How to SSH into a Cisco ASA firewall with Windows Powershell? - powershell

Would like use powershell to do some monitoring of a VPN tunnel and if outage detected, auto reset the tunnel.
Can Windows powershell SSH into a Cisco ASA firewall for issuing a firewall command?

There is an SSH module. I've only limited experience using it to change ILO passwords on HP servers. However, I'm confident it can be leveraged for more elaborate work.
You can install with:
Install-Module Posh-SSH
Make sure to do this in an elevated console. I'd also point out there are other SSH modules, I can't vouch even this much but you may want to play with them. You can find them with something like:
Find-Module *SSH*

Yes, since Windows 10 v1809, ssh is a built-in tool in Windows. You do not have to install anything else. Just issue:
ssh -l <USERNAME> <DNS/IP>
like on linux.

Related

VSCode: how to ssh remote connect to remote WSL2

Is it possible in VSCode to edit files within WSL2 of a remote PC. (This is like a combination of Remote-WSL and Remote-SSH.) I can connect to that remote PC via ssh and RDP.
The path \\wsl$\ does not seem to be available in my remote-ssh connection.
PCA - me, local, VSCode
^
|
ssh and/or RDP
|
V
PCB - remote, WSL2
(I currently have Windows OpenSSH set up on the remote PC, with the default CMD shell. I tried setting the shell to Bash but then the remote extension wouldn't install.)
Update Setting PC-B's ssh server shell to bash.exe does solve all my problems. I'm not sure why it didn't work before. See my answer below for more details.
Answering my own question I was certain I'd tried this before and it had not worked, but now that I try it again it works. Perhaps I just needed a reboot of Windows and WSL2.
Enable Windows SSH server on PC-B and set the shell to be bash.exe
# Powershell as Administrator
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service -Name sshd -StartupType 'Automatic'
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\WINDOWS\System32\bash.exe" -PropertyType String -Force
If you want authorized_keys-based login to this PC and your account is an Administrator account, you will need to follow the special instructions here: https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement (I have heard of having to manually fix the administrator_authorized_keys file permission at some point too. https://stackoverflow.com/a/64868357/600360 )
Using Remote-SSH connect VSCode from PC-A to PC-B (using Windows credentials) and tell VSCode that it is a linux server (because you're connecting to bash.exe within WSL2).
If you're behind a proxy server, add the proxy to your ~/.wgetrc.
Voila.
These steps taken from THE EASY WAY how to SSH into Bash and WSL2 on Windows 10 from an external machine where you can find more details.
If you want to connect to remote WSL, you probably should set it up to run own sshd instead of relying on hosting Windows to do the tunneling.
If I have got your problem statement right, the flow seems to be outlined in one of VS Code blog posts. Here I'll mention steps I think you will need to get to your target state.
Firstly, disable sshd on remote Windows so it does not occupy port 22. then, install and start sshd inside PCB:
# from PCB command prompt
# something like that, depending on your choice of distro
sudo apt remove openssh-server && sudo apt install openssh-server
# this would again depend on your chosen distro
sudo /etc/init.d/ssh start # after i do this - windows pops up a firewall prompt to allow me create a rule. you might need to add it manually
then you'd need to either enable password logins via ssh or (preferably) generate a key pair and put your public key into /home/your_name/.ssh/authorized_keys on PCB.
Assuming you have OpenSSH for Windows installed (this seems to be the client Remote SSH relies on), on your PCA follow something like so:
# something along these lines on your PCA
PS C:\WINDOWS\system32>ssh-keygen
# note location of .pub file and copy its contents into remote ./ssh/authorized_keys
# add generated private key to ssh-agent service
PS C:\WINDOWS\system32> Start-Service ssh-agent # if this fails - ensure service is installed and enabled
PS C:\WINDOWS\system32> ssh-add path\to\your\private_key # ensure you have dropped all permission except your own user
Watch out for permissions:
ssh keys are considered secret, so neither client nor server would start unless you drop all permissions from your key material. On linux do chmod 600 .ssh/authorized_keys, and for windows ssh-agent follow instructions from this SE answer.
The above may seem a bit daunting but is in fact very standard SSH setup procedure
easy steps
just update your vscode to the latest version
install Remote Development extension pack
allow WSL2 connection in the settings
if my answer helped you upvoted :D
I know it's been a while since the post, but here is a useful answer that uses Remote -- Tunnels extension.
https://stackoverflow.com/a/75389647
It appears that, for now, you need to manually install the CLI in WSL in order for it to work. The downloads can be found here. Since you are on Windows, I would recommend the x64 CLI download. When you extract the tar.gz file, you will get a file named code. I would recommend moving it to your home directory for ease. To open the tunnel, run ./code tunnel (from wherever you put the code file) to force the new CLI. If you use code tunnel it will still use the Windows version.
Source: https://github.com/microsoft/vscode/issues/171196

