much to say this month but I think this says it all, we got to be nice to each other, and keep love in our hearts.  The holiday season always helps me stay more positive but listening to music like this masterpiece can bring me back anytime of the year.

Well, life is too short, so love the one you got
'Cause you might get run over, or you might get shot
Never start no static, I just get it off my chest
Never had to battle with no bulletproof vest
Take a small example, take a tip from me
Take all of your money, give it all to charity

Peace out and Happy New Year!

Kringle Con

 

It's the most wonderful time of the year! Truly the best time is here, SANS Holiday Hack Challenge is back and baby and it's cold outside so time to put on another log on the fire and probably inspect a few logs in the game.  Santa and his elves need some help again and this time we are going tropical.  

Come sail away to the islands and learn from the best in this interactive and fun challenge.

https://2023.holidayhackchallenge.com/invite

BTW - Alphabetically this post is out of order but I'm breaking the rules and jumping back into my yearly challenge. But KQL is involved, so maybe I'll add another meme here later

Update - originally I titled this Holiday Hack, but then it came to me ... Change the title to Kringle Con for alphabetical consistency... And add another meme for good measure

Jinx

Wow it's almost December! I jinxed myself this year, planned too much and now the end of the year looks bleak.  My energy levels are low, body aches everywhere, could be arthritis/probably going part crazy. Winter hasn't really set in yet but it is around the corner so maybe that's contributing too. I may just be old and wise enough now to detect weather changes in my hip. Time to regroup though, being jinxed is never easy to recover from, especially when you jinx yourself. But this is the thing about being jinxed in general, some times it's about finding a way to detect it before it happens to not let it continue to happen, because it will.  

When I say jinx I mean I had a goal that was well within reach, but somehow still managed to fall short on. It's been slipping over several weeks and rather than dig in and catch up I chose the easy route and "went easy on myself". Sure I'm fat and happy most of the time, but life would have been so much easier if I did this, this, and this. There's also the side quests I call hobbies. I do believe in investing in hobbies, but have to be careful not to get too invested in several hobbies at once. Well at least that's the hope, but I'm a sucker for an interesting idea and also have the attention span of a mosquito sometimes. Home projects always take longer than expected but like the sucker I am, I always think I can get it done quicker this time. So take vitamins, try to exercise even a little every day, and prepare a bug out bag for when times are tough. That way if the death comes knocking the Grim Reaper will have to try harder to catch me first.

Keep warm and stay motivated people, I hope you get to work on a fun project. Life's got it's ups and downs but there are ways to make things better, sometimes we have to look in unexpected places. 

El Matto

Ideas

 

Ideas, sometimes you have them sometimes you have none. I fell into that category lately, this week was
busy, no time for planning we are shooting from the hip today.  All week I struggled for ideas for this post and it happens to be the letter 'I' week anyway... so it only makes sense this weeks topic is about ideas and how some of the best one form randomly.

Although it was busy, I did have a fantastic week.  I managed to get out in the woods last weekend with some good pals to cut up a big old fallen log.  I had to cobble together some old door parts to make a locking handle for our new house mate.  I also had an inspiring moment after looking at the giant log I brought home and decided it was perfect time to take apart an old electric lawnmower to use the base of it as a log hauling cart. It's been sitting in the garage for years collecting dust and it worked well so I'll probably end up modifying it for some off road hauling in the woods.  Been jamming lots lately too, trying to get myself ready to eventually perform some open mic sessions.  The hardest part is getting up onstage, it's mostly nerves, and even if you know how to play folks like me tend to blank out at first, just have to ease into it. I've been on stages in the past so probably will be more worry than actual problems so I'll keep at it because it's fun.  Still have some bathroom renos to work on but I chip away at things slowly.

Here's what 15 minutes of inspiration got me this week, I want to add larger wheels, some straps and maybe an electric motor assist to get up larger inclines. That's a longer range goal but I do have a motor from this lawnmower still kicking around.... Hope you all find some inspiring ideas too, until next week, keep it tidy!

Halloween Hacks

It was Halloween this week and the weather made it extra nice for trick or treaters. Why not setup some Wi-Fi monitoring to help keep watch for visitors.  It's not an exact science to me, but my thinking was open kismet and monitor for devices. Well that's what I expected, it's a bit more complicated than that in practice, and I'm trying to stick to having fun, so let's just talk about some mean tricks to play on trick or treaters.   

