Poor Mans Patching with PSExec & Powershell

With the release of such a critical patch as MS08-067 it seems that us "patchers" are up against it. Well this post is just really to detail an alternative method of deploying patches using PSExec and PowerShell.

Tools

• PSExec
• PowerShell (with Quest AD Cmdlets installed)
  

1. OK, so first you need to create a share that all the servers can see. Once done download the patch (or patches) and copy them to the share.


2. Now you need a list of all your servers if you dont have one. I would use PowerShell for this.

get-qadobject -sizelimit 0 -type computer | where {$_.osname -match "server"} | select name > c:\servers.txt

Tidy up the text file by removing the header field (Name) manually.


3. Now use PSExec to deploy the patch from the share to the servers listed in the file.

psexec @serverlist.txt -c "\\File-Server\SecurityPatches$\MS08-067.exe /quiet /norestart /overwriteoem"

If you have many patches to install you could place the line above into a batch file and simply change the name of the patch on each line.


4. Use PowerShell to reboot all the server in the list if required. The following PowerShell one-liner will do that.

gc c:\servers.txt | ForEach-Object { gwmi win32_operatingsystem -ComputerName $_ | ForEach-Object { $_.reboot() }}


5. Finally, Use PowerShell to check that the patches have been deployed successfully. The following script will prompt you for your server list file and the HotFix ID you want to check for.

function Get-HotFix($server,$hotFixID) {
PROCESS{
$results = gwmi win32_quickfixengineering -computer $_ -filter "HotFixID='$hotFixID'"
if ($results) {
$results | select CSName,HotFixID,@{n="Installed";e={"Yes"}}
} else {
$results = "" | select CSName,HotFixID,Installed
$results.CSName=$_
$results.HotFixID=$hotFixID
$results.Installed="No"
$results
}
}
}
gc (Read-Host "Please provide path to server list file") | Get-HotFix -hotFixID (Read-Host "Hotfix ID") | ft -auto



Or you could use WSUS or SMS I guess.

Why Patch?

This morning I was looking through my SSH server logs and as usual I saw the standard brute force attempts. I thought I would spend a few minutes looking at why certain IP's had nothing better to do than to through some lame ass dictionary attack at me.

So first I would SSH into my box and grep through the logs for failed login attempts.

grep -i failed /var/log/auth.log | less




First I took just one IP from my logs, and Nmap'd it (well they started it!). I found a single SSH port open running a vulnerable version of OpenSSH.

nmap -F 199.33.132.127 -PN



Okay, so using nmap fast scan (looking for the most common ports) I see that port 22 is open.

Now I used a really great website called clez.net to look at the port in more detail.



This site gives me the SSH version and plenty of other intresting info.

So now if I google the SSH version I quickly find that it's an old vulnerable version (OpenSSH 3.9p1).



So it would seem that some poor sucker has got his box owned and now he is scanning my box.

So that's it really. I just wanted to demonstrate to anyone who might read this why it is important to patch.

Scanning with MBSAcli

This is just a quick post mostly as a reminder to me of what commandline options to run when I want to use MBSAcli to target a server to scan for patches.

MBSA is a free program provided by Microsoft that allows admins to scan systems to check things like patch levels, admin accounts, shares etc... It's a useful tool that has a nice GUI but I find that each time I use the GUI it attempts to connect to the Internet to download updates. As I don't want that I just run it from the commandline and select just the options I need. I view the file that it spits out in MBSA as it allows for easier access to the right web pages with details of the vulnerabilty.

Tools

• MBSA

Steps

1. I download the latest cab file with details of all the patches into c:\mbsa\

http://go.microsoft.com/fwlink/?LinkId=76054

2. After installing MBSA (if not already installed) I navigate to C:\Program Files\Microsoft Baseline Security Analyzer 2

3. I run the following command to scan a server called webserver

mbsacli.exe /target webserver /nd /n password+iis+os+sql /catalog c:\mbsa\wsusscn2.cab /rd c:\mbsa

The switches I have chosen are:

/target webserver - This is the server I am scanning
/nd - This is telling MBSA not to download updates
/n password+iis+os+sql - This is telling MBSA which scans NOT to perform. I just want to know about updates.
/catalog c:\mbsa\wsusscn2.cab - This is the update cab I downloaded.
/rd c:\mbsa - This is the directory for my report.

For more details on these and other available options use mbsacli /?


4. After it finishes I go to the report it created in c:\mbsa and double click it to open it in MBSA. From there I can view details of missing patches.

Thats it. Following that I figure out if the server needs the patch due to the role it has, for example if it's just a file server it probably dont need Outlook Express patches.


Links
http://technet.microsoft.com/en-us/security/cc184922.aspx