PRTK 6.5 & DNA 3.5 Release Notes

Transcription

1 PRTK 6.5 & DNA 3.5 Release Notes INTRODUCTION These Release Notes for DNA 3.5 and PRTK 6.5 detail new features, fixes, known issues, and important information necessary for the use of this release. IMPORTANT INFORMATION Linux Workers are supported under Fedora Core versions 11 and 12. If a prior version of DNA or PRTK is currently installed on your machine, AccessData recommends that you make a copy of any custom Profiles, Dictionaries, Rules, or Groups, and then uninstall that version before installing DNA 3.5 or PRTK 6.5. NEW AND IMPROVED 64-bit support has been added to DNA 3.5/PRTK 6.5. The new names of the DNA/PRTK installation files are: PRTK AccessData Password Recovery Toolkit.exe PRTK 6.5 & DNA 3.5 Release Notes 1

2 AccessData Password Recovery Toolkit (64 bit).exe BUG FIXES DNA AccessData Distributed Network Attack.exe AccessData Distributed Network Attack (64 bit).exe New Windows worker 32/64 bit named files for DNA: AccessData DNA Worker (64 bit).msi AccessData DNA Worker.msi Fixed a bug where on certain wordlists the dictionary utility would produce a set of dictionaries that, when selected in a profile, would cause the PRTK/DNA interface to close down during the file add process. (16770). KNOWN ISSUES User needs to run the DNA/PRTK installer as an administrator on Windows Vista, Server 2003, Server 2008, and Windows 7. The 64-bit versions of DNA/PRTK cannot be run on 32-bit operating systems. DNA/PRTK will not run properly when the icon/program is set to compatibilty mode for Windows Vista, Server 2003, Server 2008, and Windows 7 Stop worker on user input does not work in Windows Vista, Server 2003, Server 2008, and Windows 7. 2 AccessData PRTK and DNA Release Notes

3 PRTK & DNA Release Notes INTRODUCTION These Release Notes for DNA and PRTK detail new features, fixes, known issues, and important information necessary for the use of this release. FIXES PRTK/DNA now properly releases the NLS license when the interface is exited. PRTK & DNA Release Notes 3

4 PRTK & DNA Release Notes INTRODUCTION These Release Notes for DNA and PRTK detail new features, fixes, known issues, and important information necessary for the use of this release. NEW FEATURES The following new features have been added: Resizable dialogs: Dialogs can now be resized throughout the user interface. Case Management: The following features have been added to improve case management. Rules: Levels are now called Rules. There is a significant change to the Rules interface. Profiles: New profiles can now be patterned after an existing profile. Drop Folders: The user can now specify the location for files to be automatically picked up by DNA. Generate Report: Reports are now available in DNA and PDF formats. Network License Server: PRTK and DNA can now utilize an AccessData Network License Server. View Worker Information: The new dialog provides more functionality. 4 AccessData PRTK and DNA Release Notes

5 Job Wizard: Default Attack types can be saved and applied to like file types. FIXES Steganos files are now correctly identified and processed. User is now prompted to uninstall DNA or PRTK if it is found during the install of this new version. PRTK no longer hangs at the splash screen when launched. This issue applied to a limited number of machines. Stop Worker on User Input flag is now being properly pushed to workers and functions as it should. When starting DNA or PRTK, if the dongle is within 45 days of expiration, there is a popup message that lets the user know that this event is about to occur. The dialog that pops up now correctly displays in front of the splash screen where the user can accept the dialog. KNOWN ISSUES DNA 3.4.x and PRTK 6.4.x is supported on 32-bit Windows operating systems, including XP, Server 2003, and Vista. Using a profile from 3.3.3/6.3.3 crashes PRTK 6.4.x or DNA 3.4.x. If you copy the old profiles into the profiles folder under PR, then go to edit/profiles/edit, where you can view the contents of the profile without crashing the program. However, there were enough XML changes that do not allow old profiles to be used. Workaround: Copy the profiles into an Old Profiles folder under \PR\, then by viewing them, you can create new ones in the 3.4.x/6.4.x format to accomplish the same tasks. When a DNA administrator chooses to push workers out to the individual machines via a disk image, it requires that they set the worker up as usual, and then remove the UUID.txt file from the [Drive]:\Documents and Settings\All Users\Application Data\AccessData\PR directory before they create a disk image; otherwise, the supervisor will confuse the workers that are being pushed with the disk image with the existing workers and not all workers will be allowed to connect. Stop worker on mouse or keyboard input does not function in Vista. The Worker on a Vista machine will always be funtioning and can only be turned off by the user physically stopping the worker service. PRTK & DNA Release Notes 5

