Articles in the Misc category

Using kd.exe from VSCode Remote
Fri 02 July 2021
Category: Misc

I wanted to do a small post here, just because the answer to this issue was sort of scattered on the internet. Bigger post coming soon on some kernel exploit technique stuff.
It turns out that when running kd.exe for command line kernel debugging from VSCode remote, symbol resolution breaks completely. Why? Looks like when running from a service symsrv.dll uses WINHTTP for making requests instead of WININET. You can replicate this behavior in a normal shell by setting $env:DBGHELP_WINHTTP=1 in a powershell window and then running kd.exe. For some reason, WINHTTP tries to always use a proxy server, so you have to tell it not to via the following key in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Symbol Server -> NoInternetProxy -> DWORD = 1
You should also set it in HKLM\SOFTWARE\WOW6432Node\Microsoft\Symbol Server too, in case you are using a 32-bit debugger.
This issue will happen with cdb.exe and kd.exe, so I hope this solution helps someone.
https://stackoverflow.com/questions/5095328/cannot-download-microsoft-symbols-when-running-cdb-in-a-windows-service
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/configuring-the-registry
Uberconference Hidden Hangup Button
Thu 24 January 2019
Category: Misc

I was on an uberconference call the other day and the leader of the conference mentioned how they had the ability to disconnect anyone on the call with a "Hangup" button next to the mute and profile buttons. Looking at the interface a caller with the icons expanded looks like this:
Now let's inspect... Going down to where the profile and mute buttons are located it looks like there's one more, hidden button available:
Removing the style="display: none;" attribute from the div causes the button to show...
It's funny because it actually works. If you click it the person gets booted from the call, even if you aren't an admin/call leader. Web is hard.
Thanks for reading.
Upgrading an Amazon EC2 Instance from Ubuntu Trusty to Xenial
Tue 04 July 2017
Category: Misc

I had a bad time.
I ran a do-release-upgrade on one of my Amazon EC2 instances to try and upgrade it from 14.04 (Trusty) to 16.04 (Xenial). After the update and a reboot the box refused to come back up. When I detached the drive and attached it to another to check syslog I found this:
/sbin/dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0 Usage: dhclient [-4|-6] [-SNTP1dvrx] [-nw] [-p <port>] [-D LL|LLT] [-s server-addr] [-cf config-file] [-lf lease-file] [-pf pid-file] [--no-pid] [-e VAR=val] [-sf script-file] [interface] Failed to bring up eth0.
Oh good, it forgot how to eth0.
I spent about four hours figuring out how to fix it:
apt update apt -y upgrade cat << EOF > /etc/update-manager/release-upgrades.d/unauth.cfg [Distro] AllowUnauthenticated=yes EOF apt install -y network-manager do-release-upgrade apt update apt -y upgrade systemctl enable systemd-networkd systemctl enable systemd-resolved dpkg-reconfigure resolvconf apt-get -y autoremove rm /etc/update-manager/release-upgrades.d/unauth.cfg reboot
Make sure you are up to date first.
Some packages (python3) complain that they are unauthenticated. Feel free to skip this if you want.
Install the network-manager
Leap of faith... do the upgrade
Finish the upgrade by installing the rest of the packages.
Enable the systemd network daemon and resolver daemon
Reconfigure resolvconf so you can dns
Get rid of the unauth.cfg file you created
Reboot and pray.
Thanks to these three links for the solutions (I just put them together):
- https://askubuntu.com/a/426121
- https://askubuntu.com/a/769239
- http://willhaley.com/blog/resolvconf-dns-issue-after-ubuntu-xenial-upgrade/
Mr. Robot Season 2 Episode 4 Easter Egg
Thu 28 July 2016
Category: Misc

After seeing the last Mr. Robot easter egg from season 2 episode 1 I have been on the lookout for IP's and domains to try and go after. At the end of season 2 episode 4 (init_1.asec) Elliot logs into an IRC server and the IP address is clearly visible as 192.251.68.53.
I decided to scan that host with nmap and got the following results:
→ sudo nmap -sS -Pn -sV -n 192.251.68.253 Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-28 08:46 EDT Nmap scan report for 192.251.68.253 Host is up (0.023s latency). Not shown: 996 filtered ports PORT STATE SERVICE VERSION 21/tcp open ftp? 80/tcp open http-proxy F5 BIG-IP load balancer http proxy 554/tcp open rtsp? 7070/tcp open realserver? Service Info: Device: load balancer
HTTP up, cool. I went to the site and it was a fake IRC server with the hostname irc.colo-solutions.net:
After it logged me in as D0loresH4ze I was dropped in a channel called #th3g3ntl3man with the all too familiar samsepi0l (for the uninformed, Sam Sepiol was the alias Elliot used in season one to gain access to Steel Mountain, a secure datacenter).
After poking around and trying to get samsepi0l to say something besides "i don't have time for this right now." I played the roll of Darlene and entered what she said in the show:
Here is the respone I got:
they have changed their standard issue. we have a way in.
What does that even mean? At the end of the episode this line of dialogue was not shown. Only wait for my instructions was. The scene after shows a news article from Business Insider titled FBI gives up Blackberry for Android. I assume that is their "standard issue" and he is going to hack into them via their smartphones. That's a bold move, we'll see how it plays out next week.
After this I investigated a couple of other addresses I found (192.251.68.240, 104.97.14.93, 192.251.68.249, irc.eversible.co) but none of them turned up anything. I looked at the page source too, hoping to find something hidden in the javascript or HTML. Nothing there either... I guess we will just have to wait and see where this goes! I'll probably take a closer look at this after work, but I thought this would be cool to share now.
Hello World
Fri 01 July 2016
Category: Misc

Finally finished this new blog. It's all static now so that's good.
I was on wordpress before and it was terrible. Hopefully I can put some cool stuff here!