Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Page of Holding
('toc' missing)
Miscellaneous stuff goes here.
Mount a CIFS/Windows share on Linux w/ "good" user permissions:
(may need to install cifs-utils, will likely need to execute command as root)
mount -t cifs -o rw,exec,domain=<Windows domain>,user=<Windows user>,uid=<local Linux user>,gid=<local Linux user>,file_mode=0644,dir_mode=0755 //<ip>/<sharename> <mountpath> Blog Post Ideas
- MIME and Python's SImpleHTTPServer
- Python's SimpleHTTPServer, reverse DNS, and hangs
- Python's 'is' versus '=='
- Python decorators
- vdb/vtrace tutorials
- vstruct tutorials
- Reversing/ASM/IDA stuff
- IDAPython QuickStart
- Using IDA in batch mode
- Similarity Analysis w/ BinDIff
- ???
- Prepping Windows B0x3n
- ixnay ASLR
- adjust NX settings
- Series on writing a (unicode-compatible) keylogger for Windows
- One really wants "language elements" not button presses
- Fun with scan codes, manufacturers, laptops, keyboard layouts, ...
- Dead Keys, Ligatures
- Unicode, code points, code units, language elements, and the representation/encoding used (utf-16-le)
- Windows issues
- (up through Win8) keyboard state caching, per-thread, key buffer and the *^&(&*%$#@! flushing behavior.
Git Fun
Useful pages:
- Git Reference
- Git Tutorials ("More info on Git Flow - "A successful Git branching model" --Workflow. Get the multi-page paper, not just the diagram)
Protip: use the "--no-ff" switch when doing 'git merge'. The reason for this is so the "branch" history remains as a conceptually separate entity (see the above mentioned 'branching model' document).
workflow: create branch, checkout (i.e. switch to that branch) that branch, add/modify/commit as appro in branch, occasionally merge ('--no-ff'!!!) into said branch, push branch to Stash/designated central repo, and finally switch to "master", merge the branch into master. Due to Git's concept of branching, tags should be added somewhere in order to help keep the "branch" (conceptually) intact and the history searchable.
Merge (assume in branch foo, and want to merge foo into branch bar)
>git branch --list
* foo
bar
>git checkout bar
Switched to branch 'bar'
>git branch --list
foo
* bar
>git merge --no-ff fooSymbols & symchk
Normal use:
Create manifest file for "offline" use:
Use previously created manifest to go grab symbols:
Prepping Windows B0x3n
There are times when one might want to disable features on a box used for development & analysis. For those times you can:
- Disable Address Space Layout Randomization (ASLRAddress Space Layout Randomization):
- add the DWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages and give it a value of 0
- 0 - Disable ASLR
- 1 - Enable ASLR
- 0xFFFFFFFF - Force ASLR
- add the DWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages and give it a value of 0
- Disable (Hardware) Data Execution Protection (DEP) / No Execute(NX) (note that the deafult on Win7 is OptIn)
- From an admin command prompt: 'bcdedit /set nx AlwaysOff' & since, DEP and PAE are tied together, and since disabling DEP will, depending upon the Windows version, also disable PAE, one must make sure PAE is still with us via, "bcdedit /set pae ForceEnable"
Crypto Fun
As of this writing (late 2015), The following seem to be commonly listed as "best practices" for doing crypto things...
- No SSLSecure Socket Layer version should be used ( SSLv1 has been known to be insecure, SSLv2 had problems, and SSLv3 had public issues like POODLE), use TLSTransport Layer Security instead
- TLS v1.2 is the most current, and accepted practice is to use this.
- Disable the ability to downgrade the protocol (e.g., wanted TLSv1.2, but didn't have it available, do the protocol auto-downgrades to SSLv2 for example)
- Disable TLSTransport Layer Security compression (see public vulns like CRIME, BEAST, ...)
- (Perfect) Forward Secrecy is a great thing. Ephemeral Keying/Ephemeral Diffie-Hellman.
- Use of RC4 is a no-no
- AES w/ GCM mode is commonly accepted as the go-to right now
- Certificate Pinning is also a best practice.
- SHA1 is a no-no
- HTTP Compression can cause problems (see vulns TIME & BREACH)
- Beware/Disable Session ID/Session Tickets (i.e., SSL/TLS Session Resumption) caching of key material can be bad....
- Disabling session renegotiation is likely a good thing.
- Diffie-Hellman parameters should be greater than RSAEncryption algorithm key size
- For ephemeral DHDiffie-Hellman encryption (e.g., Perfect Forward Secrecy), the normal way TLSTransport Layer Security does it is that DHDiffie-Hellman encryption parameters are generated ahead of time and "belong" to the server
- The above implies that for a "communication pair" (composed of keys and certs for a client<->listener combo), one should probably generate new parameters along with keys & certs?
- Elliptic Curves are considered preferred, but not necessarily widespread.
- Finding out about elliptic curve selection (e.g., specifying a curve to use) is a PITA. ECC has a "bit rating" which is equivalent to some (greater) amount of RSA-bits.
- NIST has preferred/specified curves (e.g., P-384, P-521) which made it into a FIPS standard (186-3)
- Standards for Efficient Cryptography (SECG) also has recommended curves (SEC-2 Recommended Elliptic Curve Domain Parameters) (e.g., secp256r1, secp521r1)
- ANSI also has standards (e.g., X9.62, X9.63)
- in general, one selects a 'generic' "key strength" in units of bits, then determines an equivalent key strength for elliptic curve, then selects a provided, "standard" curve (e.g., P-384)
So, for teh ultimateZ in fun:
- TLS v1.2, AES-256, GCM, SHA2+, ECEdgeCase bits >= 256, DHDiffie-Hellman encryption Params >= 2048
- AES-256, EC512, SHA512
Some useful links/references:
- Standards for Efficient Cryptography (www.secg.org) (Version 2 was current as of this writing)
- Applied Crypto Hardening, https://bettercrypto.org
- Security/Server Side TLS, https://wiki.mozilla.org/Security/Server_Side_TLS
- SSL/TLS Deployment Best Practices, https://www.ssllabs.com
- NIST Cryptographic Toolkit, csrc.nist.gov/groups/ST/toolkit/
- Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security, rfc4492, https://tools.ietf.org/html/rfc4492
- www.keylength.com (shows comparison for key lengths)
- ECRYPT II, www.ecrypt.eu.org/ecrypt2 (check out the yearly reports on algorithms and key lengths)
Some Fun OpenSSL CLICommand-Line Interface Work
(the following all assume use of openssl 1.0.1e on Debian 7.8)
List available elliptic curves:
Generate an Elliptic Curve-based private key (assumes use of openssl 1.0.1e on Debian 7):
Generate a public key from a given Elliptic Curve-based private key:
Generate a cert signing request (CSR), given an existing private key:
(self) sign a CSR to make a (root, trusted, CACovert Action) certificate (good for 7 days):
Generate a signed certificate from a CSR, a root/CA certificate, and the root/CA's private key:
View the contents of a certificate:
Use openssl's client to do a connect: