wdormann

#!/usr/bin/env python3
"""
find_retpoline_gadgets_auto.py

Find "retpoline-style" gadgets in an uncompressed vmlinux by looking for
call/jmp rel32 instructions that target retpoline thunks (e.g.
__x86_indirect_thunk_rax, __x86_return_thunk). The script will attempt to
auto-compute the KASLR slide using /proc/kallsyms and the symbols inside the
vmlinux ELF. You can also pass an explicit --slide to override.

wdormann

import socket
import os

def main():
    # Create a Unix Datagram (DGRAM) socket
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)

    # Bind the socket to a file
    socket_path = './sock'
    if os.path.exists(socket_path):

wdormann

rule PathSegmentLNK {
strings:
        $lnk_header = { 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
        $exe_string = ".exe" nocase
        $c_drive = "c:\\" nocase
    condition:
        $lnk_header at 0 and
        for any i in (0x80..0xC0): (
            uint8(i) == 0x5C and
            for any j in (i+1..0xC0): (uint8(j) == 0x5C)

wdormann

import subprocess
import re
import time
import os
from collections import defaultdict

# Function to get the kernel version
def get_kernel():
    result = subprocess.Popen(['uname', '-a'], stdout=subprocess.PIPE)
    output, _ = result.communicate()

wdormann

# Ensure the profile path exists
if (!(Test-Path -Path $PROFILE)) {
    New-Item -Type File -Path $PROFILE -Force
}

# Define the content to add to the profile
$profileContent = @'
function Invoke-CMDDir {
    $cmdArgs = @('/c', 'dir') + $args
    & cmd.exe $cmdArgs

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 87:

The parameter is incorrect.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 4551:

Your organization used Device Guard to block this app. Contact your support person for more info.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 87:

The parameter is incorrect.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 2148204812:

A certificate was explicitly revoked by its issuer.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 577:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 4551:

Your organization used Device Guard to block this app. Contact your support person for more info.

wdormann

sc start 0023ca0ca16a62d93ef51f3df98b2f94.bin
[SC] StartService FAILED 577:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

sc start 0067c788e1cb174f008c325ebde56c22.bin
[SC] StartService FAILED 2148204812:

A certificate was explicitly revoked by its issuer.

wdormann

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Aspose.Email;

namespace msgtotnef
{
    class Program