Ensight – Jeremy Wright

Whooo…. See the post describing the process here.

The download should be available for MSDN Universal / Express / Dev subscribers now, and for external beta groups by Wednesday (I’m told you can get your CD to you by Friday for those who are official beta groups). Some groups are reporting issues with build numbers, versioning, processors, etc. I suspect these are most likely due to MSDN’s upload / download system, which often has these issues due to minor human error. They’ll be fixed in the next few hours (if they aren’t already).

Okay, NOW I’m going to bed so I can actually get some work done tomorrow.

Security wiseman Anil John summarizes, links to and then adds to a great article on protecting against SQL Injection attacks.

You prevent SQL Injection using the following tactics:

* Constrain the input by validating it for type, length, format and range. Remember, ALL INPUT IS EVIL, until proved otherwise!

* Use type safe SQL parameters. The parameter collection in SQL provides type checking and length validation. So if you use the Parameters collection, input is treated as a literal value and SQL does not treat it as executable code. Another point is that the Parameters collection can be used to enforce type and length checks so that values outside of the range trigger exceptions. You can use the Parameters collection with both sprocs as well as dynamic SQL.

* Use filter routines that sanitize the code by adding escape characters to characters that have special meaning to SQL. An example would be adding an escape character to the single apostrophe character. Keep in mind that these type of filter routines can be bypassed by an attacker that uses ASCII hex characters. So they should be used as just another part of your defense in depth strategy.

It’s been awhile since I’ve posted any actual code. Most of the coding I’ve been doing this month has been in KiXtart. Most people will undoubtedly have not heard of “KiX” (the short form).

KiX is essentially DOS, on speed, for network admins of Microsoft networks. It has some pretty impressive functions. Normally it’s used as a login-script replacement. Some of what I’ve done has been in that space, other things I’ve done have been remote-execution scripts.

This script is for upgrading from ZENWorks 3.2 client to ZENWorks 4.0. It will also install the client if you don’t have one, and fulfills any pre-requisites that you might be missing.

Here’s the script:

; ZEN upgrade script - April 27, 2004
; Written by Jeremy C. Wright for the Health Sciences Centre

;**************************************************************
 ;
; EXECUTION CODE
;
;**************************************************************
 
GOSUB "setVals"
GOSUB "greetUser"

IF checkZenInstall ()=1
	tellUser ("nochange")
	EXIT
ENDIF

IF checkIEInstall ()=0
	GOSUB "doIEInstall"
ELSE
	GOSUB "doZenInstall"
ENDIF

tellUser ("nochange")
EXIT

;**************************************************************
;
 ; SUBROUTINES
;
;**************************************************************
 
:setVals
	; set the program and environment variables before initializing
	; BREAK OFF
	SetConsole ("SHOW")
	SetConsole ("MAXIMIZE")
	SetConsole ("FOREGROUND")
	SetConsole ("ALWAYSONTOP")
	CLS
RETURN

:greetUser
	; Initial comments to thank user for being patient
	? "This script will ensure you have ZENWorks properly installed."
	?
	? "Please be patient while this runs."
	?
	?
RETURN

:doIEInstall
	; Perform Installation of IE
	RUN "\\hscxntdb0012\ZenAgent\ie6install.bat"
	tellUser ("doingie")
	EXIT
RETURN

:doZenInstall
	; Perform Installation of ZENWorks
	RUN "\\hscxntdb0012\ZenAgent\zeninstall.bat"
	tellUser ("doingzen")
	EXIT
RETURN

;**************************************************************
 ;
; FUNCTIONS
;
;**************************************************************
 
FUNCTION checkZenInstall ()
	; Ensures ZENWorks is properly installed
	IF Exist ("C:\Program Files\Novell\Zenworks\zennw32.dll")
		$checkZenInstall=1
		RETURN
	ELSE
		$checkZenInstall=0
		RETURN
	END IF
	$checkZenInstall=0
ENDIF

ENDFUNCTION

FUNCTION checkIEInstall ()
	; Checks for the location of iexplore.exe on C and D, and checks version info
	IF Exist ("C:\Program Files\Internet Explorer\iexplore.exe")
		IF GetFileVersion ("C:\Program Files\Internet Explorer\iexplore.exe") < 6
			$checkIEInstall=0
			RETURN
		ENDIF
	ENDIF

	IF Exist ("D:\Program Files\Internet Explorer\iexplore.exe")
		IF GetFileVersion ("D:\Program Files\Internet Explorer\iexplore.exe") < 6
			$checkIEInstall=0
			RETURN
		ENDIF
	ENDIF
	$checkIEInstall=1
ENDFUNCTION

FUNCTION tellUser ($msgIn)
	IF $msgIn="nochange"
		?
		?
		? "Your system is up to date, have a nice day."
		?
		?
		RETURN
	ENDIF

	IF $msgIn="doingzen"
		?
		?
		? "We are now installing ZENWorks. Your computer WILL reboot."
		?
		?
		MESSAGEBOX ("Please wait... Your machine WILL reboot.","Installing...",48)
		RETURN
	ENDIF

	IF $msgIn="doingie"
		?
		?
		? "We are now installing Internet Explorer 6. Your computer WILL reboot."
		?
		?
		MESSAGEBOX ("Please wait... Your machine WILL reboot.","Installing...",48)
		RETURN
	ENDIF
ENDFUNCTION

To provide context, it's called in this manner:

IF INGROUP ("DESKTOP")
	IF @INWIN = 1
;		? "Windows NT Version is " + @DOS
	? "Updated Script, shouldn't run on 9x boxes"
		SLEEP 5
		CALL "ZENUPGRADE.KIX"
	ENDIF
ENDIF

The reason for the "INGROUP ("DESKTOP")" is that the "DESKTOP" group is our Global Group which assigns local admin rights. We can temporarily add users to this group, in which case the next time they login it'll run. Then we can remove them at a later date.

So far we've been adding 2-3 letters worth of users per day (about 500 users on average); and then removing 2-3 of the oldest letters.

Over the next week I'll also release scripts to convert clients from one print server to another, and to point clients at a local Software Update Services server.

Have a great weekend!

Vinnie’s got a great one again with Back to Basics #4.