Trick #1: We had an abundance of candy this year so the kids got spoiled rotten, but what if next year we don't?  Well you can always leave a sign outside that says "Please take one, Happy Halloween!!!"  along with a big old empty bowl! Trick or treaters will be mad at whoever emptied the dish and more likely to intervene if they see someone taking more than one candy elsewhere. Win win for the parents out there I say.

Trick #2: We have this Halloween skull door knocker that plays an audio clip and lights up it's eyes when you pull the knocker, but more often than not it self activates when we opened the door.  Lot's of fun, much less evil than the last trick.

Trick #3: ... I'm out of tricks Halloween past now, this week has been busy. I got leftover candy for Halloween, maybe I should save it for next year? hehe that's too evil, I'd forget and eat it anyway

I'm already a day over my usual Monday deadline to post so lets end this mess of a post with some words of encouragement:

"Not every day will you be your best, but you can always try again tomorrow, for it's the ups and downs in life that make it all worthwhile."

I just made that up right now, but I think I owe a lot of it to stuff I've heard others say so it's not too random. Until next time, keep your chin up so you can always see what's ahead!

Pet Grooming 101

 

 I live with a lot of pets so early on my wife and I purchased a dog grooming kit from a pet store. I figured I might be good at it because I had a background in cattle grooming through 4-H when I was younger so why not give it a whirl.  Previous experiences with grooming cattle taught me to be patient with animals, and I'd never been kicked before so I am pretty fearless. 

Our dog is a mixed breed doodle and generally very calm anyway so I had good luck trimming him.  We also have three cats, but only one in particular that's very fluffy and in need of an occasional hair cut. It usually goes well but sometimes he's temperamental.  Over the years I've gotten better at hiding the mistakes from when they move too quick, but often there's no more than a patch or two where I cut too much off. The embarrassment in poor old fluff's face when he comes in from another trimming...  He used to bite and claw a lot, but he gets so matted up it's pure relief when he gets a good buzz cut. 

Cat's aren't much different to trim only they scratch way more, so it's best to wear gloves and sturdy clothes.   Beware the hind legs that come out of no where and try to scar your thighs. It's better if you are careful and just go slow so the cat relaxes a little. It's not perfect advice so don't go too slow either, act fast when they are calm and you can accomplish a lot quickly. It's a power move for bellies, some cat's will dig in here, but if the mats are coming free they usually relent.  Keep a cool head and watch for biting, kicking, scratching and you'll do just fine

So that sums up my level of amateur expertise, I tend to look to the experts for real tips. Here's some tips I nabbed from the Internets (thanks My Pet & I blog - top search result presented on google)

 Seven tips for grooming your dog at home:

    Regularly brush your dog's coat to prevent matting.
    Trim your dog's hair – but use caution.
    Safely trim your dog's nails.
    Check your dog's skin as you groom.
    Teach your dog to enjoy grooming sessions.
    Regularly check your dog's ears.
    Don't bathe your dog too often.

All good tips, except I usually forget to do the first one as often as we should. Live and learn, until next time, keep it fashionable!

Football is hard

Having a son that plays football has taught me a lot about dedication, sportsmanship, and willingness to go all in for the team.  It amazes me because when I was a teen I  wasn't really interested in team sports. I much preferred doing things like biking, building, and running wild and free in the country.  I got into music and joined a garage band with some friends, but we never really took it too serious.  Football on the other hand requires a boatload of dedication. Early morning weightlifting and video review sessions, after school practice, games every week or two, and many bumps and bruises to heal from in between. It's amazing to see the level of dedication from the coaches and referees to family, classmates, and friends who show up to watch, coordinate, or volunteer. Beyond anything else there;s so much that goes on during the game that requires skill full thinking and improvisation.  Having different perspectives from the sidelines vs the dynamic out on the field on cheers, boos, calls made by refs, and the split second decisions made by the coaches and team mates, it's a complicated yet beautiful mess.  

