Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #20251227
Page of Holding
('toc' missing)
Miscellaneous stuff goes here.
Mount a CIFS/Windows share on Linux w/ "good" user permissions:
(may need to install cifs-utils, will likely need to execute command as root)
mount -t cifs -o rw,exec,domain=<Windows domain>,user=<Windows user>,uid=<local Linux user>,gid=<local Linux user>,file_mode=0644,dir_mode=0755 //<ip>/<sharename> <mountpath> Blog Post Ideas
- MIME and Python's SImpleHTTPServer
- Python's SimpleHTTPServer, reverse DNS, and hangs
- Python's 'is' versus '=='
- Python decorators
- vdb/vtrace tutorials
- vstruct tutorials
- Reversing/ASM/IDA stuff
- IDAPython QuickStart
- Using IDA in batch mode
- Similarity Analysis w/ BinDIff
- ???
- Prepping Windows B0x3n
- ixnay ASLR
- adjust NX settings
- Series on writing a (unicode-compatible) keylogger for Windows
- One really wants "language elements" not button presses
- Fun with scan codes, manufacturers, laptops, keyboard layouts, ...
- Dead Keys, Ligatures
- Unicode, code points, code units, language elements, and the representation/encoding used (utf-16-le)
- Windows issues
- (up through Win8) keyboard state caching, per-thread, key buffer and the *^&(&*%$#@! flushing behavior.
Git Fun
Useful pages:
- Git Reference
- Git Tutorials ("More info on Git Flow - "A successful Git branching model" --Workflow. Get the multi-page paper, not just the diagram)
Protip: use the "--no-ff" switch when doing 'git merge'. The reason for this is so the "branch" history remains as a conceptually separate entity (see the above mentioned 'branching model' document).
Workflow (feature branch based):
- (assuming starting in master) - create the feature branch: git branch featurebranch
- switch to the branch: git checkout featurebranch
- do standard workflow (git status, git add, git commit, ...)
- periodically push the branch to the remote server: git push origin featurebranch
- periodically merge changes from mainline into the featurebranch, resolving any issues (note the "--no-ff"!!!, and assuming master is fully up-to-date): git merge --no-ff master
- when ready to merge into mainline (e.g., code reviewed, tests pass, up-to-date w/r/t merges from master, no uncommitted changes):
- change to master: git checkout master
- merge from the feature branch into master: git merge --no-ff featurebranch
- tag the current spot: git tag closed-featurebranch featurebranch
- push everything: git push --all
- push the tag: 'git push origin closed-featurebranch'
- delete the local branch: git branch -d featurebranch
- delete the remote branch: git push origin --delete featurebranch
- If, at a later point, the branch needs to be re-opened, do so via the previously created tag: git branch reopened-featurebranch closed-featurebranch
Merge (assume in branch foo, and want to merge foo into branch bar)
>git branch --list
* foo
bar
>git checkout bar
Switched to branch 'bar'
>git branch --list
foo
* bar
>git merge --no-ff fooSymbols & symchk
Normal use:
Create manifest file for "offline" use:
Use previously created manifest to go grab symbols:
Prepping Windows B0x3n
There are times when one might want to disable features on a box used for development & analysis. For those times you can:
- Disable Address Space Layout Randomization (ASLRAddress Space Layout Randomization):
- add the DWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages and give it a value of 0
- 0 - Disable ASLR
- 1 - Enable ASLR
- 0xFFFFFFFF - Force ASLR
- add the DWORD HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages and give it a value of 0
- Disable (Hardware) Data Execution Protection (DEP) / No Execute(NX) (note that the deafult on Win7 is OptIn)
- From an admin command prompt: 'bcdedit /set nx AlwaysOff' & since, DEP and PAE are tied together, and since disabling DEP will, depending upon the Windows version, also disable PAE, one must make sure PAE is still with us via, "bcdedit /set pae ForceEnable"
Crypto Fun
As of this writing (late 2015), The following seem to be commonly listed as "best practices" for doing crypto things...
