Azure Powered External IP Address Returning Pages!

In my last post, we made 4 different pages that all did one thing, tell you your external IP address, now lets introduce the power of Microsoft Windows Azure!

Azure will let us run any or all of the 4 pages I showed you how to make earlier! Yes even PHP!

We will do this in 8 easy steps!

1. Signup for a Windows Azure trial (or in my case active my AWESOME MSDN subscription's Azure Subscription)
2. Go to the account management portal, and signup for the Website Beta Program http://account.windowsazure.com
3. Once accepted for the Web Site program (you will get an email, or just keep checking the management portal), go to the management portal, http://manage.windowsazure.com/ and create a new website using the Quick Create option. I called mine whatismyip, which will result in the FQDN of http://whatismyip.azurewebsites.net
4. Open the dashboard for your website, select "Reset Deployment Credentials". Enter appropriate username and password.
5. Still in the dashboard, make a note of the "Deployment User" and "FTP Hostname"
6. Open up your favorite FTP client, the server name will be the previously noted hostname, username will be the previously noted down username, password will be what you specified earlier.
7. Copy up the file or files for the IP returning page that you wish to use, I uploaded all 4!
8. Use the pages!

Here are mine:

http://whatismyip.azurewebsites.net/getip.php

http://whatismyip.azurewebsites.net/getip.aspx

http://whatismyip.azurewebsites.net/getip.ashx

http://whatismyip.azurewebsites.net/getip.asp

Making your own external IP address returning page

In my last post, I mentioned a number of web sites you can go to where you can find out what your external IP Address is.

Well below is PHP, ASP, C# - ASPX and ASHX.

PHP

ASP

ASPX

ASHX

Accessing the Internet from PowerShell: Getting Page Content

In this post, I am going to cover some more of the DownloadString() method of the .Net WebClient that we briefly touched on in my earlier post.

I am going to show you a function that will return your current external/public IP address.

There a numerous services out there that allow a user to get their external IP Address, most have two flavours, one which will return a nicely formatted page with text like “Your IP address is 123.123.123.123” whilst others are designed for automation and will simply return a plain text formatted page with only the IP address 123.123.123.123. Of course, you could make your own service and host it somewhere yourself. It is very simple to make your own page which can do this with a single line of C# in a ASP.Net page (.ASPX),  C# code in a Web Event Handler (.ASHX), PHP page or even classic ASP (.ASP) page.

A later post will cover making your own page, for today, we will test with one of the already existing services listed below:

• http://whatismyip.com –> These guys provide a good service, they make use of a separate automation page located at http://automation.whatismyip.com/n09230945.asp
• http://icanhazip.com/ 
• http://whatismyip.Akamai.com/ 
• http://b10m.swal.org/ip

WARNING NOTES

1. Some malware uses these sites to work out your IP address, some proxy servers and antivirus solutions may block access to their site.
2. Don’t hit this page more than once every 300s or you might get blocked.

The Function

Let’s start by writing a function that will perform the following:

1. Take an optional value of the URL, this will be the URL of a service which returns our external IP address as plain text. Like any of the ones listed above. If we don’t specify one, use icanhazip.com
2. Set the UserAgent to be that of an Internet Explorer User
3. Call the DownloadString function with the URL

Let’s take a look at a function which would return our current IP address:

So we can see this is a pretty standard PowerShell Function. The function starts off with a param definition, there is a single parameter $ipcheckurl, for once I am being a nice programmer and specifying the type as a String. This is an optional parameter,  and if there is no value for this parameter provided we will use the value of http://icanhazip.com .

The body of the function is pretty simple. Let’s make a WebClient object, then we will set the UserAgent header to that of a Windows Internet Explorer UserAgent, and finally, we call the DownloadString method, specifying our URL and return it to the calling code.

That’s all pretty simple right?

Before we continue, notice I didn’t add any error handling? That is because if anything goes wrong, I want the calling code to know that something has gone wrong. anything calling this will need to handle any errors that might occur (for example, page not found, name could not be resolved, server busy etc).

The Script

Now lets look at a script we could use to monitor our external IP address, it will perform the following:

1. Read a file containing the previously recorded external IP address, if non exists, the script should continue.
2. Call our previously defined function and store the returned IP address in a variable. We will also safely handle any errors that occur.
3. Compare the two, if they match, then the external IP address hasn’t changed, we don’t need to do anything, but we might want to. If they don’t match, then the external IP address has changed and we should make a fuss!
4. If the address has changed, we need to store the IP address back into the file.

Lets Take a look:

I am not going to go into much detail, this is a pretty simple script. I am assuming that the function that was previously discussed is available, you could put it into either a module or just defined in the script file.

So, now you know how to watch for your external IP address changing!

Enhanced Mitigation Experience Toolkit (EMET) V2 Config script

I was asked how I managed my Microsoft Enhanced Mitigation Experience Toolkit (EMET) V2.1 deployment, its not very important now as V3 is so much easier to manage.

Code contained in this post isn't pretty, there is a long story behind why this script is so bad, and why it is no where near the quality of my code that I write these days. Whilst I am embarrassed by this codes quality, people need ideas for managing EMET v2, whilst 3 is now out, I still wanted this code to be out there for people to use.

There are two things you need to realise when configuring EMET, is that applications are stored in different spot depending on if they are on a 32bit or 64bit machine.

In the script  there is a function which has two parameters, it will then try and configure a small list of apps. For a 32bit workstation, send that function c:\windows\system32 and c:\Program Files, but for a 64bit machine, send it those 32bit locations and c:\windows\syswow64 and c:\program files (x86). In that function you place lines calling emet_conf.exe sending it a parameter to the path of the executable you want to protect.

The main core code of the script is pretty simple. First we determine where EMET is installed to, we CD to its directory, we then delete any current configuration that might exist within EMET.

Next we will configure the system protection levels to be:

• DEP = ApplicationOptOut
• SEHOP = ApplicationOptOut
• ASLR = ApplicationOptIN

These were the settings we found worked best in our environment, but there is documentation from Microsoft on what you can set these to.

Continuing on with the script, Media Centre gains some protection, its always installed to the same place.

We then configure EMET for known apps in c:\windows\system32 and c:\program files

If the system is 64bit, we will then configure EMET for known apps in c:\windows\syswow64 and c:\program files (x86).

The function configure-apps simply contains lines calling emet_conf.exe, here are some examples:

Services and Microsoft Apps:

3rd Party apps

Office

As you can see, its all rather simple.

So there you have it, one of my quick and dirty scripts to configure EMET V2 (and it will work on 3 but you should switch to group policy or the profile xml files).

PowerShell PowerTools

I loved Quake, and having the Quake console experience for PowerShell is just amazing. I have been using the instructions located at Jake Ginnivan's blog for quite some time now. 

With Windows 8 being a little un-keyboard friendly, this console is even more useful to a Powershell power user.

Please take a look at: http://jake.ginnivan.net/quake-style-powershell-console

Another very handy tool which I only discovered today is WindowPad. Please take a look at the post on LifeHacker http://www.lifehacker.com.au/2012/06/windowpad-uses-your-number-pad-to-snap-windows-to-the-screen-edge/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+LifehackerAustralia+%28Lifehacker+Australia%29