6 To update a worker from the worker or earlier on Windows Vista, the user must manually uninstall the worker via the Control Panel. At that point a worker can be put on the machine either manually or through the Group Policy feature from a Windows Domain. COMMENTS? We value all feedback from our customers. Please contact us at support@accessdata.com, or send documentation issues to documentation@accessdata.com. 6 AccessData PRTK and DNA Release Notes

7 PRTK 6.4 & DNA 3.4 Release Notes These Release Notes apply to the DNA 3.4 and the PRTK 6.4 releases. NEW AND IMPROVED This release of PRTK and DNA contains the following fixes and updates: The Worker Installer is now an.msi file instead of an.exe file. The new file is found at [drive]:\program Files\AccessData\DNA 3\Supervisor\WorkerInstall.msi. Please view the installation instructions under the heading Other Considerations following Known Issues. Browse buttons: Anytime you see a Browse button in any dialog, it indicates you need additional information to perform the selected task. Clicking Browse automatically open the Windows Explorer window in the same folder previous information or files were added from. Worker update process has changed with the implementation of the WorkerInstall.msi. The new process updates the worker using the WorkerInstall.msi file and utilizes the Microsoft Group Policy functionality to distribute and update the worker. You can manually install the workers if you do not have the ability to utilize the Microsoft Group Policy. See Chapter 2 of the PRTK and DNA User Guide for installation instructions. PRTK 6.4 & DNA 3.4 Release Notes 7

8 Setting up a group policy: Workers should be set up on a domain that will allow a group policy to be utilized to push a newer version of the worker down to the specified machines. A group policy should then be created from the domain server with the WorkerInstall.msi that will push the worker out to the existing or new clients. Note: See Microsoft Group Policy instructions on how to set up the policy. There is a document on Microsofts website called Introduction to Group Policy in Windows Server 2003 that gives a good overview of Group Policy. Worker Installer for PS3 is now available. Please view the installation instructions under the heading Other Considerations following Known Issues. Case Management Rules: Levels are now called Rules. There is a significant change to the Rules interface. Rules: The user now has the ability to use any dictionary with any given Rule. New Profiles: There is a now ability to pattern a new profile after an existing profile. Drop Folders: The location where you can place files to be automatically picked up by DNA Generate Report: The user can now generate DNA or PRTK reports in both DNA and PDF formats. Network License Server: Both PRTK and DNA now have the ability to utilize an AccessData Network License Server View Workers Information: New dialog, more functionality. Job Wizard: Attack types can be saved so they can be applied to like file types. Resizable dialogs: Dialogs can now be resized to meet your needs. KNOWN ISSUES Worker update on Vista machines: To update a worker from the worker or earlier on Windows Vista, the user must manually uninstall the worker using the Windows Control Panel. At that point a worker can be put on the machine either Manually or through the Group Policy feature from a Windows Domain. NLS Support: If NLS is activated, local Wibu CmSticks or Keylok dongles are no longer automatically recognized by PRTK or DNA, and when connected, PRTK or DNA will run in demo mode. Workaround: 8 AccessData PRTK and DNA Release Notes

