This is a guide on how to email securely.
There are many guides on how to install and use PGP to encrypt email. This is not one of them. This is a guide on secure communication using email with PGP encryption. If you are not familiar with PGP, please read another guide first. If you are comfortable using PGP to encrypt and decrypt emails, this guide will raise your security to the next level.
| #!/usr/bin/python | |
| # As written, this requires the following: | |
| # - OS X 10.6+ (may not work in 10.10, haven't tested) | |
| # - python 2.6 or 2.7 (for collections.namedtuple usage, should be fine as default python in 10.6 is 2.6) | |
| # - pyObjC (as such, recommended to be used with native OS X python install) | |
| # Only tested and confirmed to work against 10.9.5 | |
| # Run with root |
| import objc | |
| from Foundation import NSBundle | |
| IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit') | |
| functions = [("IOServiceGetMatchingService", b"II@"), | |
| ("IOServiceMatching", b"@*"), | |
| ("IORegistryEntryCreateCFProperty", b"@I@@I"), | |
| ] |
| void callEntryPointOfImage(char *path, int argc, char **argv) | |
| { | |
| void *handle; | |
| int (*binary_main)(int binary_argc, char **binary_argv); | |
| char *error; | |
| int err = 0; | |
| printf("Loading %s…\n", path); | |
| handle = dlopen (path, RTLD_LAZY); |
| import ssl, base64, objc | |
| from Foundation import NSBundle | |
| Security = NSBundle.bundleWithIdentifier_('com.apple.security') | |
| S_functions = [ | |
| ('SecCertificateCreateWithData', '@@@'), | |
| ('SecCertificateCopyValues', '@@^@o^@'), | |
| ] | |
| objc.loadBundleFunctions(Security, globals(), S_functions) |
| import objc | |
| from ctypes import c_char | |
| from Foundation import NSBundle | |
| Security = NSBundle.bundleWithIdentifier_('com.apple.security') | |
| S_functions = [ | |
| ('SecKeychainGetTypeID', 'I'), | |
| ('SecKeychainItemGetTypeID', 'I'), | |
| ('SecKeychainAddGenericPassword', 'i^{OpaqueSecKeychainRef=}I*I*I*o^^{OpaqueSecKeychainItemRef}'), | |
| ('SecKeychainOpen', 'i*o^^{OpaqueSecKeychainRef}'), |
| class Logging(object): | |
| __name__ = 'logger.info(1)' | |
| plist = '/System/Library/Preferences/Logging/Subsystems/' | |
| def __init__(__name__, plist, *args, **kwargs): | |
| super(getLogger/, self).__init__() | |
| logger.info('Input parameters:\n' | |
| 'accessibility: "{com.apple.Accessibility.plist}"\n' |
| from ctypes import CDLL, Structure, POINTER, c_int64, c_int32, c_int16, c_char, c_uint32 | |
| from ctypes.util import find_library | |
| import time | |
| c = CDLL(find_library("System")) | |
| # https://opensource.apple.com/source/Libc/Libc-1158.50.2/include/NetBSD/utmpx.h.auto.html | |
| # https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man3/endutxent.3.html#//apple_ref/doc/man/3/endutxent | |
| BOOT_TIME = 2 |
credit: @GossiTheDog: "If you want to setup FUZZBUNCH (the Equation exploit framework) you need Win7 VM + Python 2.6 + Pywin 2.6, then python fb.py for shell"
h/t @x0rz @DEYCrypt @hackerfantastic
context: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
writeup: https://www.trustedsec.com/blog/equation-group-dump-analysis-full-rce-win7-fully-patched-cobalt-strike/
decrypted files: https://github.com/x0rz/EQGRP_Lost_in_Translation
