cephurs

#!/usr/bin/env python3
'''
A simplified FLOSS implementation that only supports stackstrings.

requirements:
  - yara-python
  - unicorn

author: Willi Ballenthin
email: [email protected]

cephurs

#/etc/pam.d/system-auth
#%PAM-1.0

# Jump two rules if login succeeds.
auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    optional                        pam_exec.so /home/pamcam.sh
auth    requisite                       pam_deny.so

# User gets here if authentication is successful. No denying, no cam module.
auth      required  pam_unix.so     try_first_pass nullok

cephurs

references:

• https://reverseengineering.stackexchange.com/questions/1597/reverse-engineering-a-visual-basic-p-code-binary
• http://web.archive.org/web/20071020232030/http://www.alex-ionescu.com/vb.pdf (ref: Alex Ionescu)
• http://web.archive.org/web/20101127044116/http://vb-decompiler.com/pcode/opcodes.php?t=1
• https://github.com/bontchev/pcodedmp
• http://www.openrce.org/blog/view/1719/Visual_Basic_6_IDC_updated
• https://pediy.com/thread-12832.htm
• https://github.com/vic4key/VB-Exe-Parser/blob/master/VB-Parser.py
• http://www.openrce.org/repositories/users/Paolo/vbpython.py

cephurs

import r2pipe
import os
from subprocess import run 

retdec_exec = "retdec-decompiler.sh"

r2 = r2pipe.open()

filepath = r2.cmdj("ij")["core"]["file"]

cephurs

function Get-PublicKey
{
    [OutputType([byte[]])]
    PARAM (
        [Uri]$Uri
    )

    if (-Not ($uri.Scheme -eq "https"))
    {
        Write-Error "You can only get keys for https addresses"

cephurs

<#
.SYNOPSIS

This script demonstrates the ability to capture and tamper with Web sessions.  
For secure sessions, this is done by dynamically writing certificates to match the requested domain. 
This is only proof-of-concept, and should be used cautiously, to demonstrate the effects of such an attack. 

Function: Interceptor
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

cephurs

#Verify Not Present
( Get-ChildItem Cert:\CurrentUser\Root | Where-Object {$_.Subject -match "__Interceptor_Trusted_Root" })
#Import-Certificate
( Get-ChildItem -Path C:\Test\thing.cer ) | Import-Certificate -CertStoreLocation cert:\CurrentUser\Root
#Prompted
Remove-Item -Path cert:\CurrentUser\Root\5C205339AE9FA846FA99D3FFF0CDEE65EB8D8E99

cephurs

"          _                      _          "
"   _     /||       .   .        ||\     _   "
"  ( }    \||D    '   '     '   C||/    { %  "
" | /\__,=_[_]   '  .   . '       [_]_=,__/\ |"
" |_\_  |----|                    |----|  _/_|"
" |  |/ |    |                    |    | \|  |"
" |  /_ |    |                    |    | _\  |"

	It is all fun and games until someone gets hacked!

cephurs

# A port of Joakim Schicht's RegKeyFixer in PowerShell.
# https://github.com/jschicht/RegKeyFixer
#
# This script will recursively search keys starting from the Keyname
# for any value entry names with null characters
# Example usage:
# $SID = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
# $KeyName = "\Registry\User\$SID\SOFTWARE\Microsoft\Windows\CurrentVersion"
# $Results = Get-HiddenNames -KeyName $KeyName
# $Results | Remove-HiddenNames

cephurs

# requires PSReflect.ps1 to be in the same directory as this script
. .\PSReflect.ps1

$Module = New-InMemoryModule -ModuleName RegHide
# Define our structs. 

# https://msdn.microsoft.com/en-us/library/windows/hardware/ff564879(v=vs.85).aspx
# typedef struct _UNICODE_STRING {
#  USHORT Length;
#  USHORT MaximumLength;