Toolkit

Using the IIS ADSI object to retrieve the anonymous user password for a server via VBScript

I recently had to change the anonymous user account for a change request for a site in IIS, but unfortunately the change did not work and we had to roll it back. However, I didn’t have and wouldn’t have known the account’s password since IIS and windows changes it periodically.

So, out came the scripting tool belt and I found that I had a script written previously that let me get the anonymous user account and password through the IIS ADSI object.

Below is a snippet from the script to display the password.

Function Get_IUSR_Password(ServerName)
   Dim IIsObject
   
   Set IIsObject = GetObject (”IIS://” & ServerName & “/w3svc”)
   on Error resume Next
   Get_IUSR_Password = IIsObject.Get(”AnonymousUserPass”)
   On Error GoTo 0
End Function

Enjoy!

Very simple encryption example with VBScript

I previously mentioned a routine that I wrote to encrypt a string. Now, before the security folks look at the code… understand this:

This is intended only to obscure a string from a casual prying eye. It is NOT intended to be a replacement for true encryption like 3DES and RSA encryption. Please do NOT assume this routine is in any way secure or uncrackable. It is intended to only be an exercise in working with strings and is only as secure as the price you have paid for it. Nothing. Furthermore, it is provided as-is without warranties and by using it you agree that all risk from it’s use is transferred to you.

….Now that we’ve gotten the unpleasant legal disclaimer out of the way… Lets discuss the code!

Essentially, The code uses a variable length key to obscure the original string by iterating through the string you want obscured and adding the ASCII value of the character at each position of the original string with the ASCII value of a rotating “key character” in the key provided to generate a new ASCII value. This new ASCII value is then converted to a character and added to the newly encrypted string. The obscured string is further obscured by the fact that the original string is reversed prior to being changed. 

This key position changes after each character in the original string is obscured. The result is the key is iterated through sequentially as the original string is encrypted and when the end of the key string is encountered the iteration through the key string is started again from the beginning of the key string until the original string is completely encrypted.

This process works because the ASCII values in the typical string and the typical key string when added together do not exceed 255. (The highest possible ASCII character) Essentially, Strings and Keys with ASCII values higher than 126 should not be used or the result could be unpredictable– or worse yet, an unencryptable string.

Now that I’ve explained a bit about the premise… Lets look at the code!

Option Explicit

Dim temp, key

temp = “Now is the time for all good men To come To the aid of their fellow countrymen.”
key = “huasHIYhkasdho1″

temp = Encrypt(temp,key)
WScript.Echo temp
temp = Decrypt(temp,key)
WScript.Echo temp

Function encrypt(Str, key)
 Dim lenKey, KeyPos, LenStr, x, Newstr
 
 Newstr = “”
 lenKey = Len(key)
 KeyPos = 1
 LenStr = Len(Str)
 str = StrReverse(str)
 For x = 1 To LenStr
      Newstr = Newstr & chr(asc(Mid(str,x,1)) + Asc(Mid(key,KeyPos,1)))
      KeyPos = keypos+1
      If KeyPos > lenKey Then KeyPos = 1
 Next
 encrypt = Newstr
End Function

Function Decrypt(str,key)
 Dim lenKey, KeyPos, LenStr, x, Newstr
 
 Newstr = “”
 lenKey = Len(key)
 KeyPos = 1
 LenStr = Len(Str)
 
 str=StrReverse(str)
 For x = LenStr To 1 Step -1
      Newstr = Newstr & chr(asc(Mid(str,x,1)) - Asc(Mid(key,KeyPos,1)))
      KeyPos = KeyPos+1
      If KeyPos > lenKey Then KeyPos = 1
      Next
      Newstr=StrReverse(Newstr)
      Decrypt = Newstr
End Function

Essential tools: Wget, a command line tool to retrieve web pages

There is nothing more annoying than having a web server or site down and IE (or FireFox, for that matter) become dog slow or simply getting in the way of trouble shooting the page. Additionally, sometimes these browsers actually get in the way of troubleshooting the problem by masking the error page the server sends back– IE’s “friendly” HTTP errors messages, for example. When it comes right down to fixing the problem, sometimes you need to retrieve just the HTML code a particular web page sends simply for inspection or analysis. That is where our next essential tool comes in!

Wget is a small (~325K) command line utility that allows you to download a HTTP, HTTPS, or FTP file quickly from the command line and save it locally so you can open it with a text editor, simply have it in an alternate location, or use in a comparison to what a specific browser renders after download. Wget for windows can be downloaded here. It’s a powerful tool, and covering all the options in one posting isn’t possible, so let’s start off with a little syntax to get you rolling:

In its  simplest form you can download a specific page, including a full URL, as shown below:

wget http://www.gamersigs.net

Alternatively, you can download a site and all its linked items recursively to a specific number of levels. This is useful to archive a site or  to simply grab pages that the HTML uses, but doesn’t link to directly– Cascading Style Sheets (css) for example. The syntax below will recursively get 2 levels of www.msn.com and automatically create a directory called www.msn.com in the current directory.

wget -r –level=2 http://www.msn.com

If the page links to a HTTPS page, wget will automatically try to negotiate a SSL connection. You can optionally specify the SSL protocol to use by adding –secure-protocol=PR, where PR is either auto, SSLv2, SSLv3, or TLSv1. This is especially helpful in testing and ensuring your servers do not respond to the weaker SSLv2 SSL protocol.

If you deal with websites as a part of your Systems Administration duties– or if you’re just interested in it as a side project at the office, I’m sure you’ll add this tool to your essential tools.

Know of a tool that you think is essential? Post a comment here and if I don’t already have it in my tool belt, I’ll add it and give it a shot. If it makes the grade– I’ll add it to the list of tools to review. The only criteria are:

1. The tool must be free, or inexpensive with a “Per User” or “site” type license. (No pay per installation licenses, please)
2. The tool (or it’s installation file) must be small enough to fit on a 256Mb flash drive for portability.
3. Command line run time options are beneficial, but not required.
4. If it has ads… it needs be truly INVALUABLE.
5. It should make the user’s job easier by gathering information or preforming a task that a typical Network or Systems Administrator would preform.

Enjoy!

Essential tools: Tools every systems administrator needs to know about and use

If you read this blog regularly, you know that much of what I write about is VBScript. But that’s not completely the goal of this blog. The main goal is to make your life as a systems admin easier! (Scripting just happens to be a big way to accomplish this.) So, on occasion I do write about other topics.

One topic I plan on starting is one for useful tools I find to help make your job easier. (Please don’t applaud, just keep coming back and reading the blog.) To help identify these postings, I will place “Essential Tools:” at the front of the title and tag them “essential tools“.

This will be a virtual corner of the blog that you will be able to find free tools and applications that will either make your life easier or provide those sysadmins with less resources (read budget) than a fortune 500 company gives to the systems administration team to accomplish things.

Stay tuned, the first tool is on the way!