CosmosKey

Powershell Wake-OnLan Function

2010-09-11T21:03:00.000+01:00

Me and my colleague were discussing just before the left for the weekend and at one point he said he said; "I always switch off my PC before the weekend and it's always switched on when I come back on Monday. It didn't used to do that so they (the desktop operations team) must have deployed Wake-on-Lan". This triggered a thought in my head, how does Wake-on-Lan work. So after my colleague left I googled around a bit and found this piece of java code. After seeing how easy it is to send a Wake-on-Lan magic packet I couldn't stop myself from spending another half an hour at work to build a powershell Wake-on-Lan function.

To wake a PC up just run the following:

PS C:\PS> Wake-OnLan -BroadCastAddress 192.168.0.255 -MacAddress 32:2D:F4:32:7D:E5

Where -BroadCastAddress is the IP Address subnet address and where -MacAddress is the mac address of the computer to wake up. The -MacAddress parameter takes the address in either the colon (32:24:F4:32:7D:E5) or the dash (32-24-F4-32-7D-E5) format. Here is the function...

Function Wake-OnLan {
param(
  [string]$BroadCastAddress=$(throw "Mandatory -Parameter -BroadCastAddress missing, for example 192.168.0.255"),
  [string]$MacAddress=$(throw "Mandatory -Parameter -MacAddress missing, for example 32:2D:F4:32:7D:E5 or 32-2D-F4-32-7D-E5")
  )
  [void][System.Reflection.Assembly]::LoadWithPartialName("System.Net")
  [void][System.Reflection.Assembly]::LoadWithPartialName("System.Net.Sockets")
  $udpClient = new-object System.Net.Sockets.UdpClient
  $endPoint = new-object System.Net.IPEndPoint $([System.Net.IPAddress]::Parse($BroadCastAddress)),10000

  $MacAddress = $MacAddress.Replace(":","-")
  [byte[]]$macBytes = $macAddress.split("-") | %{[byte]"0x$_"}
  [byte[]]$bytes = new-object "byte[]" $(6 + 16 * $($macBytes.length))
  for ($i = 0; $i -lt 6; $i++) {
    $bytes[$i] = [byte] 0xff
  }
  for ($i = 6; $i -lt $bytes.length; $i += $macBytes.length) {
    for($j = 0; $j -lt $macBytes.length; $j++){
      $bytes[$i + $j] = $macBytes[$j]
    }
  }
  $udpClient.connect($endPoint)
  [void]$udpClient.Send($bytes,$bytes.length)
  Write-Host "Magic packet has been sent"
}

Please enjoy!

Get Certificate Chain from any port with Powershell

2010-09-10T01:06:00.000+01:00

Some time back I needed to dump the certificate chain from an LDAP server. I cobbled together a small function to connect to any SSL/TLS port and download the certificate chain.

The function takes 3 parameters, -Server, -Port and -ToBase64. I think all of them are self describing. Without the -ToBase64 the function returns a X509Certificate2 object from which you can get the Subject, Issuer, Thumbprint (...) fields.

Sample execution:

PS C:\> Get-CertificateChain -server lon001 -Port 636 -ToBase64 > c:\cert.cer

I used the function to collect all certificates from all our Domain Controller in our Active Directory domain, lo and behold, we had a few Domain Controllers with old certs. So it was very useful. Here's the function...

Function Get-CertificateChain {
param(
[string]$server=$(throw "Mandatory parameter -Server is missing."),
[int]$port=$(throw "Mandatory parameter -Port is missing."),
[switch]$ToBase64
)
$code=@"
using System;
using System.Collections;
using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Text;
using System.Security.Cryptography.X509Certificates;
using System.IO;
using System.Threading;
namespace CosmosKey.Powershell
{
  public class SslUtility
  {
    private static byte[] CertChain;
    private static object Lock = new object();
    private static Hashtable certificateErrors = new Hashtable();
    public static bool ValidateServerCertificate(
        object sender,
        X509Certificate certificate,
        X509Chain chain,
        SslPolicyErrors sslPolicyErrors)
    {
      byte[] data = certificate.Export(X509ContentType.Cert);
      lock (Lock)
      {
        CertChain = data;
        Monitor.Pulse(Lock);
      }
      return true;
    }
    public static byte[] GetCertificate(string serverName, int port)
    {
      TcpClient client = new TcpClient(serverName,port);
          SslStream sslStream = new SslStream(
          client.GetStream(),
          false,
          new RemoteCertificateValidationCallback (ValidateServerCertificate),
          null
        );
      try
      {
        lock (Lock)
        {
          sslStream.BeginAuthenticateAsClient(serverName,null,null);
          bool didTimeout = Monitor.Wait(Lock);
        }
      }
      finally
      {
        client.Close();
      }
      return CertChain;
    }
  }
}
"@
  Add-Type $code
  [byte[]]$certData = [CosmosKey.Powershell.SslUtility]::GetCertificate($server,$port)
  if($ToBase64){
    [convert]::ToBase64String($certData)
  } else {
    $cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
    $cert.import($certData)
    $cert
  }
}

Please enjoy!

