restore

Many roads to IAT

Published December 1, 2011 |

A few days ago a friend approached me and asked how he could see the import address table under immunity debugger and if this could be done using the command line.

I figured this would be a good time to take a look at what the IAT is, how we can list the IAT and what common reversing hurdles could be with regards to the IAT.
Continue reading →

Posted in Malware and Reversing | Tagged corelan, iat, ida, immunity, import address directory, import address table, impre, lordpe, monaida-plugin, ollydbg, python, rebuild iat, reconstruct, resetsearchinindex-ps1, restore, reverse, reverse engineering, reversing, view names, windbg

In Memory Fuzzing

Published October 20, 2010 |

By Corelan Team (sinn3r)

Introduction In memory fuzzing is a technique that allows the analyst to bypass parsers; network-related limitations such as max connections, buit-in IDS or flooding protection; encrypted or unknown (poorly documented) protocol in order to fuzz the actual underlying assembly routines that are potentially vulnerable. Prior to the development of my fuzzing toolset, I was unsatisfied […]

Posted in Private | Tagged argument, function, functions, fuzz, fuzzing, ida, immunity-debugger-add-watch-on-memory-address, inmemoryfuzzer, memory fuzzing, point argument, pydbg, python, python-fuzzer-tutorial, restore, restore point, snapshot, snapshot point, tracer, user input, want fuzz

Backup & Restore Windows Server based Print Servers

Published October 23, 2009 |

By Peter Van Eeckhoutte (corelanc0d3r)

After having to recover a broken Windows Server based print server yesterday, I decided to write this small article on how to set up print server backups, and describe the simple process of recovering the print server after a crash (or even roll back printer drivers in case a newly installed driver messes up your […]

Posted in Scripts, Windows Server | Tagged 2000, 2003, 2008, backup-print-server-2008, print server, printbrm, printbrm-powershell, printer-driver-backup-2008, printerbackup, printerexport, printers, printers cab, printmig, recovery, restore, restore-print-server-2003, schedule, script, server-2008-r2-print-backup, Windows Server

How to properly restore (objects in) the 2003 AD database

Published October 2, 2007 |

By Peter Van Eeckhoutte (corelanc0d3r)

Windows 2000 /Active Directory has been around for more than 7 years now. I’ve been using AD for almost 7 years, and due to its stability, I never had to recover a deleted object in AD. (Knock on wood). So it’s not a real surprise to find out that a lot of admins don’t even […]

Posted in Active Directory, Windows Server | Tagged 2003, Active Directory, ad-2003-restore-object, authoritative restore, how-to-restore-the-ou-in-2003, ntbackup-restore-ntds-dit, ntdsutil, ntdsutil-2003-authoritative-restore, ntdsutil-restore-object, objects, recover-an-object-deleted-in-2003-ads, recover-tombstoned-objects-using-ntdsutil, recovering-a-ou-from-ntds-dit, restore, restore-2003-ad-user, restore-object-ntdutil, restore-ou-ad-windows-2003, restore-user-obiect-from-ntdsdit, restoring-opjects-from-ntds-files, windows-2003-ad-restore-ou

How to restore a Windows 2003 DC using ASR and VMWare

Published September 14, 2007 |

By Peter Van Eeckhoutte (corelanc0d3r)

The following procedure should work for any type of hardware, but I’ve used VMWare (so this procedure is also valid if you want to convert a physical Domain Controller to VMWare). Additionally, the procedure works for Windows 2003 server, but also for Windows XP (professional) Prerequisites : ASR backup .bkf file and the ASR floppy […]

Posted in Active Directory, Virtualization, Windows Server | Tagged 2003, Active Directory, apipa, apipa-address, ASR, asr-setup-could-not-detect-a-floppy-drive-on-your-machine-windows-2003, automated system recovery, bkfrestorescript, DC, how-to-restore-a-windows-2003-dc-using-asr-and-vmware, konvert-windows-asr-backup-to-vmware, naming-information-cannot-be-located-after-restore, ntbackup, restore, the-sysvol-and-netlogon-shares-are-missing-after-you-restore-a-domain-controller-from-backup, vmware, vmware-attache-bfk-file, vmware-converter-windows-server-2003-restore, windows, windows-2003-asr-procedure

AD 2003 DC Restore Technique using VMWare (without having to grant local DC/Domain Admin rights)

Published September 12, 2007 |

By Peter Van Eeckhoutte (corelanc0d3r)

In certain distributed AD scenario’s, Domain Admins group membership or local DC admin privileges are restricted to certain people only. This is a good thing to do, but it requires you to think about certain issues before they happen. One of these issues is backup and restore. Yes, you can schedule a system state backup […]

Posted in Active Directory, Virtualization, Windows Server | Tagged 2003, Active Directory, ad, bkf-to-vm, bkf-to-vmware, converting-dc-2003-to-vmware, dc-vmware-recover, domain-controller-vm-snapshot-fix-restore-mode, hacking-active-directory-restore-mode-vm, import-bkf-file-into-vmware, ntds-dit-restore-file-vm, problems-with-restored-vmware-dc, restore, restore-dc-to-vm, restore-vm-domain-controller, restoring-a-domain-controller-to-virtual-machine, vmware, vmware-recover-domain-controller, vmware-reinstall-drivers-windows-ntbackup-restore, vmware-server-2003-f8-directory-restore-mode

Restoring 2003 AD Objects using Windows 2008 Server

Published July 14, 2007 |

By Peter Van Eeckhoutte (corelanc0d3r)

Anyone managing an Active Directory knows about the administrative troubles and work that can be caused when an object (such as a user) gets deleted. The admin needs to either restore the object, and then manually fill out the attributes (such as password, group membership and so on), or restore a backup of the ntds.dit […]

Posted in Active Directory, Windows Server | Tagged 2003, 2008, Active Directory, active-directory-recovery-2003-auf-2008, can-i-restore-2003-ad-backup-in-2008, esentutl-p-for-ntds-technet, how-to-restore-active-directory-2003-from-ntbackup-to-2008, recover-win-2003-ad-on-win2008, restauration-ad-2003-vers-2008, restore, restore-2008-system-state-to-2003-server, restore-active-directory-2008-from-2003-backup, restore-ad-from-2003-system-state-to-2008-server, restore-server-2003-ad-to-2008, restore-to-alternate-location-access-ntds-dit, restore-user-obiect-from-ntdsdit, restore-windows-2003-group-policy-into-windows-2008, server, where-is-the-ntds-dit-in-an-alternate-location-restore, win-2008-recover-ad-with-files

Corelan Cybersecurity Research

:: Knowledge is not an object, it's a flow ::

Many roads to IAT

In Memory Fuzzing

Backup & Restore Windows Server based Print Servers

How to properly restore (objects in) the 2003 AD database

How to restore a Windows 2003 DC using ASR and VMWare

AD 2003 DC Restore Technique using VMWare (without having to grant local DC/Domain Admin rights)

Restoring 2003 AD Objects using Windows 2008 Server

Corelan Training

Donate

Corelan Team Merchandise

Corelan on Slack

Actions

Categories

Hi there!

We have good news for you!