Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Page of Holding
Miscellaneous stuff goes here.
Mount a CIFS/Windows share on Linux w/ "good" user permissions:
(may need to install cifs-utils, will likely need to execute command as root)
mount -t cifs -o rw,domain=<Windows domain>,user=<Windows user>,uid=<local Linux user>,gid=<local Linux user>,file_mode=0644,dir_mode=0755 //<ip>/<sharename> <mountpath> Blog Post Ideas
- MIME and Python's SImpleHTTPServer
- Python's SimpleHTTPServer, reverse DNS, and hangs
- Python's 'is' versus '=='
- Python decorators
- vdb/vtrace tutorials
- vstruct tutorials
- Reversing/ASM/IDA stuff
- IDAPython QuickStart
- Using IDA in batch mode
- Similarity Analysis w/ BinDIff
- ???
- Prepping Windows B0x3n
- ixnay ASLR
- adjust NX settings
Git Fun
Useful pages:
- Git Reference
- Git Tutorials ("More info on Git Flow - "A successful Git branching model" --Workflow. Get the multi-page paper, not just the diagram)
Protip: use the "--no-ff" switch when doing 'git merge'. The reason for this is so the "branch" history remains as a conceptually separate entity (see the above mentioned 'branching model' document).
workflow: create branch, checkout (i.e. switch to that branch) that branch, add/modify/commit as appro in branch, occasionally merge ('--no-ff'!!!) into said branch, push branch to Stash/designated central repo, and finally switch to "master", merge the branch into master. Due to Git's concept of branching, tags should be added somewhere in order to help keep the "branch" (conceptually) intact and the history searchable.
Symbols & symchk
Normal use:
Create manifest file for "offline" use:
Use previously created manifest to go grab symbols:
Prepping Windows B0x3n
There are times when one might want to disable features on a box used for development & analysis. For those times you can:
- Disable Address Space Layout Randomization (ASLRAddress Space Layout Randomization):
- add the DWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages and give it a value of 0
- Disable (Hardware) Data Execution Protection (DEP) / No Execute(NX) (note that the deafult on Win7 is OptIn)
- From an admin command prompt: 'bcdedit /set nx AlwaysOff' & since, DEP and PAE are tied together, and since disabling DEP will, depending upon the Windows version, also disable PAE, one must make sure PAE is still with us via, "bcdedit /set pae ForceEnable"