Powershell script to get Active Directory LastLogon

2010-09-08T16:08:00.001+01:00

As you probably know the Active Directory LastLogon attribute is not synchronized between servers so you need to query each server in the domain to find out the last logon of a user. A while back I knocked up this little function:

Function Get-LastLogon {
param(
  $Username = $(throw "Mandatory parameter -Username is missing")
)
$rootDse = [adsi]"LDAP://RootDSE"
$configNamingContext = $rootDse.psbase.properties.configurationnamingcontext[0]
if($username.ToLower() -notcontains "dc="){
  $defaultNamingContext = $rootDse.psbase.properties.defaultNamingContext[0]
  $searcher = new-object DirectoryServices.DirectorySearcher $([ADSI]"LDAP://$defaultNamingContext"),"(samaccountname=$username)",$([string[]]"distinguishedName")
  $result = $searcher.findall()
  if($result.Count -ne 1){ throw "Username not found"
  }
  $userDN = $result[0].properties.distinguishedname[0]
} else {
  if($username -match "^LDAP://"){
   $userDN = $([adsi]$username).psbase.distinguishedName[0]
  }
  $userDN = $username
}
$lastLogonObj = "" | select UserDN,ServerNameLastLogonMap
$lastLogonObj.UserDN = $userDN
$confSearcher = new-object DirectoryServices.DirectorySearcher $([ADSI]"LDAP://$configNamingContext"),"(objectclass=ntdsdsa)"
$lastLogonObj.ServerNameLastLogonMap = $confSearcher.FindAll() | % {
  $record = "" | select ServerName,LastLogon
  $serverDN = $_.GetDirectoryEntry().psbase.parent.psbase.properties.serverReference[0]
  $serverDnsName = $([adsi]"LDAP://$serverDN").psbase.properties.dnshostname[0]
  write-progress -Activity "Reading LastLogon value for $userdn from" -Status "server $serverDnsName"
  $record.Servername = $serverDnsName
  if(($([ADSI]"LDAP://$serverDnsName/$userDN").psbase.properties.LastLogon.count) -eq 1){
   $adsLargeInteger = $([ADSI]"LDAP://$serverDnsName/$userDN").psbase.properties.LastLogon[0]     $highPart = $adsLargeInteger.GetType().InvokeMember("HighPart",[System.Reflection.BindingFlags]::GetProperty,$null, $adsLargeInteger, $null)
    $lowPart = $adsLargeInteger.GetType().InvokeMember("LowPart",[System.Reflection.BindingFlags]::GetProperty,$null, $adsLargeInteger, $null)
    $bytes = [System.BitConverter]::GetBytes($highPart)
    $tmp = [System.Byte[]]@(0,0,0,0,0,0,0,0)
    [System.Array]::Copy($bytes, 0, $tmp, 4, 4)
    $highPart = [System.BitConverter]::ToInt64($tmp, 0)
    $bytes = [System.BitConverter]::GetBytes($lowPart)
    $lowPart = [System.BitConverter]::ToUInt32($bytes, 0)
    $value = ($lowPart + $highPart)
    $record.LastLogon = [datetime]::FromFileTimeUTC($value)
  }
  $record
}
$getDomainLastLogon = {$this.ServerNameLastLogonMap| ? {$_.Lastlogon -ne $null}|sort -Property LastLogon -Descending |select -first 1}

$lastLogonObj | add-member -MemberType ScriptProperty -Name DomainLastLogon -Value $getDomainLastLogon -PassThru

}

Run it as Get-LastLogon samaccountname or Get-LastLogon distinguishedname

. This will return a object with three properties UserDN, SererNameLastLogonMap which holds all the DC's LastLogon value for the user and DomainLastLogon which holds the latest LastLogon value in the domain.

Please enjoy!

Powershell script to generate an executable from a powershell script.

2010-09-06T19:52:00.000+01:00

I was helping someone with a bit of powershelling. The guy needed a small script which asked a user a few questions and then the account created a local account on the machine based on the answers. He had started to use some Windows Forms powershell code and helped him with a few small details. The problem is that it's a bit ugly to run a Windows Forms script with a big shell sitting in the background doing nothing.

There are a few different solutions out there to hide the Powershell console window but was thinking in the lines about. Hey why not just compile an executable with the Add-Type cmdlet, embed the script inside the executable and run the script from inside the executable. At deployment you only have to run the executable.

A little script compiles a Powershell script into an executable. The script is not brilliant and is only intended for two different scenarios.