Hyper-V Enhanced Session Mode Does Not Work

I am new to virtual machines so pardon my ignorance.
I have a host machine running Windows Server 2012 R2 and I'm trying to run a VM with Windows 8.1 Enterprise using Hyper-V. I need to be able to use USB devices on the VM.
Please check screenshot for the Hyper-V settings and the VM settings. The VMConnect does not have 'Show Options' to select local resources.
I tried using Remote Desktop Connection to the VM but nothing happens when USB devices are plugged in the host machine.
Not sure what I'm missing here.
Any help in fixing this will be greatly appreciated. Thanks!
Hyper-V Settings
VM Settings
If the USB device you want to use in the VM is a USB memory stick share it with the RDP local resources option as a Drive instead of the trying to replicate the USB port itself.
Eg:
There is a dependency(XRDP) to be installed in order to enable Enhanced Session Mode. Please follow the following steps or watch this video for more clarity.
Visit https://www.youtube.com/watch?v=LS2m6iyG7_M&ab_channel=VikeshYadav
On hyper-v linux machine:
git clone https://github.com/Microsoft/linux-vm-tools
cd linux-vm-tools/ubuntu/18.04/
sudo chmod +x install.sh
sudo ./install.sh
On windows machine:
set-vm -VMName ubuntu -EnhancedSessionTransportType HvSocket
I've got Win8.1 guest system (1 gen VM) and Win10 as host. Tried pretty much everything, but wasn't able to enable Enhanced Mode (simply grayed out all the time), unless I enabled RDP connections in the guest system (Control Panel, Allow remote access to your computer). After this change VMConnect with ability to share local resources appeared on attempt to connect to the VM.
Hope this helps all the people who find this thread while googling.

Psexec brute forcing credentials

I am currently pen-testing with a Kali software installed machine and a Windows 8 installed Machine.
I am trying to gain access with a psexec_command attack with Metasploit.
Is there maybe a way that I could brute force the credentials for the psexec?
Yes you use a wordlist or generator against -p parameter of psexec.exe after getting a username with wmic.exe or another tool. I don't know of a way to get users in Linux I'm sure there is a tool though. With Linux you can probably do a bruteforce tool in bash using pipes or something.

Connecting to a remote CentOS machine

I am trying to connect to a remote system which has CentOS running on it from a Windows machine. I am getting the following error:
My remote computer is on and is available on the network. I tried following the steps mentioned on this website http://www.techotopia.com/index.php/Remote_Access_to_the_CentOS_6_Desktop to enable remote access on centos as well.
Currently I can access the remote sever through commandline utility like Putty only.
I use VNC for remote GUI admin work on CentOS device's from windows its nice and easy to set up and use, below are links to CentOS 6.5 set up guide and 7
https://www.howtoforge.com/vnc-server-installation-centos-6.5
https://www.howtoforge.com/vnc-server-installation-on-centos-7
Let me know how you get on :)
As posted by PaulM, I followed the steps in the website to install VNCServer on the centos machine.
To connect from my linux machine, I wrote the following commands:
vncviewer
IPAddress:5901
Adding the port number specifically made it work
CentOs to centOs Only
No Need Any Softwares Already Centos have TigerVnc Viewer
1.Enable Remote desktop in your centos system
Goto System-->Preference-->Remote Desktop
**i.Enable allow other user to view your Desktop**
**ii.Enable allow other user to control your Desktop**
**iii.You must confirm each access to this machine allow or cancel**
**iv.if you ask any password to enable and type your password**
Notification Area:
Some one connect your system its enable to shows the icon on top panel.

Need to run command on a remote server with no access to remote desktop

As the title describes I need to run a command on a remote server and I do not have access to remote desktop! I head that this should be possible using Powershell, but I can't find any good tutorials on this.
Recommendations?
The easiest way is to use psexec.exe (Part of Microsoft Sysinternals).
You can also use powershell.
I wrote a blogpost about these two alternatives a few days ago:
http://blog.degree.no/2012/03/executing-commands-and-programs-on-a-remote-machine-using-powershell/
When using PSEXEC or PowerShell remoting you can execute a command on a remote machine, but it is not interactive with any currently logged on user. Using PowerShell requires 2.0 to be installed on your machine and remotely AND remoting must be enabled AND you must have admin rights on the remote computer.