1. Download xming from sourceforge

2. Open putty

3. Go to the SSH section>X11>Enable X11 forwarding

4. Open a connection

5. Run a command for something that only runs in a gui, like gedit.

6. The gedit window will appear on your desktop.

Setup netcat to listen (the machine receiving the data)

• Command: nc -v -l -p 10000 > command.txt
• Notes: -p is the port that you are opening up to receive the data. You can name the text file anything you want (usually wise to name it something descriptive).

Run a command on the sending machine

• Command: command | nc receiving_machine_ip_address 10000
• When the transfer is complete, kill the command using Ctrl-c

• The System Date and Time
• Current Network Connects
• Open TCP or UDP Ports
• Which Executables Are Opening TCP or UDP Ports
• Cached NetBIOS Name Table
• Users Currently Logged On
• The Internal Routing Table
• Running Processes
• Running Services
• Scheduled Jobs
• Open Files
• Process Memory Dumps

The System Date and Time

Check this to keep the machine time in sync with logs and trusted NTP server.

Windows Commands:

• date
• time

Linux/Unix Command:

• date

Current Network Configuration

Check this to see if an attacker is currently connected or running a brute force attack against the internet. Note that port assignments can be checked at www.portsdb.org.

Windows/Linux/Unix Command:

• netstat -an (Note that the -an flag specifies to check all network connections)

Open TCP or UDP Ports

Check for rogue ports that were not opened by the system. A suspiciously open port can be the sign of a back door created by an attacker. Note that port assignments can be checked at www.portsdb.org.

Windows Command:

• netstat -an

Linux/Unix Command;

• netstat -anp (the p shows the process number that opened the port)

Executables Opening TCP or UDP Ports

Using a tool called FPort distributed from www.foundstone.com, scan which executables are using ports. Compare the list to the list of questionable ports you gathered while running netcat. Research which process are system processes and which are suspicious.

Windows Command:

• FPort

Linux/Unix Command:

• lsof (adding -n command lengthens the output)

Cached NetBIOS Name Tables (Windows only)

Checking the NetBIOS Name Table cache will show the NetBIOS name or IP address of recently connected machines.

Windows Command:

• nbtstat -c (the -c switch instructs nbtstat to dump the cache)

Users Currently Logged On (Windows only)

Using the PSLoggedOn tool in the PSTools suite distributed at www.sysinternals.com you can see who is currently logged into your system. This would catch anybody that is connected remotely.

Windows Command:

• psloggedon

The Internal Routing Table

Checking the Routing Table will identify instances where an attacker is routing his connection to avoid a firewall or gain access from a machine with greater access.

Windows/Linux/Unix Command:

• netstat -rn

Running Processes

Using the pslist tool to check which processes are running will show which processes have been run by an attacker. The elapsed time will help indicate which processes were launched by the system and which were launched by an attacker.

Windows Command:

• pslist

Linux/Unix Command:

• ps -aux

Running Services (Windows only)

Using the PSService tool you can examine the services running on the target machine. Finding a rogue service can be valuable since attackers can run executables from them.

Windows Command:

• psservice

Scheduled Jobs

Attackers can schedule jobs to do things while they are not even there.

Windows Command:

• at

Linux/Unix Command:

• cron

Open Files

The PSfile tool will check for any files opened remotely on the machine. This will help determine more information about the attack.

Windows Command:

• psfile

Linux/Unix Command:

• lsof

Process Memory Dumps (Windows only)

Running process memory dumps and using tools to inspect the data will help gain additional information about the attacker and their intent. This is extensive and requires a large knowledge base to know what to look for.

Windows Command/Tool:

• userdump.exe (provided by Microsoft)

Full System Memory Dumps (Windows only)

Using the dd tool you can dump the entire memory of the target computer. It is wise to map a drive to a remote machine so that you do not overwrite valuable data.

Windows Command/Tools:

• dd

Loaded Kernel Modules (Linux/Unix only)

This command unloads the kernel modules so that you can inspect for items that are not system related.

Linux/Unix Command:

• lsmod

Mounted File Systems (Linux/Unix only)

These commands check for mounted file systems that are unexpected.

