Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About DarBis
About DarBis
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
04-16-2020
27Posts
1Like
1Solution
Apr 16, 2020Last Visited
User
Activity
User
Profile
Latest posts by DarBis
| Subject | Views | Posted |
|---|---|---|
| 1484 | 12-12-2019 03:48 AM | |
| 697 | 08-22-2019 08:17 AM | |
| 2290 | 07-23-2019 01:07 AM | |
| 1322 | 07-23-2019 01:05 AM | |
| 2355 | 07-22-2019 07:48 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 15 |
User Badges
Public Statistics
| Date Registered | 12-02-2014 03:31 AM |
| Date Last Visited | 04-16-2020 03:45 AM |
| Total Messages Posted | 27 |
| Total Likes Received | 1 |
08-22-2019
08:17 AM
Hi, anyone had issues after updating to this version? We had strange behaviour accessing some websites stating that 'File Transfer Blocked' there was nothing showing in the logs. We rolled back to 9.0.3 and problem went away. Possible bug ? D.
... View more
07-23-2019
01:07 AM
Hi, Our PA and Global Protect are well established, however Prelogon is new. We are using PKI to delivery certs to all machines. D.
... View more
07-22-2019
07:48 AM
PAN-OS - 9.0.3 Global Protect 5.0.3 We are having problems with GPPrelogon. Logs: (T7612) 07/22/19 15:20:16:670 Debug(5727): REGION-PRIO, region code is GB (T7612) 07/22/19 15:20:16:670 Debug(10868): REGION-PRIO, save region code GB (T7612) 07/22/19 15:20:16:670 Debug(5783): Portal authentication-message is Enter RAFA login credentials (T7612) 07/22/19 15:20:16:670 Debug(5799): autosubmit is false (T7612) 07/22/19 15:20:16:670 Debug(7179): ----Portal Login starts---- (T7612) 07/22/19 15:20:16:670 Debug( 310): No need to decrypt data with length 0 (T7612) 07/22/19 15:20:16:670 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Program Files\Palo Alto Networks\GlobalProtect\PanPCD_e30b15ae554406f5223cc15453e1a19.dat (T7612) 07/22/19 15:20:16:670 Debug(1655): cannot restore portal config digest C:\Program Files\Palo Alto Networks\GlobalProtect\PanPCD_e30b15ae554406f5223cc15453e1a19.dat. (T7612) 07/22/19 15:20:16:670 Debug(1519): Failed to open file C:\Program Files\Palo Alto Networks\GlobalProtect\PanPUAC_e30b15ae554406f5223cc15453e1a19.dat (T7612) 07/22/19 15:20:16:670 Debug(1496): Unserialized empty cookie for portal secure.rafa.org.uk and pre-logon user. (T7612) 07/22/19 15:20:16:670 Debug(7247): IsInPrelogon() 1, GetPrelogonStatus() 1 (T7612) 07/22/19 15:20:16:670 Debug( 310): No need to decrypt data with length 0 (T7612) 07/22/19 15:20:16:670 Debug(6812): use cached deviceSN (T7612) 07/22/19 15:20:16:670 Debug(6812): use cached deviceSN (T7612) 07/22/19 15:20:16:670 Debug( 324): ClearHipCustomCheckInfo(): pHipCustomCheckInfo is NULL. (T7612) 07/22/19 15:20:16:670 Debug( 86): ClearHipCustomCheckRegKeyInfo(): pHipCustomCheckRegKeyInfo is NULL. (T7612) 07/22/19 15:20:16:670 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Program Files\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_e30b15ae554406f5223cc15453e1a19.dat (T7612) 07/22/19 15:20:16:670 Debug( 71): Portal config criteria is restored. (T7612) 07/22/19 15:20:16:670 Debug( 530): pan_read_text_from_file(): File does not exist. File: C:\Program Files\Palo Alto Networks\GlobalProtect\PanPortalCfgCriteria_e30b15ae554406f5223cc15453e1a19.dat (T7612) 07/22/19 15:20:16:670 Debug(7317): m_szDomainAndUsername