Conflict

In all arguments, both solvable and perpetual, no one is ever right. There is no absolute reality in conflict, only two subjective realities.

Fundamental error: believing that the fight is all other's fault.

Changes

People can change only if they feel that they are basically liked and accepted as they are. When people feel criticized, disliked, and unappreciated they are unable to change.
Instead, they feel under siege and dig in to protect themselves.

Vulnerability in HTML prevents opening CHM remote files

Problem:
       After downloading a .chm file from network or Internet, it is treated by windows as untrusted, so when you try to open it, an Action canceled  error page appears:

 Miscrosoft issued updates to fix the bug (Microsoft Security Bulletin MS05-026). To view the file correctly, there are at least 2 methods:

1. Use HHReg utility to register HTML Help (.chm) files, and make them available for viewing, after they have been downloaded.  Details on how to use it on the site.
2. A simpler way could also work:
• Right-click the chm file, and then click Properties.
• Click Unblock
• Open the .chm again.
• Enjoy the pirate copy of the book  :)

AutoIt script to execute on key combination event

     For the Programming section of SecurityOverride, you are required to make a script to resolve a task, given a random input, in a short time, 10-15 seconds.  The method I've used for all the challenges:  I've written an AutoIt  script that:

• stays active when run
• after a keyboard combination is pressed:
  
  • copies the selected text into clipboard
  • gets it, and executes a function on it
  • puts the result in the clipboard

Example for challenge1:


         In order to complete Programming Challenge 1, you must code a script that will reverse the string below, while maintaining the first letter at the beginning.
         Example: chicken -> cnekcih

#comments-start
#comments-start
 ;---------------------------------------
 Autorun program on Ctrl+C event (for SecurityOverride programming)
 ;---------------------------------------
#comments-end 

HotKeySet("^{F1}", "Solve")
Global $input

While 1
 Sleep(10000)
WEnd


Func Solve()
 GetInput()
 ParseInput()
 Exit(0)
EndFunc

Func GetInput()
 Send("^{c}")
 $input = ClipGet()
EndFunc

Func ParseInput()  
 Local $a = StringToASCIIArray($input)
 Local $len = StringLen($input)
 Local $i, $j = 1
 Dim $rez[$len]
 
 $rez[0] = $a[0]
 For $i = $len-1 to 1 Step -1
   $rez[$j] = $a[$i]
   $j = $j + 1
 Next
 
 ClipPut(StringFromASCIIArray($rez))
EndFunc

; cnekcih

References: 

1. AutoIt official site
2. Scite IDE for AutoIt3
3. Great site: SecurityOverride

Script to find diff between labels in ClearCase

     A simple bash script, using cleartool,  to show files that have the new label, but not the old one. Supposedly modified files are label correctly with new label, the script will show the files modified between two labels, in ClearCase. It will also show the creator of the new version. There is also a grep with regular expression filter on the output, to show only the files with .c, .cpp, .h, ... extensions.

#! /bin/bash
# Script to show diffs between 2 ClearCase labels

#cleartool location
export CT=/usr/atria/bin/cleartool

function usage() {
 echo "Usage: cc_dif.sh <new_label> <old_label>"
 exit
}

if [ $# -ne 2 ] ; then
 usage
 exit
else
 echo -e "\t-- New label: $1 --"
 echo -e "\t-- Old label: $2 --\n"
fi

${CT} find . -version "{(lbtype($1) && ! lbtype($2))}" -exec 'cleartool describe -fmt "%Xn \t\tBy: %Fu (%Lu) \n" $CLEARCASE_PN' | grep -E '.*\.(c|cpp|h|hpp|xml)@' 

References:

• cleartool find man page (cand also be accessed with cleartool man find )
• cleartool describe man page
• format to apply to describecommand:  fmt_ccase  
• Useful regexp filters, this post

Hope it will be useful for others too. If you used other methods to do this, leave a comment:) 

Strings replacement for windows

      Sometimes a simple utility like unix strings can be very helpful in forensics process. Strings is a tool for Windows OS, developed by Mark Russinovich, that scans executables or object files for ASCII or UNICODE strings. Strings can be called with wildcard parameters and can be used in conjunction with other tools like findstr. 


Ex:
      strings prog123.exe | findstr -i name > OUT


Another useful parameter is '-n' used for return only strings of a minimum length.  The flags -a and -u  can be used to scan for ASCII/UNICODE strings. It can scan files and folders too.


Using strings

Usage: strings.exe [-a] [-b bytes] [-n length] [-o] [-q] [-s] [-u]

Strings takes wild-card expressions for file names, and additional command line parameters are defined as follows:

-s	Recurse subdirectories.
-o	Print offset in file string is located.
-a	Scan for ASCII only.
-u	Scan for UNICODE only.
-b bytes	Bytes of file to scan.
-n X	Strings must be a minimum of X characters in length.

To search one or more files for the presence of a particular string using strings use a command like this:

strings * | findstr /i TextToSearchFor

References:

• Strings v4.21 (Mark Russinovich)

Alternate Data Streams in NTFS

Windows alternate Data Streams  
Windows NT from version 3.1 to 2000 and XP has a nice (and documented!) feature: a file can have multiple streams. Maybe one stream of data, the other with information, metadata. Anyway, you can have a small data file that can have a bigger (and hidden) alternate stream containing maybe viruses, or just information you want to be hidden. This (sometimes useful) feature can be exploited in not so friendly ways.


Creating ADS Example

• Create an ADS associated with hello.txt file:
      echo "Hidden text" > hello.txt:hidden
  
• Associate an executable with an ADS:
        type prog12.exe >hello.txt:hidden.exe
  
• ADS text can be viewed with the same syntax:
        notepad hello.txt:hidden.txt
  
• Running ADS executable:
       start hello.txt:hidden.exe 
  (This generates an error about absolute paths on Windows NT, so running with absolute path solves it)
       start c:\hello.txt:hidden.exe
  This command will start a new shell and execute it. Done.
• Another feature is that ads can be attached to directories:
       type "in hidden dir" > c:\HELLO:hidden.txt
• What makes ADS still cool (in an evil way:) is that public awareness is still very restricted to specific public

Detecting ADS
Those ads cannot be detected with the DIR command. DIR command reports the file hello.txt, with just it's size, not considering the alternate streams. Two good free programs to detect ADS are LADS by Frank Heyne and streams by Mark Russinovich.  The output shows how to create 2 alternate streams with text and an executable, and also that normal DIR operations don't detect them. 

(Click to enlarge)

Task manager and process tools (procexp and tasklist) show the hidden executable correctly ( c:\hello.txt:hidden.exe)


Deleting ADS

• If you move the file/folder containing alternate streams to a file system different than NTFS, alternate streams are deleted
• If ADS is not attached to a directory you can copy just the content of the file (without ads) to a new file, and maybe delete the old one
        type hello.txt > hello_noads.txt
• If ADS is attached to a directory, use the trick from Frank Heyne site, or use streams program with -d parameter. 

References:

• NTFS Streams
• The Dark Side of NTFS at InfosecWriters 
• A thorough analysis of NTFS ADS  (Frank Heyne)
• Streams v1.56 by Mark Russinovich