Liu Wenyuan Dobby233Liu

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

app_name	repo	electron_version	vulnerable
1Clipboard	https://github.com/wiziple/1clipboard
1Password	None	25.8.1	FALSE
3CX Desktop App		19.0.8	TRUE
5EClient	None
Abstract	None
Account Surfer	None
Advanced REST Client	https://github.com/advanced-rest-client/arc-electron	^17.0.0	TRUE
Aedron Shrine	None
Aeon	https://github.com/leinelissen/aeon	23.2.0	TRUE

How to use:

./wordle.sh

Or try the unlimit mode:

Android Phantom, Cached And Empty Processes

This has been moved to https://github.com/agnostic-apollo/Android-Docs/blob/master/en/docs/apps/processes/phantom-cached-and-empty-processes.md

Some important headings are kept so that users can redirect to new link if they land here.

	'''
	Proof of concept way to get cookies from chrome on Windows.. even when they're locked.
	Does not require admin rights.

	Includes a pure-python version of release_file_lock from:
	https://github.com/thewh1teagle/rookie/blob/02995bbbb692f775e12368e7fb2b728775c88ddd/rookie-rs/src/winapi.rs#L63

	(C) - MIT License 2023 - Charles Machalow
	'''
	import os

	// ==UserScript==
	// @name OwOiki
	// @version 0.2.7c
	// @icon data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAAAAADmVT4XAAAAAXNSR0IArs4c6QAAAAlwSFlzAAAOwwAADsMBx2+oZAAACOFJREFUeNrs2gOQI9sex/Hf6dPpZDvJODtI1vbmrplBDaqurXXVGqVna/Wsa9u2bdv23cyOM0F3/s+YzEHnGfMpV/SN8Qvo38zAv9lQwFDAUMB/bsBQwFDAzpVN8+MLWzbg77ShZWF8ftPKnZAhoS8vKgO4CbC6ptPpb3Z6Ux0DTA6ULfoyCYFEWssQGtW0YvVBUyMMlWvob7SmEiwy9aDVK5pGhVDW6jngpzOZNfMLVz315rtvPnnGQVVgjfQ3aWSoOuiMJ397Nk9d9YWZFpv5U28BP5mA8qOu/NCl38m8/bPpBhbQ32ABjOk/eztDv+N+eOVR5ZjwEy8BZ07F8I2PZ+hP0jcnTCyioi2Cmbg5TX+SeXzjcEw900PAYlSsf4H+2oPNnLdRkdo4b36Q/toL6yuwWB+wituHP0kD5O9bhNA6Ksq6EBbdl6cBnjzc5qt0Ab+s4HOupwLpK8Yi9jMqws9iGHtFmgpcP4dX/FITsATVO1NUqH2nbcynIsw37J3tVCi1sxpL1AE7TX/bmzTYm20o3UqebS2F5Gz85k5lwGzUnUkC6esr2HjybDyruD5NAmfWYbYq4CTua/6cRNpXILiePFofxIp2Evm82cdPUgTUo+QkEsrdF2YjyaORLHxfjoROKkG9ImAYn/whifUeCOs75Ml3LBzYS2IfTubD5AFfgLmZJNwrmTGdPJlusCtdkths4gvSgEnMuptkOkeCkyccIztJ5m6LTZIG+NjYbpJab+LL5MGXYa4nqe6xzCcL2OvDuhxJ3RRCnDyII3QTSeXWwbdX8vX8foZGgtSCauNVePCqUb0AUtQ

	Dim Wsh, Fs, WMIServ
	Set Wsh = CreateObject("WScript.Shell")
	Set Fs = CreateObject("Scripting.FileSystemObject")
	Set WMIServ = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

	MainDir = Fs.GetFile(WScript.ScriptFullName).ParentFolder.Path

	Function HasArg(TargetArg)
	HasArg = False
	For Each Arg in WScript.Arguments

	from struct import pack, unpack
	import sys

	#.bss
	left9 = [0] * 0x400 #u16
	right9 = [0] * 0x400 #u16
	left12 = [0] * 0x10000 #u16
	right12 = [0] * 0x10000 #u16
	stack = [0] * 0x100 #u32
	#.sbss

	{
	"date":"1632407807322",
	"DEVICE_CHOICE_slash_Create_0_gml_28_0":"NO",
	"DEVICE_CHOICE_slash_Create_0_gml_29_0":"YES",
	"DEVICE_CHOICE_slash_Create_0_gml_64_0":"GRAINS",
	"DEVICE_CHOICE_slash_Create_0_gml_65_0":"MEAT",
	"DEVICE_CHOICE_slash_Create_0_gml_66_0":"DAIRY",
	"DEVICE_CHOICE_slash_Create_0_gml_67_0":"SWEETS",
	"DEVICE_CHOICE_slash_Create_0_gml_68_0":"FRUIT",
	"DEVICE_CHOICE_slash_Create_0_gml_69_0":"VEGETABLE",

	#Game Maker 4.X decompiler
	#for python 2.7 :^)
	#Only tested on ~20 files
	#
	#As far as I can tell, there are no tools out there that actually support GM4(even if they claim to).
	#Unlike later versions, image data is stored unencrypted. So we need to partially parse the GMD.
	import struct
	import io
	import os
	import sys