is pre-logon (T7612) 07/22/19 15:20:16:670 Debug( 990): PrepareRequest, m_pMachineCertCtx is 0000000000000000... (T7612) 07/22/19 15:20:16:670 Debug( 998): WinHttpOpenRequest... (T7612) 07/22/19 15:20:16:670 Debug( 442): CPanHTTPSession::PostRequest: WinHttpSendRequest... (T7612) 07/22/19 15:20:16:702 Debug( 453): bResults=1, g_dwStatus = 00000000 (T7612) 07/22/19 15:20:16:702 Debug( 675): Server secure.rafa.org.uk cert chain has been created. (T7612) 07/22/19 15:20:16:702 Debug( 689): Server secure.rafa.org.uk cert verification passed (T7612) 07/22/19 15:20:16:702 Debug( 721): Check server certificate revocation returns TRUE (T7612) 07/22/19 15:20:16:702 Debug( 475): CPanHTTPSession::PostRequest: WinHttpReceiveREsponse... (T7612) 07/22/19 15:20:16:702 Debug( 487): CPanHTTPSession::PostRequest: WinHttpQueryHeaders... (T7612) 07/22/19 15:20:16:702 Debug(1149): m_bUserAuthentication is set to false. (T7612) 07/22/19 15:20:16:702 Debug( 530): CPanHTTPSession::SendRequest: WinHttpQueryHeaders... (T7612) 07/22/19 15:20:16:702 Debug(1168): Auth failed. Private header is auth-failed-password-empty (T7612) 07/22/19 15:20:16:702 Debug(7540): Portal config is NULL. (T7612) 07/22/19 15:20:16:702 Debug(6707): portal status is User authentication failed. (T7612) 07/22/19 15:20:16:702 Debug(5521): --Set state to Disconnected (T7612) 07/22/19 15:20:16:702 Info ( 648): return without process!!!! socket=-1, os=14 (T7612) 07/22/19 15:20:16:702 Debug(6051): In prelogon, failed to get portal configuration. (T7612) 07/22/19 15:20:21:711 Debug(8305): ProcessServerPortal failed (T7612) 07/22/19 15:20:21:711 Debug(1692): ----portal processing starts---- (T7612) 07/22/19 15:20:21:711 Debug(1713): no user-profile-type tag. (T7612) 07/22/19 15:20:21:711 Debug(1720): pg, source = 3, old source is 3 (T7612) 07/22/19 15:20:21:711 Debug(1742): pg, preferred gateway not set in message, old prefergateway=NULL:) (T7612) 07/22/19 15:20:21:711 Debug(1807): no checkupdate tag. (T7612) 07/22/19 15:20:21:711 Debug(1826): no portal-certificate-verification tag. (T7612) 07/22/19 15:20:21:711 Debug(1859): No saml-load-cache tag. (T7612) 07/22/19 15:20:21:711 Debug(1882): no saml-auth-error tag. (T7612) 07/22/19 15:20:21:711 Debug(1893): allow-cached-portal is yes (T7612) 07/22/19 15:20:21:711 Debug(1921): No win-user attribute in portal/user_credential message. (T7612) 07/22/19 15:20:21:711 Debug(1927): This portal message is from prelogon thread (T7612) 07/22/19 15:20:21:711 Debug(1937): NewWinUser is , WinUser is , PreviousSwitchOffMsg is false (T7612) 07/22/19 15:20:21:711 Debug(1938): GetPrelogonStatus() 1, m_userName pre-logon, m_preUsername pre-logon (T7612) 07/22/19 15:20:21:711 Debug(5373): StartThreads starts: (T7612) 07/22/19 15:20:21:711 Debug(2079): No saved-user (T7612) 07/22/19 15:20:21:711 Debug(2090): No saved-passwd (T7612) 07/22/19 15:20:21:711 Debug(2099): Portal secure.rafa.org.uk, user pre-logon, logonDomain , saved user , path C:\Program Files\Palo Alto Networks\GlobalProtect\ (T7612) 07/22/19 15:20:21:711 Debug(1547): SSO GetSsoCredential starts. (T7612) 07/22/19 15:20:21:711 Info (1577): SSO ----- PanCredGet failed with error Element not found. Any ideas ? Darren
... View more
06-24-2019
08:06 AM
Hi, anyone experiencing desktop slow downs with the above version of traps? D.