9 Stop both the DNA supervisor and worker services, connect the dongle and then start the supervisor and worker services, then DNA uses the local dongle and not the license from the nls server. Close PRTK to stop the PRTK service. Connect the local dongle, and run PRTK again. This will cause PRTK to read the local dongle instead of the NLS license. This is illustrated in the following figure: Figure 1-1 How NLS Works with PRTK or DNA Network License Server with PRTK or DNA PRTK or DNA Supervisor Machine No Local Device Connected. No License Found No Security Device Found. Do You Want to Look for a Network License Server? Local device connected. License Found PRTK or DNA Runs in Full Mode When PRTK is closed, the PRTK service is stopped. This means that with every restart, PRTK will look locally first for a license, and prompt for a network license if none is found. When the DNA is closed the Supervisor service is not stopped. You must manually stop the Supervisor service or reboot the computer to stop the service. At that point, the license scenario can be reversed. NO YES Either way, none of your work will be lost. Provide IP Address of NLS Server PRTK or DNA Runs in Demo Mode PRTK or DNA Runs in Full Mode The default is for PRTK or DNA to look for a local license first. If one is found, it will not look elsewhere until the PRTK service or the DNA Supervisor service is stopped and restarted and no license is found. If none is found, the user is prompted to provide the IP Address of a license server on the network. If a network license is found, PRTK or DNA will not look elsewhere for a license until the respective service is stopped and restarted. At that point, it again looks locally first for a license. If neither a local license nor a network license is found, DNA runs in Demo Mode. Uninstalling a Worker on the Supervisor machine: There is an issue when uninstalling a worker that has been installed on the same machine as a Supervisor. You may see Error Could not update the.ini file C:\Documents and Settings\AccessDta\PR\Worker.ini. Verify that the file exists and that you can access it. Solution: Shut down the Supervisor service before attempting to uninstall a worker. PRTK 6.4 & DNA 3.4 Release Notes 9

10 OTHER CONSIDERATIONS DNA WORKER INSTALL ON A WINDOWS BOX USING THE.MSI FILE Before you begin this installation, the Supervisor folder on the Supervisor machine should be shared to allow worker machines to remotely access it for running the DNA Worker installation. This worker cannot currently be installed silently. Important: You must not compress the Worker.ini file. SHARING THE SUPERVISOR DIRECTORY If the directory isn t already shared and you plan to install the workers by attaching to the Supervisor machine to access the install file, complete the following: 1. In Windows Explorer, navigate to the [drive]: Program Files\AccessData\DNA 3\ directory. Right-click the \Supervisor\ directory and select Sharing. 2. In the Sharing tab, select Shared As. 3. (Optional) Enter any additional information in the Sharing tab fields that you want to require of the client workstations before they can access the directory. Note: The WorkerInstall.msi file is a fully self-contained worker install file. It can be copied to a thumb drive or other portable media, or copied to a network shared location. The point is, all Windows machines that will run a DNA Worker must have access to this file. NEW WORKER INFORMATION FOR THE DNA 3.4 RELEASE Workers are now installed with WorkerInstall.msi rather than the WorkerInstall.exe. To install the worker on a Windows workstation, do the following: New workers update via Group Policy when the worker machine is rebooted. 1. On the Windows workstation, browse to the shared Supervisor directory and either double-click WorkerInstall.msi on the Supervisor machine, or copy the WorkerInstall.msi to the local worker machine, and execute it there. You can also right click on the WorkerInstall.msi file and choose Install. 10 AccessData PRTK and DNA Release Notes

