captainGeech42

import "pe"

rule Feature_PE_NoManifest {
    meta:
        date = "2022-03-13"
        author = "Zander Work (@captainGeech42)"
        descr = "Look for PE files that don't have a manifest. This could be indicative of malicious files trying to reduce their footprint."
        notes = "When building a binary with MSVC, the manifest can be disabled by passing /MANIFEST:NO to link.exe. By default, a manifest is generated when compiling via Visual Studio."
        ref_manifest = "https://gist.github.com/captainGeech42/5e0bf655d048a562336ce99eea23dccc"
        ref_sample = "ade0b06ef992926f5e5c80b69af19a70"

captainGeech42

import "pe"

rule Methodology_PE_LoadLibraryGetProcAddrOnly {
    meta:
        date = "2022-04-18"
        author = "Zander Work (@captainGeech42)"
        ref = "80ecb9e09772f5c54b2c02519ed68883"
        desc = "Look for binaries with only LoadLibrary* and GetProcAddress imports. Not necessarily a sign of maliciousness, but worth looking into probably."
    condition:
        pe.is_pe and pe.number_of_imported_functions == 2 and

captainGeech42

#!/usr/bin/env python3

# script for managing OTP codes. requires py3.6+
# secrets can optionally be encrypted at rest with pbkdf2/chacha20
# uses a sqlite database for storing data
# to run tests: python -m pytest otpboi.py

import argparse
import base64
import binascii

captainGeech42

IMPORTS_TO_PATCH = [
    "alarm",
    "ptrace"
]

# iterate over imported symbols
for import_sym in bv.get_symbols_of_type(SymbolType.ImportedFunctionSymbol):
    # check if symbol is in the patch list
    if import_sym.name in IMPORTS_TO_PATCH:
        log.log_info(f"patching out call to {import_sym.name}")

captainGeech42

#!/usr/bin/env python3

"""
A script to output tabular data from a Storm query. Stormfile queries must emit data via $lib.csv.emit()

Based on Synapse's csvtool
    source: https://github.com/vertexproject/synapse/blob/master/synapse/tools/csvtool.py
"""

import argparse

captainGeech42

Install a window manager, XFCE is my preference for VNC setups.

$ sudo apt install xubuntu-desktop tightvncserver
$ sudo reboot

Next, configure the VNC session behavior. vncpasswd interactively prompts for a password, its different than the user password, and hashed into ~/.vnc/passwd.

$ mkdir ~/.vnc

captainGeech42

import logging
import os
import time
import traceback

import requests
from dateutil.parser import parse as dt_parse

WEBHOOK_URL = "https://discord.com/api/webhooks/xxxxxx"
CTFD_URL = "https://xxxxxxxxxxx"