... View more
04-18-2019
06:17 AM
That suggests to me that when the user goes to site the traffic is hitting another rule. Suggest you tighten your rules to make sure its not hitting an allow rule. D.
... View more
04-12-2019
07:33 AM
However GP Pre-logon from 9.0 and 9.0.1 is broken and is currently with TAC for investigation.
... View more
03-25-2019
03:27 AM
Hi, I have got it to work. Make sure you have the correct cert from the DDNS provider. I public IP is provided by DHCP by my ISP. Darren
... View more
06-09-2018
03:08 AM
Just an update: PA have reported that the file is self encyprted which is making it hard for WF to detect, PA are looking into soltuons on WF. However, Traps the jury is still out, its going very slowly. I will report back once PA have something. But I can create many new payloads and Traps still ignores them...albeit the outgoing network traffic would be shutdown subject to your configs on your PA, but it is still passing Traps 😞 Darren
... View more
05-24-2018
11:44 PM
This has to be the way, as other brands are now working towards anti-exploit and a cloud-basedhosting. We moved to 5 as we were hosting our ESM in Azure and I wanted toshut that down due to costs. But I am encourage by your feedback @BPry D.
... View more
05-24-2018
12:12 AM
@BPry many thanks I figured this out, I am guessing Traps 5 will only get better as right now it seems to basic functions. Darren
... View more
05-17-2018
05:49 AM
Hi all, me again... I have made some submissions on files I believe to be benign or greyware, my questions is in Traps 5 how do I know and where do I find the outcome of the WF results based on a submission? Because in 4x you could refresh it and the outcome would change. Not sure in 5. Thanks Darren
... View more
05-17-2018
05:36 AM
Hi, we have the anti-malware scanning, but I cannot seem to find a location in the polices to stop Traps scanning certain files C:\Pagefile.sys, c:\hiberfil.sys etc. I have added them into the Whitelist Folders but they still get scanned. Any ideas? Darren
... View more
05-10-2018
01:20 PM
@jdelio Hello Sir, I have watched many of your vids on youtube greatwork by the way. Yes, I raised it with our support partner who have passed this onto PA. Interestingly I have tried this payload on on an PC running Sophos InterceptX and this also misses the payload. I have given the details of my findings to our support to pass onto PA. Thank you for reaching out to me, I want to get PA on this but its always difficult in being heard. Let me kow if you need more info. Darren
... View more
05-10-2018
03:44 AM
and yep... I ran the payload and it connected to my MSF Exploit running on Kali! And Traps just ignores it... I wish someone from PA would look into this and maje a comment. I know that the payload is effectively just opening up a session its behaviour is malcious or beyond the normal. and Wildfire... As you can see it fails and marks this as benign, which if I flag this as a false positive they will mark this as Maware... Seriously worrying...