The team didn't win many games this year, but they played amazing in spite of various player injuries, some arguably bad calls, and other slip ups. They played hard right down to the last second every game. Even this last game, after a penalty called in the final seconds, as they got a touchdown that inevitably didn't count, it feels like the ref just pulled the rug out from under them. You have to wonder how he feels about it too, perhaps he stands by it due to his perspective on the field or personal experiences, perhaps he thinks he made a mistake but it's too late to change his mind. Who knows, he made a call in a game, and sometimes luck isn't in your favor. Maybe it was meant to give the team a rest to heal up, grow stronger, and get right back to it. With training camps and off season leagues, it's never really over if you are dedicated enough. I hope some day I can feel that dedicated about a sport, but for now, family and too many hobbies are my jam.

Until next time, appreciate each other and don't work too hard! Or do work hard, but enjoy every moment.

Emulation Nation

 

Emulation is defined as "the effort to match or surpass a person or achievement, typically by imitation." In the computing world it's a slightly different explanation "reproduction of the function or action of a different computer, software system, etc." 

For the purpose of making society better, maybe it comes down to these two rules

If you are human: emulate good behaviour so others will emulate good behaviour too.

If you're a computer: emulate a better computer so other computers may emulate better computers (or video game consoles)

What else should we emulate to make the world better for those around us?

Success? Sympathy? Compassion? Empathy? Love? Loyalty? Fairness?

Docking Stations

 

Yeah, you read that correctly, today's post is all about my beef with laptop docking stations through out my career. 

My first job in tech started out with a Dell laptop and the old school docking station that could hold the laptop at an angle so you could still awkwardly use the laptop monitor and go dual screen with all sorts of conveniently wired in devices. The best part was it all connected in with a simple satisfying "click". Most laptop vendors at the time had similar styles all with unique connections on the bottom of the laptop slotted for a specific vintage of docking station. It was great until you had to switch to a new laptop, where every model practically required a new compatible dock. 

Most of my docking stations were always supplied through my job, I didn't own them, so I never gave them much credit but lately I've been feeling the industry has lost its clever design due to standardized ports. Lenovo was a little more compatible between the laptop models. Most companies I worked with preferred Dell or Lenovo, but then one year I got a Microsoft Surface tablet and a little later on ended up in a  sweet remote job that supplied me a Surface laptop and I felt a compatibility alignment which changed my life forever. I had picked up a used surface dock from a Kijiji ad shortly before I started this job and it became my #1 choice. The Surface lineup is not the most powerful systems out there, but generally very performant and the touch screen makes navigation a breeze. 

The dock had a magnetic connector that worked on multiple models for several years and put Apples charging cable to shame (In My Humble Opinion). The Surfaces magnetic connection bus allowed me to dock/undock my devices and worked well most of the time.

 Lately we have more USB options than ever to avoid being locked into a vendor based solution. Since moving back away from Surface laptops from work,  I  picked up a mobile docking unit that connects over USB-C for travel and onsite work. Still I am quickly learning these new models aren't really proper docking stations. They heat up quick and the monitor connectivity can be flaky in some models. Sure good ones provide expansion ports for additional features and network adapters. It's just not the same as that satisfying magnetic "shluck" sound or the old school "clack click" of the manual connectors.  I'm probably the weird one here, but n the world of cyber security programs and documenting the many problems with computers, mundane stuff like that helps bring some necessary excitement to my day.  Sometimes it even helps to make the sound as you dock: Schluck! Unshluck! and so on ... 

Haven't tinkered in the garage much lately so next week I probably will take a break and build or destroy something metal or electronic. Maybe build both! Maybe destroy one electronic thing and build a metal thing. So many choices in life. 

Be good to each other, we only exist for a short time!

Change Management

 

This year has been full of change, more than usual it feels like. It seems like it's happening to everyone, not just me. Heard so many stories from friends and family that make this year seem more overwhelming than most. There was no shortage of bad news during the first half of this year and it's not over yet.  It feels like we have been chasing an imaginary goal to bring things back to a normal state. 

The real problem with this plan is that change truly is inevitable and normal is always changing.  While we try to make the world around us more comfortable to what we have been used to, the world continues to evolve in ways we never imagined.  Just because everything is changing we shouldn't worry too much because our core beliefs still hold true and if a change truly works better it will stick around for a while and if it doesn't it will change.  