- No SSLSecure Socket Layer version should be used ( SSLv1 has been known to be insecure, SSLv2 had problems, and SSLv3 had public issues like POODLE), use TLSTransport Layer Security instead
- TLS v1.2 is the most current, and accepted practice is to use this.
- Disable the ability to downgrade the protocol (e.g., wanted TLSv1.2, but didn't have it available, do the protocol auto-downgrades to SSLv2 for example)
- Disable TLSTransport Layer Security compression (see public vulns like CRIME, BEAST, ...)
- (Perfect) Forward Secrecy is a great thing. Ephemeral Keying/Ephemeral Diffie-Hellman.
- Use of RC4 is a no-no
- AES w/ GCM mode is commonly accepted as the go-to right now
- Certificate Pinning is also a best practice.
- SHA1 is a no-no
- HTTP Compression can cause problems (see vulns TIME & BREACH)
- Beware/Disable Session ID/Session Tickets (i.e., SSL/TLS Session Resumption) caching of key material can be bad....
- Disabling session renegotiation is likely a good thing.
- Diffie-Hellman parameters should be greater than RSAEncryption algorithm key size
- For ephemeral DHDiffie-Hellman encryption (e.g., Perfect Forward Secrecy), the normal way TLSTransport Layer Security does it is that DHDiffie-Hellman encryption parameters are generated ahead of time and "belong" to the server
- The above implies that for a "communication pair" (composed of keys and certs for a client<->listener combo), one should probably generate new parameters along with keys & certs?
- Elliptic Curves are considered preferred, but not necessarily widespread.
- Finding out about elliptic curve selection (e.g., specifying a curve to use) is a PITA. ECC has a "bit rating" which is equivalent to some (greater) amount of RSA-bits.
- NIST has preferred/specified curves (e.g., P-384, P-521) which made it into a FIPS standard (186-3)
- Standards for Efficient Cryptography (SECG) also has recommended curves (SEC-2 Recommended Elliptic Curve Domain Parameters) (e.g., secp256r1, secp521r1)
- ANSI also has standards (e.g., X9.62, X9.63)
- in general, one selects a 'generic' "key strength" in units of bits, then determines an equivalent key strength for elliptic curve, then selects a provided, "standard" curve (e.g., P-384)
So, for teh ultimateZ in fun:
- TLS v1.2, AES-256, GCM, SHA2+, ECEdgeCase bits >= 256, DHDiffie-Hellman encryption Params >= 2048
- AES-256, EC512, SHA512
Some useful links/references:
- Standards for Efficient Cryptography (www.secg.org) (Version 2 was current as of this writing)
- Applied Crypto Hardening, https://bettercrypto.org
- Security/Server Side TLS, https://wiki.mozilla.org/Security/Server_Side_TLS
- SSL/TLS Deployment Best Practices, https://www.ssllabs.com
- NIST Cryptographic Toolkit, csrc.nist.gov/groups/ST/toolkit/
- Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security, rfc4492, https://tools.ietf.org/html/rfc4492
- www.keylength.com (shows comparison for key lengths)
- ECRYPT II, www.ecrypt.eu.org/ecrypt2 (check out the yearly reports on algorithms and key lengths)
Some Fun OpenSSL CLICommand-Line Interface Work
(the following all assume use of openssl 1.0.1e on Debian 7.8)
List available elliptic curves:
Generate an Elliptic Curve-based private key (assumes use of openssl 1.0.1e on Debian 7):
Generate a public key from a given Elliptic Curve-based private key:
Generate a cert signing request (CSR), given an existing private key:
(self) sign a CSR to make a (root, trusted, CACovert Action) certificate (good for 7 days):
Generate a signed certificate from a CSR, a root/CA certificate, and the root/CA's private key:
View the contents of a certificate:
Use openssl's client to do a connect:
SQLite fun
Get a list of all tables (ref sqlite's FAQ: "How do I list all tables/indices contained in an SQLite database?)
Get a count of all tables
See if a table has any data: