Solara Simpson absimpson

.mxtsessions file format

Introduction

This document tries to give a description of the .mxtsession files used in the proprietary software MobaXterm. Sadly this format, as efficient as it is, is too obscure to encourage legitimate use cases of this format as there is no public documentation available.

The software licence of MobaXterm, for both Home and Pro editions, allows to "observe, study or test the functioning of the Software in order to determine the ideas and principles which are the basis of the Software, when performing the loading, display, execution, transmission or storage of the Software" and this study has been done in full under those terms.

The studied format is the one of version 23.6: sessions last modified (but not necessarily exported) before this version will have fewer fields.

(Note: I wrote this up quickly and without a lot of research, so there are probably inaccuracies. However, I wanted to put this out there in case it helps someone else hitting this issue. Github gists like this unfortunately don't have comment notifications, so if you want me to send me a comment, use my email [email protected] and not the comments.)

Problem: Can't use sudo command-limiting in Ansible

The ability to limit sudo users to only be able to execute certain commands doesn't work with Ansible (without a workaround).

This isn't a problem if you're running Ansible as a super-user like root, but if you are allowing others to run Ansible on your systems in order to do things like application deploys, then you need a way to limit their access to the system for basic security.

For example, a line in /etc/sudoers like this:

	#! /bin/bash
	### BEGIN INIT INFO
	# Provides: dns-sync
	# Required-Start:
	# Required-Stop:
	# Default-Start: S
	# Default-Stop:
	# Short-Description: Synchronizes /etc/resolv.conf in WLS with Windows DNS - Matthias Brooks
	### END INIT INFO

	import json

	def lambda_handler(event, context):
	print('Received event: ' + json.dumps(event, indent=2))

	response = {
	"statusCode":200,
	"headers": { "Access-Control-Allow-Origin": " *", "Content-Type" : 'application/json' },
	"body": json.dumps(event)
	}

	[WinEventLog:Security]
	#Returns most of the space savings XML would provide
	SEDCMD-clean0-null_sids = s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(^\s+[^:]+\:)\s+-?$/\1/g s/(?m)(\:)(\s+NULL SID)$/\1/g s/(?m)(ID\:)(\s+0x0)$/\1/g
	SEDCMD-clean1-summary = s/This event is generated[\S\s\r\n]+$//g
	SEDCMD-clean2-cert_summary = s/Certificate information is only[\S\s\r\n]+$//g
	SEDCMD-clean3-blank_ipv6 = s/::ffff://g
	SEDCMD-clean4-token_elevation_summary = s/Token Elevation Type indicates[\S\s\r\n]+$//g
	SEDCMD-clean5-network_share_summary = s/(?ms)(A network share object was checked to see whether.*$)//g
	SEDCMD-clean6-authentication_summary = s/(?ms)(The computer attempted to validate the credentials.*$)//g
	SEDCMD-clean7-local_ipv6 = s/(?ms)(::1)//g

	# Get-BitLockerRecovery.ps1
	# Written by Bill Stewart ([email protected])

	<#
	.SYNOPSIS
	Gets BitLocker recovery information for one or more Active Directory computer objects.

	.DESCRIPTION
	Gets BitLocker recovery information for one or more Active Directory computer objects.