Morpheus

Been doing these tutorials and have installed 1000+ IDS's in the last 15 years and not once have I had to add an extension. It sounds like you have a corrupted .EXE association.This issue can occur if a virus or other 3rd party application has changed or corrupted some default registry settings. These types of quirks seem to pop up when the installer fails to install the Windows Intrusion Detection System on a fresh install of Windows.

There is something odd about your Windows environment requiring the extensions?

You need to change line 900 in the php.ini Change from: ;extension=php_mysql.dll Change to: extension=php_mysql.dll Your PHP in IIS is not configured correctly. Stop the IIS server, copy the file in the attached zip to the C:\Windows\System32\inetsrv\config folder, and restart the IIS server. applicationHost.zip

What happens when put the test.php file in d:\winids\inetpub\wwwroot\base folder and then from a browser type http://winids/test.php Attach your php.ini file located in the d:\winids\php folder Attach your applicationHost.config file located in the C:\Windows\System32\inetsrv folder.

Item 1: Go back to the section titled Configuring IIS for PHP, and the Windows Intrusion Detection Systems security console and complete again. Item2: It appears there was a time delay for some reason. Try it again. Make sure your not routing through a proxy.

It appears the snort database has a problem or authentication. Go into the task manager and kill the Barnyard2 process. Go into the uninstall programs and remove postgresql. Go into the d:\winids folder and delete the postgresql folder. Return to the tutorial section labeled Installing the PostgreSQL Database Server and complete. Go to the tutorial section labeled Configuring the PostgreSQL Database Server and complete. Go to the tutorial section labeled Confirming PostgreSQL and Snort are operational and complete. Go to the tutorial section labeled Testing the Barnyard2 configuration file and complete. This should fix the problem.

Pulled your Pulledpork folder in and everything works as expected. I'm not sure what the problem is? Possible firewall issue with a blocked port? C:\Users\Operator>perl d:\winids\pulledpork\pulledpork.pl -c d:\winids\pulledpork\etc\pulledpork.conf -T https://github.com/shirkdog/pulledpork _____ ____ `----,\ ) `--==\\ / PulledPork v0.7.4 - Helping you protect your bitcoin wallet! `--==\\/ .-~~~~-.Y|\\_ Copyright (C) 2009-2017 JJ Cummings, Michael Shirk @_/ / 66\_ and the PulledPork Team! | \ \ _(") \ /-| ||'--' Rules give me wings! \_\ \_\\ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 'uname' is not recognized as an internal or external command, operable program or batch file. Checking latest MD5 for snortrules-snapshot-29111.tar.gz.... Rules tarball download of snortrules-snapshot-29111.tar.gz.... They Match Done! IP Blacklist download of https://talosintelligence.com/documents/ip-blacklist.... Reading IP List... Checking latest MD5 for opensource.gz.... Rules tarball download of opensource.gz.... They Match Done! Prepping rules from opensource.gz for work.... Done! Prepping rules from snortrules-snapshot-29111.tar.gz for work.... No such file in archive: 'doc/signatures/rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 366. Could not find an entry for 'doc/signatures/rules/VRT-License.txt' at d:\winids\pulledpork\pulledpork.pl line 366. Done! Reading rules... readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 722. readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 722. readline() on closed filehandle DATA at d:\winids\pulledpork\pulledpork.pl line 722. Reading rules... Activating security rulesets.... Done Modifying Sids.... Done! Processing d:\winids\pulledpork\etc\enablesid.conf.... Modified 20480 rules Skipped 0 rules (already disabled) Done Processing d:\winids\pulledpork\etc\dropsid.conf.... Modified 0 rules Skipped 0 rules (already disabled) Done Processing d:\winids\pulledpork\etc\disablesid.conf.... Modified 0 rules Skipped 0 rules (already disabled) Done Setting Flowbit State.... Done Writing d:\winids\snort\rules\winids.rules.... Done Generating sid-msg.map.... Done Writing v1 d:\winids\snort\etc\sid-msg.map.... Done Writing d:\winids\snort\log\sid_changes.log.... Done Rule Stats... New:-------4 Deleted:---0 Enabled Rules:----32501 Dropped Rules:----0 Disabled Rules:---0 Total Rules:------32501 No IP Blacklist Changes Done Please review d:\winids\snort\log\sid_changes.log for additional details Fly Piggy Fly!

