Wes wesinator

Some DOCX samples today had the VBA script payload embedded into OLE objects in the DOCX. To a user this looks like document icons in the Word file, and for file analysis they are in the DOCX zip under word/embeddings (Thanks Brian!). After doing a few of these manaully, and then dynamically fighting with the Office debugger to get the indicators out of them individually, I took a moment to try and automate at least part of the process.

Loop through samples in a directory, yank all of the embedded OLE objects, and scan them for likely VBA script with Yara

$ for file in efax/*.docx ; do unzip -qq -o -j $file "word/embeddings*" ; \
  for y in `ls oleObject*`; do echo -n "$file  "; \
    yara -f -w vbaoleobj.yara $y;done; rm -f oleObject* ; done

There is a built-in command line utility caffeinate that can be used to prevent macOS from sleeping.

To prevent macOS from sleeping before a process with given PID exits:

$ caffeinate -w PID

To prevent macOS from sleeping for the next N seconds:

	// Defines the entry point for the console application.
	// $author: @dNetGuru

	// TConsole.cpp : Defines the entry point for the console application.
	//
	#include <stdio.h>
	#include <stdlib.h>
	#include<time.h>

	char message[] = "Hello World!\n";

	#!/usr/bin/python
	# -- coding: utf-8 --

	__author__ = "Daniel Vaca [email protected]"

	import os
	import argparse
	import time
	try:
	import requests

	var toggle = false;
	var status = 'off';
	var the_tab_id = '';

	function set_status() {
	toggle = !toggle;
	status = 'off';
	if(toggle) { status = 'on'; }
	}

	import requests

	r = requests.get("https://amtrckr.info/json/live")
	matches = []

	for row in r.json():
	koodous_r = requests.get("https://api.koodous.com/apks?search=network.hosts:'%s'" % row.get("ip"))
	for apk in koodous_r.json().get("results"):
	matches.append(apk.get("sha256"))

	curl -s -g -O -J -L -H "Authorization: Token $1" https://api.koodous.com/feed/apks
	unzip -o apk*.zip
	rm apk*.zip
	mkdir downloads

	while read p; do
	IFS=';' read -r -a array <<< "$p"
	echo "Downloading ${array[0]}"
	curl -s ${array[1]} > downloads/${array[0]}.apk
	done < samples

	sudo yum remove docker \
	docker-common \
	container-selinux \
	docker-selinux \
	docker-engine
	sudo yum install -y yum-utils device-mapper-persistent-data lvm2
	sudo yum-config-manager \
	--add-repo \
	https://download.docker.com/linux/centos/docker-ce.repo


	sudo systemctl stop cups-browsed
	sudo systemctl disable cups-browsed

	출처 : https://askubuntu.com/questions/873399/disable-cups-and-cups-browsed-in-16-04