11 Figure 1-2 Selecting the MSI 2. Click Next on the Welcome screen. 3. Click Yes to accept the license agreement, then click Next. 4. Click Next on the Supervisor Information screen. Important: Do not change any of the values, unless you want to connect this worker to a different supervisor. 5. Click Install to proceed with the worker installation. 6. Click Finish to complete the installation of the worker. After the installation is complete, the DNA worker service runs automatically in the background, listening for Supervisor communication. If you run worker.exe from the Worker or the Supervisor folder, the Worker icon appears in the System Tray. Clicking the icon opens the DNA Worker Status screen. For more information about the DNA Worker Status screen, see DNA Worker Interface on page 67. The worker interface shows workers that are older than the current version of DNA with a light red background. Important: All workers will need to be updated to the latest version for the shipping build of DNA as there have been numerous changes which will not allow an older worker to process jobs. Any workers that were set up with a Beta version of 3.4 should also be updated. Existing DNA workers will uninstall automatically. Worker update is accomplished through a Group Policy. PRTK 6.4 & DNA 3.4 Release Notes 11

12 SETTING UP A GROUP POLICY. Workers should be set up on a domain that will allow a group policy to be utilized to push a newer version of the worker down to the specified machines. A group policy should then be created from the domain server with the WorkerInstall.msi that will push the worker out to the existing or new clients. Note: See Microsoft Group Policy instructions on how to set up the policy. There is a document on Microsoft s website called Introduction to Group Policy in Windows Server 2003 that gives a good overview of Group Policy. DNA WORKER INSTALLATION ON A SONY PLAYSTATION 3 To install the DNA Worker on a Sony Playstation 3 (PS3), complete the following steps as user root at the command line on the target Linux machine: TO INSTALL A PS3 WORKER: Prior to worker installation you must have OpenSuSE 11 Power-PC installed as the active operating system on the PS3 box. Installing OpenSuSE 11 Disclaimer: AccessData provides this information on a best effort basis only, in the interest of aiding its customers in installing the related DNA Worker. If you have problems with the OpenSuSE 11 installation, please refer to specific documentation for that product. AccessData does not offer support for the OpenSuSE 11 installation. 1. Start in Game mode 2. Format Drive with 10 GB for Game system, 30 GB for other OS 3. Install New OS 4. Set option to default the OS to the Other OS on the PS3 5. Do a custom partition and remove home partition and root partition 6. Set up a new root partition (24G) 7. Tab three times to get to create a new user (if you can t see the options on the screen) 8. Append video=ps3fb:mode:12 to the end of the line in kboot.conf opensuse= / dev/ps3da5:/vmlinux initrd=/dev/ps3da5:/inidrd quit panic=42 sysrq=1 so that it reads: opensuse= /dev/ps3da5:/vmlinux initrd=/dev/ps3da5:/inidrd quit panic=42 sysrq=1 video=ps3fb:mode:12 Use 12 to get the SXGA video mode 12 AccessData PRTK and DNA Release Notes

13 9. Disable the wireless card in the network devices as this appears to cause conflicts when trying to update utilities 10. Update the PS3 utilities zypper install ps3 utils 11. Install the libspe (Yast, software) 12. Reboot the PS3 system 13. Disable X (change id:5:initdefault: to read id:3:initdefault in /etc/inittab Installing the worker: 1. scp worker powerpc install.sh [PS3 box name]: directory on the PS3 You will be prompted for your user password. By default, the folder is copied to the /home/[username] folder. 2. Once copied, logon to the box by typing ssh user@[box_name] and switch to the root user: su (prompts for password, if applicable). 3. Change directory to the folder you copied worker powerpc install.sh to, such as: cd /home/[user_name] 4. Install the worker by running sh worker powerpc install.sh install. 5. Go to the /opt/accessdata/dna3/worker folder by typing cd /opt/accessdata/dna3/worker. 6. Run the Worker by typing./dna3workerd start Once running, the worker on this PS3 box should display with the IP address and name of the machine on the Supervisor. To stop the worker service: Run the following command from the AccessData folder to stop the worker service:./dna3workerd stop Should you need to uninstall the worker: 1. Run./dna3workerd stop from the /opt/accessdata.dna3/worker directory 2. Change to the /Home/[username] directory 3. Type sh worker powerpc install.sh uninstall PRTK 6.4 & DNA 3.4 Release Notes 13