Make SURE you are ONLY using the Pulledpork from here. I have to modify it to work on windows. Make sure your oink code is correct. If you are behind a proxy there may be problems. Try removing everything in the pulledpork/temp folder. If there is still problems zip up the pulledpork folder and attach it. Don't forget to delete everything in the pulledpork/temp folder before compressing.

Attach you pulledpork.conf file.

The config files look good. It's usually quicker to start fresh.

To completely remove Apache2 remove the service using httpd -k uninstall then delete the Apache24 directory, and then look in the services to make sure the service is gone. Looks like something else is using port 80?

Try this one. barnyard2.conf

Attach your barnyard2.conf file.

In line 105 of your base_conf.php change: $$alert_user = 'base'; to $alert_user = 'base'; In line 434 of your base_conf.php change: $priority_colors = array('000000','FF0000','FF9900','FFFF00','999999'); to $priority_colors = array ('000000','FF0000','FF9900','FFFF00','999999');

The Windows Intrusion Detection System is probably plugged into a SWITCH. The Windows Intrusion Detection System needs to be plugged into a HUB with all the other PC's on the network, or if The Windows Intrusion Detection System is plugged into a SWITCH all the ports for the PC's to be monitored MUST be mirrored to the port The Windows Intrusion Detection System is plugged into. You could do this

You should have checked and verified the tables per the tutorial. The error states there is a problem with the archive database. Below is how to check the existence of the tables in the archive database. If the tables are missing then you might need to reinstall, and make sure that no steps are missed. Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Operator>mysql -u root -pd1ngd0ng mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 7 Server version: 5.7.18-log MySQL Community Server (GPL) Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. mysql> connect archive; Connection id: 8 Current database: archive mysql> show tables; +-------------------+ | Tables_in_archive | +-------------------+ | acid_ag | | acid_ag_alert | | acid_event | | acid_ip_cache | | base_roles | | base_users | | data | | detail | | encoding | | event | | icmphdr | | iphdr | | opt | | reference | | reference_system | | schema | | sensor | | sig_class | | sig_reference | | signature | | tcphdr | | udphdr | +-------------------+ 22 rows in set (0.00 sec) mysql>

Remember: The Windows Intrusion Detection Systems security console (BASE) will never work with PHP-7 Do not preform function if it's not detailed in the tutorial. The portscan.log will be created when it is needed.

Only use the versions that are detailed in the tutorial. There MIGHT be a failure by using newer/older versions. If you are using PHP 7.x then the BASE console will not work, and PHP is only installed for that one program. Note: It is possible to run multiple versions of PHP at the same time.

I have no idea what you are doing but you are working on a non-standard (not following tutorial) and it is really hard to diagnose problems. Note: PHP that is supported in the tutorial has extension=php_mysql as an option. There are a couple of solutions: Preform a complete reinstall and follow the tutorial. I am available for a one on support, and I guarantee to get it 100%. However, there is a $250 US fee and I would need remote access to the PC. Everything will be installed on one device, and the OS has to be one that is officially supported, and memory has to be a minimum of 3 gigs for non-server and 6 gigs for server.

This has been fixed in the current version. To fix this: Open a CMD window and type 'cd /d d:\winids\php' (less the outside quotes), and tap the 'Enter' key. At the CMD prompt type 'pear install mail mail_mime' (less the outside quotes), and tap the 'Enter' key. Close the CMD window and try it again.

You have a non-standard path assigned. I'm betting you failed to edit one of the .reg files to match your path.

Sorry for the delay. There is no event mechanism setup for auto-updating the rules using Pulledpork. This has to be completed manually unless you create something to auto-update. Remember: there needs to be faults checked throughout the complete update process because if one error occurs the Windows Intrusion Detection will shut down without notice. A script would need to very detailed and faults would need to be handled properly.

Preform a fresh install of Windows 10, and then use this tutorial to install the Windows Intrusion Detection System per the support programs you requested.

Make a copy of your barnyard2 folder, and then dissolve the attached by2.zip into the barnyard2 folder and overwrite everything. Then try the test again. Your original barnyard2.conf will not be over written. by2.zip

I just tried on a new install of Windows 7 and there is no problem. I'm not sure what your problem could be, but make sure you are running the modder.vbs from a command window with administrator privileges. You might be able to right click the modder.vbs and Run as Administrator. You might mod the modder.vbs file to bypass the check.