This weekend marked the autumnal equinox and you can see signs of changing seasons everywhere. Tree leaves are changing color and falling.  Weather is getting cold quicker at night and school is back in session. Personally I am going through lots of change this next week so it seemed fitting to make this post, got a new job with lots of new and exciting challenges, seems like it will be good, but it's much harder going from 4 months off to back to work. Will have to hit the ground running, but that's the way I like it.  

One thing I've learned over the years is embracing change generally leads to the best success and personal satisfaction. Resistance is futile when change is inevitable. New schedules will mess up routine but optimizations can be introduced to make a change more tolerable. Now for the tricky part, practice adapting to change whenever possible to become a more resilient human.  Take a lesson from the change management playbooks used in critical infrastructure, every change is reviewed regularly to help communicate intentions, plan for possible impacts, and stay prepared for back out and recovery plans if a change fails.

Cheers to change! For the better, worse or otherwise it will continue to happen!

Banjolele and Bass week

 

Decided to pick up the banjolele I had purchased a few years ago.  I was initially excited for the possibility of a tiny banjo like musical instrument one drunken night and purchased it on Amazon. When it arrived I spent about a week learning to play it and then ended up with a random injury on the pinky finger of my plucking hand.  It was a just a scratch in my opinion, but over a few weeks became very infected and uncomfortable. It sort of became a saga of it's own leading a journey of recovery that lasted months.  But enough about fingers, this is a post about banjolele's for those interested.

So after what seems like an eternity of lacking inspiration, I picked up the little fella this week and decided to learn a few tunes.  There's lots of great content online to teach you songs and proper methods to practice and I also have an eBook to dust off (Clawhammer Ukulele: Tabs and Techniques By Aaron Keim). It's a great book on the clawhammer technique which gives the banjolele the unique banjo twang. Some enjoy it more than others, although it's much different than playing bass. Still fun to play and unique in it's own way.  The finger picking style used for banjo maximizes the notes you can play in a strum sort of like playing triplets with a bass.  

I don't plan on becoming an expert at it, but knowing how to strum a few tunes made my week extra nice. Until next week, keep on doing your things, and just be happy!

Adversary Emulation

 

Did some playing with Caldera the other day...

More details to come as I learn more but for now let's just say you don't need rocket appliances to run this tool at home. Any old laptop within the past 10 years'ish will generally do. I'm sure there are some exceptions. I also managed to get the recently released OT plugins uploaded for bacnet, DNP3, and modbus with hopes of testing soon. So far I've only deployed a couple agents on sacrificial Linux hosts in the home lab.  I felt like I barely scratched the surface of capabilities of this tool, but it was very painless to setup, and includes impeccable documentation and training support.  Kudos to the folks at Mitre for releasing another great tool.

Until next time, keep on tinkering!

Brewing again... (part 2)

 

So no that the general brew day process planned out, time to figure out the grain bills.  I have an amber ale and a dark IPA in mind. The recipes I picked are both based on two-row malt barley and I have some old grains I want to use up also. The additional ingredients needed will cost about $40. This is a supplemental challenge so we'll be short on a few things but all sorts of odds and ends to choose from for specialty malts. The plan is just add in whatever I have kicking around clearing out some old ingredients I would have otherwise thrown out. This will be a journey, the recipes will be brewed on separate days allowing me to work out the bugs. 

I expect to make a few mistakes on along the way but I also want to experiment with a more casual brewing process, in the past I was pretty stringent in following the recipe and it works but can be stressful resulting in unwanted anxiousness on brew day. What I want to figure out, if there is really a big difference in the outcome if you switch up a few things?

I put in my order with the local brewing supply store and decided to wing it a little.  The schedule and recipe generally goes like this:

1. Thursday - pick up ingredients and mill grains. I plan on doing these recipes on different days but might as well mill everything at once, while we have the equipment out. I use a power drill to run the mill saving my arm from a lot of cranking.
   
2. Friday - 1st Brew - Fat Tire Amber Ale remix - most of the regular grain recipe with a few minor improvisations but swap out hops completely.  Instead of Willamette and fuggles, I had picked Citra, Lumberjack to  start and Simcoe hops to finish. Why? Well why not? It's for science! I also planned on dry hopping this batch but changed my mind in the end - let's try to keep it simple.
   