Linux/Unix Command:

• mount
• df

1. Open Putty, and create a session with any and all settings you would want in putty. Add tunnels, compression, etc, whatever you usually do when you start a putty session
2. Save your session for future use. You'll use the name of this session later.
3. Write a simple batch script that will load putty, and send a user name and pw.  Mine looks like this: "\putty.exe -load sessionname -l username -pw password
4. Save your batch file.
5. This s where we start using autohotkey.  You'll want to download this, and open it to create a new autohotkey script. Here's how my script looks:

;
; AutoHotkey Version: 1.x
; Language:       English
; Platform:       Win9x/NT
; Author:         A.N.Other <myemail@nowhere.com>
;
; Script Function:
;    Template script (you can customize this template by editing 

"ShellNew\Template.ahk" in your Windows folder)
;

#NoEnv  ; Recommended for performance and compatibility with future AutoHotkey 

releases.
SendMode Input  ; Recommended for new scripts due to its superior speed and 

reliability.
SetWorkingDir %A_ScriptDir%  ; Ensures a consistent starting directory.
#p::
Run "location of your putty batch file"
WinWaitActive, ahk_class PuTTY,,3
WinMinimize
WinWaitActive, ahk_class ConsoleWindowClass,,3
WinMinimize
return

#c::
If WinExist("ahk_class PuTTY")
{
 WinClose
}
If WinExist("ahk_class #32770")
{
 WinActivate
 Send {Enter}
}

return

Save that script and run it. When ever you press windowkey+p it will start putty.  When ever you press windowkey+c it will close putty!

WinToFlash - Install Windows from usb - Download page.

Bluetooth Mouse From Hell

I have a Microsoft 5000 Bluetooth Mouse. Unfortunately it has been a total headache to get it to work with Ubuntu and stay working. Below are the steps I have taken to remedy the issue:

1. Turn on your mouse and make it discoverable
2. Open a terminal and enter the command: hcitool scan
3. It should return a list of bluetooth devices in range (mine returned something like: 00:1D:D8:92:FE:45     Microsoft Bluetooth Notebook Mouse 5000)
4. Enter: sudo gedit /etc/bluetooth/hcid.conf
5. Add the following entry to the file (remember the name is the same returned in the previous step):
   device HardwareAddressHere {
name “Microsoft Bluetooth Notebook Mouse 5000”;
}
6. Run the command: sudo /etc/init.d/bluetooth restart
7. Verify that you get a message indicating that stopping and starting bluetooth is OK
8. Run the command: sudo apt-get install bluez-compat
9. With your mouse still in discovery mode, run the command: sudo hidd --search
10. Your mouse should now be paired and working. (this includes after reboot, it should automatically pair)

One Gig Wonder

I found a link on moko's blog that showed how you run Ubuntu Jaunty in 1024x576 on a Dell Mini 10. However, I have the Mini 10 with the HD screen (1366x768) which required a few additional steps to get it work right. Here is the entire process

First, create the file: /etc/apt/sources.list.d/ubuntu-mobile.list

Add the following content and save (these entries will change depending on the version of Ubuntu):

deb http://ppa.launchpad.net/ubuntu-mobile/ppa/ubuntu jaunty main
deb-src http://ppa.launchpad.net/ubuntu-mobile/ppa/ubuntu jaunty main

Open a terminal and run the following two commands:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys C6598A30
sudo apt-get update
sudo apt-get install psb-kernel-source psb-kernel-headers

Restart your machine and open the terminal again. Enter the command:

sudo apt-get install xserver-xorg-video-psb

Restart your machine again. You should now have 1366x768 resolution.

1. Download and install the actual Windows Royale theme.

2. Download the Royale Noir theme, and extract it to the C:\Windows\Resources\Themes\royale noir\ folder

3. Go to C:\Windows\Resources\Themes\ and open the Royale.Theme file in a text editor

4. Go to the [Visual Styles] section

5. Change the line "Path=%WinDir%resources\Themes\Royale\Royale.msstyles" to Path=%WinDir%resources\Themes\royale noir\luna.msstyles

6. Save and exit.

After that, you should be able to consistently select the Royale Noir theme from the apperances section.

Features

• Change SFX icon.
• Create shortcuts for current user or all users.
• Create environment variables.
• Run multiple programs one by one after extraction.
• Delete SFX file after extraction (Self-delete)
• Select overwrite mode for files.
• Hide extraction progress.
• Compress SFX stub with UPX to reduce size.
• Enable/disable XP Visual style.
• Set extraction path. Allow/deny users to change the path.
• Extract to temporary folder for software setups.
• Save/load settings.

7-Zip SFX Maker v2.0