Embed scripts where you do NOT want a console window. This executable allows NO console interaction.
Embed scripts where you keep the Runspace alive (the -KeepAlive switch) for event listeners. This is useful if you are register for WMI events or other events in your script.

Here it is, enjoy!

function New-PSExecutable {     

param(

    [string]$Scriptname=$(throw "Mandatory param -scriptname is missing."),

    [string]$Filename,

    [switch]$KeepAlive

)

$code=@" 

using System; using System.Diagnostics;

using System.Windows.Forms;
using System.Management.Automation.Runspaces;
using System.Management.Automation;
namespace CosmosKey.Powershell.Utils
{
    class RunEmbedded
    {
        private static string codeB64 = "@@@";

        private static string funcName = "CosmosKeyRunEmbedded";
        private static Pipeline pipe;
        private static Runspace rs = RunspaceFactory.CreateRunspace();

         static void Main(string[] args)
        {
            try

{

                rs.Open();

                pipe = rs.CreatePipeline();

                String script = System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(codeB64));

                System.Text.StringBuilder sb = new System.Text.StringBuilder();

                sb.AppendLine("function " + funcName + " {");

                sb.AppendLine(script);

                sb.AppendLine("}");

                sb.AppendLine("[reflection.assembly]::loadwithpartialname('System.Xml')");

                sb.AppendLine("[reflection.assembly]::loadwithpartialname('System.Management')");

                sb.AppendLine("[reflection.assembly]::loadwithpartialname('System.DirectoryServices')");

                sb.AppendLine("[reflection.assembly]::loadwithpartialname('System.Data')");             

                sb.Append(funcName);

                foreach(string arg in args){

                    sb.Append(" ");

                    if(arg.StartsWith("-")){

                        sb.Append(arg);

                    } else if (arg.Contains(" ")){

                        sb.Append("\"" + arg + "\"");

                    } else {

                        sb.Append(arg);

}

}

                sb.AppendLine("");

                pipe.Commands.AddScript(sb.ToString());

ZZZ

                CloseRunspace();

}

            catch (Exception) { ;}

}

        private static void CloseRunspace(){
            pipe.StopAsync();

            rs.CloseAsync();

}

    }
}
"@
    if(test-path $scriptname){
        $script:scriptFilename = get-item $scriptname
    } else {
        throw "Can't find script file"
    }
    if([string]::IsNullOrEmpty($filename)){
        $filename = $scriptFilename.Name.ToLower() -replace ".ps1",".exe"
        $filename = "$pwd\$filename"
    }
    Write-Host "Source script file:   $($scriptFilename.FullName)"
    Write-Host "Output executable :   $filename"
    $scriptBytes = [io.file]::ReadAllBytes($scriptFilename.FullName)
    $b64 = [convert]::tobase64string($scriptBytes)
    $newCode = $code -replace "@@@",$b64
    if($KeepAlive){
        $newCode = $newCode -replace "ZZZ","pipe.InvokeAsync();Application.Run();"
    } else {
        $newCode = $newCode -replace "ZZZ","pipe.Invoke();"
    }
    $formsAssembly = [reflection.assembly]::LoadWithPartialName("System.Windows.Forms")
    Add-Type $newCode -OutputAssembly $filename -OutputType WindowsApplication -ReferencedAssemblies $formsAssembly.Location 

}

To build the executable just load the function and run

    New-PSExecutable  [outputfile] [-KeepAlive]

The scriptname vaariable is mandatory obviously but the outputfile will be the scriptname without the .ps1 extension and with an .exe extension if it's left out.
The -KeepAlive flag will make sure that the application stays alive if the script is using events. The executable can be shutdown from within the script with [Windows.Forms.Application]::Exit() when using the -KeepAlive switch, if you need to exit the application from within.

Here are two sample scripts one test script for being executed without the -KeepAlive and one which uses events which is better compiled with the -KeepAlive switch.

Without -KeepAlive:

[void][system.reflection.assembly]::LoadWithPartialName("System.Windows.Forms")
[windows.forms.messagebox]::Show("Hey there's no script here... or is there ;)")
 

With -KeepAlive:

[void][system.reflection.assembly]::LoadWithPartialName("System.Windows.Forms")
[void][system.reflection.assembly]::LoadWithPartialName("System.Timers")
$timer = New-Object Timers.Timer
$timer.Interval = 5000
$global:maxTimes = 5
$job = Register-ObjectEvent -inputObject $timer -eventName Elapsed -sourceIdentifier Timer.Random -Action {
   $global:maxTimes--
   [windows.forms.messagebox]::Show($maxTimes)
   if($global:maxTimes -le 0) {
   [windows.forms.application]::Exit()
   }
}
[windows.forms.messagebox]::Show("Started. Runs 5 times")
$timer.start()

The scripts aren't perfect but they did what I needed. 

Please Enjoy!

Regards Johan Akerstrom