3. My memory on how to brew was rusty so I spent some time reading brewing books, comparing ideas and notes from past brews.   
1. As expected I messed up a little on brew day, but I think brewing can be a forgiving process as long as you keep it clean and be patient.
2. I put the Citra and Lumberjack in just before the wort had boiled - or so I thought - it ended up being another 20+ minutes before we say any signs of a rolling boil so altogether the Citra and Lumberjack stayed in about 90 minutes - and boil start was significantly delayed by the hop oils. It might end up a little bitter?
   
4. After brewing the wort, it's important to quickly cool it down to ~68 F before transferring to a fermenter and pitching the yeast
5. Then you monitor the fermentation process for 5-10 days
1. Should  start to see foam forming on top within 48 hrs
2. The airlock will bubble steady until fermentation is complete.  Watch for slow bubbling (i.e. 1-2 bubbles per 60 seconds)
3. Some yeasts will react more aggressively than others.  Some will have 1-2 inches of foam throughout the process while others may require intervention to prevent the fermenter from exploding at their most active time (definitely not a wanted outcome).
   

 

Brewing again ... (Part 1)

 

Decided to pull out the brewing gear after a few years of inactivity.  Brewing during COVID did not work out for many reasons - but mostly because I would have drank way more.  I think it's a good time to get some practice brews in and experiment a little more than before so here's a little mini-series about how it has progressed.  

This series of posts is intended to help future me remember how to brew again.

Keep in mind it took about a day to prepare and find all the brewing gear I had "strategically" scattered around the basement through various basement emergencies in the past 3 years.  This post will never help me with that however, I just need to be more organized about storage and perhaps brew more frequently.

Luckily there were some old ingredients safely stored which I was able to incorporate into the recipe.  About 25 lbs of two-row barley and a variety of specialty malt grains will fill in two recipes I had good success with in the past. While I was a little short on some ingredients I decided to improvise.  Also there was a cider kit that I've convinced myself is worthy of experimentation so after making the first brew I planned to reuse the yeast for the cider kit to see how it turns out.

For planning a brew it's important to have everything you need for brew day:

1. Clean and sanitized equipment
1. Brewing vessel/bucket/carboy
2. Kettle(s)
3. Stir spoon
   
4. Hoses and siphons
   
5. Hydrometer and sample tube
   
2. Malts/grains/hops are measured out and any whole grains milled coarsely
1. Grains will be added to large brew in a bag to steep in the brew kettle
   
2. Hops can be measured and placed in cloth bags to add to boil as needed
3. If you are limited on hop bags just tie the bag so it can be reopened but tight enough where it will not open on it's own.
   
3. Water is prepared and ideally room temp (to speed initial boil). 
1. Use Camden tablets or balancer chemicals if needed
2. I usually use tap water in recent brews but in the past have used store bought water jugs
4. General Notes
1. Initial brew to bottle time is 1-2 weeks for most standard recipes
2. it's best to track activities along the way, especially when you find a good process and want to replicate it later. 
3. Use a beer brewing notebook or template to keep track of all the important variables.
4. Original Gravity will be the reference point for initial alcohol potential. The final product may be lower or higher than expected from this initial reading but it's a good estimate.  Hydrometer or a good refractometer will be required for this measurement, it's also a good excuse to taste a sample
5. Final Gravity measured at bottling time can then be used to calculate the alcohol content of the brew after the yeast and enzymes have done their work  
• The simple calculation for ABV = (og – fg) * 131.25
• Online calculators use a more advanced formula for higher gravity beers ABV =(76.08 * (og-fg) / (1.775-og)) * (fg / 0.794)
  

Starting over

Crazy how time flies... I had big dreams for this blog but didn't do a whole heck of a lot with it yet. That's the key word 'yet', there's still time to get better and improve focus! We only have some much time on this planet, some say we should use it wisely. Some other people say to have no regrets, live life in the moment, one day at time.  I say whatever works for you - just do your best while handling all of life's curveballs, and accept that bad and good stuff will happen in life. It's a dream to think only good things will happen. I think there's also common sense in setting out with a plan to succeed and changing when needed.

