C:\> sc queryC:\> sc config "<SERVICE_NAME>" start= disabledC:\> sc stop "<SERVICE_NAME>"C:\> wmic service where name='<SERVICE_NAME>' call ChangeStartmode Disabled
Host Firewall
View all rules:
C:\> netsh advfirewall firewall show rule name=all
Enable or disable the firewall:
C:\> netsh advfirewall set currentprofile state onC:\> netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutboundC:\> netsh advfirewall set publicprofile state onC:\> netsh advfirewall set privateprofile state onC:\> netsh advfirewall set domainprofile state onC:\> netsh advfirewall set allprofile state onC:\> netsh advfirewall set allprof ile state off
Creating and Using a Proxy Auto Config (PAC) File for Suspicious URLs and IPs:
function FindProxyForURL(url, host) {
// Send bad DNS name to the proxy
if (dnsDomainIs(host, ".badsite.com"))
return "PROXY http://127.0.0.1:8080";
// Send bad IPs to the proxy
if (isInNet(myIpAddress(), "222.222.222.222", "255.255.255.0"))
return "PROXY http://127.0.0.1:8080";
// All other traffic bypass proxy
return "DIRECT";
}
Application Restrictions
Using Applocker - for Server 2008 R2, Windows 7, or higher:
Rules for executable files (.exe, .com)
DLL rules (.dll, .ocx)
Script rules (.ps1, .bat, .cmd, .vbs, .js)
Installation program rules (.msi, .msp, .mst)
Working Steps with Applocker (Requires GUI):
Step 1: Create a new GPO.
Step 2: Right-click on it to edit, then navigate through Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > Applocker. Click "Configure Rule Enforcement".
Step 3: Under "Executable Rules", check the "Configured" box and ensure "Enforce Rules" is selected from the drop-down box. Click "OK".
Step 4: In the left pane, click "Executable Rules".
Step 5: Right-click in the right pane and select "Create New Rule".
Step 6: On the "Before You Begin" screen, click "Next".
Step 7: On the "Permissions" screen, click "Next".
Step 8: On the "Conditions" screen, select the "Publisher" condition and click "Next".
Step 9: Click the "Browse" button and navigate to any executable file on your system. It doesn’t matter which one.
Step 10: Drag the slider up to "Any Publisher" and then click "Next".
Step 11: Click "Next" on the "Exceptions" screen.
Step 12: Name the policy, for example, "only run executables that are signed" and click "Create".
Step 13: If this is your first time creating an Applocker policy, Windows will prompt you to create a default rule, click "Yes".
Step 14: Ensure "Application Identity Service" is Running.
PS C:\> netsh firewall set logging droppedpackets=enable connections=enable
Bash Script for Linux
Service Information, List, Start, and Stop services in Ubuntu, and List All Services:
Service Information:
service --status-all
ps -ef
ps -aux
# List, Start, and Stop services in Ubuntu:
/etc/init.d/apache2 start
/etc/init.d/apache2 restart
/etc/init.d/apache2 stop # (stops only until reboot)
service mysql start
service mysql restart
service mysql stop # (stops only until reboot)
# List All Boot Up services:
ls /etc/init/*.conf
# Check Boot Up service status:
status ssh
Example Firewall (iptables) Commands:
Save All Existing iptables Rules:
iptables-save > firewall.out
# Edit File Containing Rules:
vi firewall.out
# Reload iptables Rules:
iptables-restore < firewall.out
# Example iptables Commands to Limit IPs and Ports:
iptables -A INPUT -s 10.10.10.10 -j DROP
iptables -A INPUT -s 10.10.10.0/24 -j DROP
iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -j DROP
iptables -A INPUT -p tcp --dport ssh -j DROP
# Block All Connections:
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# Logging All Denied Rules in iptables:
iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
Example Password Commands:
Change Password:
passwd # (For current user)
passwd bob # (For user Bob)
sudo su passwd # (For root)
Example Host File Commands:
Add Malicious Domain and Redirect to localhost:
echo "127.0.0.1 <MALICIOUS DOMAIN>" >> /etc/hosts
# Check Host Files by Pinging 127.0.0.1:
ping -c 1 <MALICIOUS DOMAIN>
# Restart DNS cache in Ubuntu:
/etc/init.d/dns-clean start
Example IPSEC Commands:
Allow Firewall for IPSEC Traffic:
iptables -A INPUT -p esp -j ACCEPT
iptables -A INPUT -p ah -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
# IPSEC Traffic Pass Setup using Racoon:
# Step 1: Install Racoon on <HOST1 IP ADDRESS> and <HOST2 IP ADDRESS> to enable IPSEC tunneling in Ubuntu.
apt-get install racoon
# Steps 2, 3, 4, and 5 need further manual configurations as per original text.