... View more
05-10-2018
03:21 AM
I used a script called 'hacktheworld' installed into Kali, it makes the payload and BOOM! https://www.youtube.com/watch?v=Z-Kx4Bb3H7s&ab_channel=KaliPentesting But I have done a test again this morning with a new payload and Traps ignored it again and smart screen popped up!! Please have a go with the script in the video and see how you get on, its quite scary. Darren
... View more
05-04-2018
05:45 AM
But I can recreate the file and a new hash will be created, so I see that as not a benefit. I would of thought as this is exhibiting certain behaviours that Traps or WF would have picked it out as Traps is supposed to be behavourial not hash look ups. So effectively I could recreate the file 1000 times with same behaviour all with different hashes, but the behaviour would still not picked up. I would like someone from PA comment on this because I am seriously worried, I know the NGFW will stop the traffic on port 4444 with I am sure with clever thinking that could be bypassed, but the conversation is about Traps stopping odd behaviour before it becomes something else. PA any comments? Darren
... View more
05-04-2018
05:29 AM
E53A09E7DA85F128ADFA180428C504262DE14375116197358E7734B113E8F117 Darren
... View more
05-02-2018
06:15 AM
Yep I'm with you. Biggest concern I have flagged this in WF as the wrong result, and left a message. It would be nice if someone from PA came back and said, yep we have this info and we are working on this or 'OMG you are right, nice spot' I'm starting to think my over confidence in Traps was misplaced. Darren
... View more
05-02-2018
04:28 AM
Ladies & Gents, I created a x64 payload.exe (internal testing) this payload creates a reverse_tcp on port 4444. So I uploaded my 'payload.exe' to my test machine with Traps 4.1.3 (39-2454 Content). Thinking, Traps will shut this down, to my horror it just let it run, in fact Windows Smart Filter triggered at first and let me click on proceed. Which I did and in a few seconds I had a meterpreter session running on my Kali box. So my concern is why didn't Traps pick up on this? I also uploaded to WF which said it was a benign file, how can a file that opens up a reserve shell be cosnidered benign? I am not no coder just used the standard tools in Kali, which means if I can anyone can. Really worrying that Traps let this through 😞 Darren
... View more
08-25-2017
01:31 PM
Hi, I did this... The issue has been resolved and it was down to the Action rule was not be seen as new, I stopped the services and removed action.json, located in C:\ProgramData\Cyvera\LocalSystem\Data this allowed one endpoint to update. Following discussion with PA support they suggested this query needed to be run on the SQL DB on the ESM. DBCC CHECKIDENT('OneTimeAction',RESEED,4000) (back up sql first) then re-create the action and endpoints start updating.
... View more
08-25-2017
01:30 PM
Try this.. The issue has been resolved and it was down to the Action rule was not be seen as new, I stopped the services and removed action.json, located in C:\ProgramData\Cyvera\LocalSystem\Data this allowed one endpoint to update. Following discussion with PA support they suggested this query needed to be run on the SQL DB on the ESM. (BACKUP DB FIRST) DBCC CHECKIDENT('OneTimeAction',RESEED,4000) (back up sql first) the re-create the action and endpoints start updating.
... View more
08-06-2017
07:18 AM
The issue has been resolved and it was down to the Action rule was not be seen as new, I stopped the services and removed action.json, located in C:\ProgramData\Cyvera\LocalSystem\Data this allowed one endpoint to update. Following discussion with PA support they suggested this query needed to be run on the SQL DB on the ESM. DBCC CHECKIDENT('OneTimeAction',RESEED,4000) (back up sql first) the re-create the action and endpoints start updating.
... View more
07-28-2017
12:35 PM
Hi, we have deployed our Traps ESM onto an Azure 2016 server, ports 443 & 2125 are open. The endpoints communicate no problem, but when I set an action to upgrade from 4.0.1 to 4.0.2 some endpoints get the upgrade and some dont, out of 144 endpoints only 30 have recieved the upgrade. The action sits at 21 and never moves above... it is at 21 because I deleted the previous one. So how often should the ESM push out the upgrades and why am I not getting all the endpoints upgraded. Complex question I know. Darren
... View more
06-26-2017
05:42 AM
1 Kudo
Hi, Users trying to update AdobeCC are getting blocked, the PA seems to think the below files are wildfire-virus, but when uploaded to WF they are tagged as benign. http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/packages/ACCC_4_1_1_utils_202/Utils.zip This triggers wildfire-virus 182090415 - Win32.WGeneric.mkcan - SHA256 - f1edb3877014862c8a08a48384cffad392f11f5490bcfa4a46f03250ae7f2eda and so does CreativeCloudSetup.exe is also triggering the same. I believe this to be an error, can it be investigated? Darren
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-16-2020
03:45 AM
|
Likes Given To
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