So what's my goal now? Why all of a sudden now?  With news of the big G getting out of the domains business what will happen to elmatto.ltd?  Well, so far sounds like business as usual until the acquisition is complete. So for now, the goal is simple, use the domain services I've been paying for and work on my writing.  I have some ideas for some posts related to industrial cybersecurity, beer brewing, and other nerdy home projects.  Occasionally may post some health related content because we all need a little more self care and encouragement in this world. Be nice to one another and don't be afraid to hi-5 the occasional stranger, you may never know how much they needed it.

Until later, take care my friends!

El Matto

How to take down your free cloud account before it costs $$$

 OK so the time has come, we are all done with our Juicebox CTF and other experiments and the $100 credit is nearly running out (if you did it right).   The follow instructions are my quick reference notes, but really there's a great article here that provides a nice walkthrough: this is where i started.  https://www.websiteplanet.com/blog/cancel-digitalocean/

1) First things first - backup your data.  

    * I also recommend exporting terminal history so you can recall setup commands for future projects.

    * Using WinSCP or other SSH based file transfer tool (even windows 10 supports this now)

        https://winscp.net/eng/docs/guides

        https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh

2) After your data has been copied off the systems you setup, you can shutdown the VM's

3) With that completed, now you need to remove any special DNS settings (i.e. if you used a registed domain for any of your VM's  

    * In my case I had a google domain associated with it so referring back to my previous article, I undid the config settings both in Google domain services and Digital Ocean

    * After this step your domain is only referred through Google DNS so any VM's host records tied to this are gone, from this point on you will only able to connect with the cloud providers account console or if you ssh to the IP of the vm directly

4) Now we need to destroy the VM (and any others)

     * Now there's multiple prompts to makes sure you aren't making a mistake, but once completed they are gone

5) Now you can go to account settings and deactivate the account - make sure you purge your data 

    * After this your account is gone, bye bye, syanora, hasta nunca test VM's!

    * Don't forget to fill out the customer survey - you had some fun through their kindness, the least you can do is tell them what you think of the product, your input may even help make it better. (no royalties likely, but bonus gratitude is still worth it hehe)

Now to try out some other cloud services ... like Oracle Cloud Platform, why not give it a whirl ... look forward to more posts.  Until next time!

How to make a CTF

 In this blog article I'll explain how to build your own Capture The Flag (CTF) challenge and host it online for up to two months for free using a digital ocean droplet.

Requirements:

• A Gmail account to register with digital ocean
• A valid credit card, sorry it's a necessary evil
• A referral link from digital ocean providing $100 credit for up to 2 months.  
• Use mine if you like: https://m.do.co/c/45afc9316e43
• Lot's of patience - some of the setup is tricky - google is your friend
• Setup reminders... Monitor activity and remember to close out your account before the 2 months expires or $100 credit is used

Procedure:

1. Use your Gmail account and credit card to register for a digital ocean account
1. https://www.digitalocean.com
2. Login to digital ocean and create a droplet. 

    3. In this example we will use an Ubuntu VM (choose version 18.04), Basic $5/mo plan
    4. Scrolling down we will choose preferred datacenter, and root authentication method, tags and link the droplet to a project. 
    5. Create the droplet and go to the Droplets menu to access the settings and Recovery shell (alternately the droplet is accessible through SSH clients such as Putty)

    6. Configure Networking settings

            a) Configure the firewall to at a minimum, allow inbound access to the droplet on TCP port                         3000. 

  b) In the example below ICMP is also enabled for troubleshooting, but SSH and other ports can be added as required, just be sure to only allow access from IP's you want to allow access from rather than the default (All IPv4/IPv6)

            c) If you have a domain available, and want to use it, setup DNS records and link to the IP

            d) No domain - no problem, you're users will just need to be given the IP address to connect
    7. Install docker

            a) I just followed the instructions at this link:

       https://www.digitalocean.com/community/tutorials/how-to-install-and-use-docker-on-ubuntu-18-04

    8. Setup and start Juice Shop

            a) Run docker pull bkimminich/juice-shop
    9. Run docker run --rm -p 3000:3000 bkimminich/juice-shop

Connect and Hack

1. Connect to the new CTF page and begin hacking!
        a) Browse to http://<your IP or domain>:3000
2. Have fun and learn! 

        a) You can always use the companion guide to help you through the tough spots

        b) https://bkimminich.gitbooks.io/pwning-owasp-juice-shop/content/