Windows

Using Sysinternals from the command line

 in Windows  tagged cmd / command line / HKCU / reg / registry / Sysinternals / windows by

Recently, we connected to a Windows machine using SSH and downloaded a fresh copy of the Sysinternal suite. When we tried to use PSexec from our command line shell, it would get stuck without warning. We were unaware that the Sysuinteral suite does not prompt the user to accept the EULA agreement without a graphical interface. For this reason, we did not know that we had to take some action, and we were waiting indefinitely for the modules to finish, killing the processes and restarting them.

Eventually, we realized that if we added the following key in the Windows registry, PSexec would be considered by the Sysinternal suite as a EULA agreement acceptance and thus becoming operational again.

reg ADD HKCU\Software\Sysinternals\PSexec /v EulaAccepted /t REG_DWORD /d 1 /f

psftp.exe: The server’s host key is not cached in the registry. You have no guarantee that the server is the computer you think it is.

 in Windows  tagged psftp.exe / sftp / sql / sql server / sql server management studio / windows by

Recently, we were debugging a scheduled job running on a Microsoft SQL Server Agent. After starting the SQL Server Management Studio, we saw that the specific task was using psftp.exe to upload some data securely to a remote server. When executing the job manually, it would work as expected. On the other hand, when the job would be executed automatically, it would always fail. After review the error logs, we got the following message:

Executed as user: FSRV\SYSTEM. …s\FTP\remote-server.ppk myuser@remote-server -batch -bc -be -b C:\putty\upload.txtThe server's host key is not cached in the registry. You  have no guarantee that the server is the computer you  think it is.  The server's rsa2 key fingerprint is:  ssh-rsa 2048 39:e4:84:b2:6f:bc:87:04:1f:21:bf:32:83:79:0b:cf  Connection abandoned.  DTSRun:  Loading…   DTSRun:  Executing…   DTSRun OnStart:  DTSStep_DTSExecuteSQLTask_1   DTSRun OnFinish:  DTSStep_DTSExecuteSQLTask_1   DTSRun OnStart:  DTSStep_DTSExecuteSQLTask_3   DTSRun OnFinish:  DTSStep_DTSExecuteSQLTask_3   DTSRun OnStart:  DTSStep_DTSActiveScriptTask_2   DTSRun OnFinish:  DTSStep_DTSActiveScriptTask_2   DTSRun OnStart:  DTSStep_DTSActiveScriptTask_3   DTSRun OnFinish:  DTSStep_DTSActiveScriptTask_3   DTSRun OnStart:  DTSStep_DTSDataPumpTask_1   DTSRun OnProgress:  DTSStep_DTSDataPumpTask_1; 34 Rows have been transformed or copied.; …  Process Exit Code 1.  The step failed.

The problem was with the account executing the scheduled job, which was different than the one that created the job. The second account, the one that was executing the scheduled jobs did not have any knowledge of the ssh-rsa key of the remote server. Because of this lack of information, psftp.exe could not verify that we were indeed trying to connect to the correct server. To fix this issue, we modified the psftp.exe execution command to match the following one:

C:\putty\psftp.exe -i C:\connections\FTP\remote-server.ppk myuser@remote-server -batch -bc -be -b C:\putty\upload.txt -hostkey 39:e4:84:b2:6f:bc:87:04:1f:21:bf:32:83:79:0b:cf

To help any reader that is not familiar with the psftp.exe and powershell (or cmd) we will breakdown the arguments of the above command:

  • C:\putty\psftp.exe : is the exact location of the psftp.exe binary on that server
  • -i C:\connections\FTP\remote-server.ppk : PPK files are PuTTY Private Key Files developed by Putty and they serve as storage for the private keys the program generated. In this case, instead of using a combination of username and password to authenticate, the client was given a private key to use as proof of identity and authenticity.
  • myuser@remote-server : The username and the domain or IP of the remote server.
  • -batch : Disables interactive prompts as no person will be supervising the script.
  • -bc : It displays batch commands in the same way they are run. It is useful for logging and troubleshooting.
  • -be : When running a batch file, this additional option causes psftp.exe to continue processing even if a command fails to complete successfully. An example you might want this to happen is the following: you want to delete a file and don’t care if it is already not present.
  • -b C:\putty\upload.txt : It specifies a file with batch commands. This argument helps users automate tasks by allowing them to set commands in advance.
  • -hostkey 39:e4:84:b2:6f:bc:87:04:1f:21:bf:32:83:79:0b:cf : Here, we copied the rsa-ssh key of the server that was displayed on the error and we explicitly defined it to let psftp.exe that it is trying to connect to the correct server. If you are not sure if the value you get at the errors is indeed the correct value, consult your system administrator.

Stop Windows 10 Updates

 in Windows  tagged stop / updates / windows by

Recently, we were working on a Windows 10 machine on a metered connection. Even though we are not fans of blocking updates, this time we had to stop the updates as they were sucking the data package dry. To do so we executed the commands of the block below in a command prompt with administrative rights.

To start a Command Prompt (cmd) with administrative rights we pressed Windows+X that showed the Quick Access menu, from the menu we clicked on Command Prompt (Admin). After that we got prompted by User Account Control window if it was OK to allow this application to make changes, where we clicked Yes.

In the new Command Prompt window we executed the following 3 commands that kill all services immediately related with the updates

net stop wuauserv
net stop bits
net stop dosvc

Explanation

  • net stop wuauserv stops the Windows Update service.
  • net stop bits stops the Background Intelligent Transfer Service service
  • net stop dosvc stops the Delivery Optimization service

Revert action and Start Windows 10 updates

To resume (actually restart them since we stopped them) the Windows 10 updates you can either restart the machine or in a command prompt with administrative rights execute the following:

net start wuauserc
net start bits
net start dosvc

Windows XP: Extend evaluation period (Not a permanent solution)

 in Windows  tagged evaluation / extend / rundll32.exe / SetupOobeBnk / syssetup / trial / windows / windows xp / xp by

Recently, an old machine running Windows XP SP3 had its hard disk replaced, since then the OS decided that the license was not valid and considered itself to be in a trial/evaluation 30 days period.
Since the activation/validation services of Windows XP got discontinued we could not reactivate the current setup using the internet.
We tried a few times to activate via phone but it failed as well..

Temporary Solution (mitigating the problem)

To give us some time to think about a solution, whenever Windows XP would say that the evaluation period was expired, we would boot into safe mode and then run this command rundll32.exe syssetup,SetupOobeBnk (in cmd.exe or in the Run option that is in the Start menu) that allows you to reset the evaluation period for up to 4 times (and if used properly will give you 150 days in total to find a solution).

Actual Solution

In the end, we used the installation CD to downgrade the installation using the repair option, then we tried the telephone activation again and it worked!
Although Windows XP was not complaining any more, that caused us some problems with the antivirus, as a shared system library (DLL) that was replaced was not compatible with the antivirus.
To resolve this issue, we booted the machine using a GNU/Linux live CD and replaced the library (DLL) from a backup that was in the old disk.

Warning: Downgrading the system using the installation CD most probably re-enabled old exploits and hacks making the system less secure.
Keep this information in mind as you cannot re-apply the updates to the system not even the security updates any more.