Here is a new tool I’m releasing as beta: pngdump.py.
It’s a tool to analyze PNG files. Unlike jpegdump, you can not yet select items for further analysis.
Monday 18 April 2022
Saturday 9 April 2022
New Tool: myjson-filter.py
A couple of my tools can produce JSON output, using my own format (myjson).
This output can then be piped into another tool, like strings.py or file-magic.py.
I’m now releasing a tool that can be put into a command pipe to filter the JSON data: myjson-filter.py
For example, here I use myjson-filter.py to remove all items that are XML files (based on the content: starting with <?xml) before strings are extracted with strings.py:
More info in this ISC diary entry I wrote: “Method For String Extraction Filtering“.
MD5: 15DDC15DE65F447CE6DA94F8B34C5066
SHA256: EB330FE49421A13A8743F18064788DC2E8189A9B63FD19D517F0B830D1569321
Friday 1 April 2022
Overview of Content Published in March
Here is an overview of content I published in March:
Blog posts:
YouTube videos:
Videoblog posts:
- YARA?s Console Module
- MSBuild & Cobalt Strike
- Quick & Dirty Shellcode Analysis ? CVE-2017-11882
- TShark & Multiple IP Addresses
- Maldoc Cleaned by Anti-Virus
- TShark & Multiple IP Addresses
- oledump’s Extra Option
- Video: TShark & Multiple IP Addresses
- ICMP Messages: Original Datagram Field
- YARA 4.2.0 Released
- Curl on Windows
- SolarWinds Advisory: Unauthenticated Access in Web Help Desk (12.7.5)
- MGLNDD_* Scans
- Maldoc Cleaned by Anti-Virus
- Wireshark 3.6.3 Released
- Video: Maldoc Cleaned by Anti-Virus
- Quickie: Parsing XLSB Documents
Saturday 5 March 2022
Overview of Content Published in February
Here is an overview of content I published in February:
Blog posts:
YouTube videos:
SANS ISC Diary entries:
Wednesday 2 February 2022
Overview of Content Published in January
Here is an overview of content I published in January:
SANS ISC Diary entries:
SANS ISC Diary entries:
Saturday 1 January 2022
Overview of Content Published in December
Here is an overview of content I published in December:
Blog posts:
- MiTM Cobalt Strike Network Traffic
- Update: base64dump.py Version 0.0.19
- Update: cs-decrypt-metadata.py Version 0.0.4
- Update: cs-parse-traffic.py Version 0.0.4
- Update: 1768.py Version 0.0.11
- Update: cs-extract-key.py Version 0.0.4
- Update: cs-analyze-processdump.py Version 0.0.3
- VBA: __SRP_ Streams
- Update: pecheck Version 0.7.14
- Update: base64dump.py Version 0.0.20
Wednesday 1 December 2021
Overview of Content Published in November
Here is an overview of content I published in November:
Blog posts:
Blog posts:
- New Tool: cs-extract-key.py
- Update: 1768.py Version 0.0.9
- Update: cs-decrypt-metadata.py Version 0.0.2
- Update: 1768.py Version 0.0.10
- Update: base64dump.py Version 0.0.18
- Update: cs-decrypt-metadata.py Version 0.0.3
- New tool: cs-analyze-processdump.py
- New Tool: cs-parse-traffic.py
- Update: cs-extract-key.py Version 0.0.3
- Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory
- Decrypting Cobalt Strike Metadata Without and With Malleable C2 Instructions
- Obfuscated Maldoc: Reversed BASE64
- YARA Rules for Office Maldocs
- Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory
- Decrypting Cobalt Strike Metadata Without and With Malleable C2 Instructions
- Obfuscated Maldoc: Reversed BASE64
- YARA Rules for Office Maldocs
- Decrypting Cobalt Strike Traffic With a “Leaked” Private Key
- Sysinternals: Autoruns and Sysmon updates
- Video: Phishing ZIP With Malformed Filename
- Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory
- Video: Decrypting Cobalt Strike Traffic With Keys Extracted From Process Memory
- Obfuscated Maldoc: Reversed BASE64
- Video: Obfuscated Maldoc: Reversed BASE64
- External Email System FBI Compromised: Sending Out Fake Warnings
- Backdooring PAM
- Simple YARA Rules for Office Maldocs
- YARA Rule for OOXML Maldocs: Less False Positives
- YARA’s Private Strings
- Video: SANS Holiday Hack Challenge 2021 Q&A with Ed Skoudis
- Video: YARA Rules for Office Maldocs
- Wireshark 3.6.0 Released
Monday 29 November 2021
New Tool: cs-parse-traffic.py
This tool is the combination of beta tool cs-parse-http-traffic.py (discontinued) and unreleased tool cs-parse-dns-traffic.py: it can decrypt and parse Cobalt Strike DNS and HTTP beacon network traffic.
By default it handles HTTP traffic. Use option -f dns to handle DNS traffic.
cs-parse-traffic_V0_0_3.zip (https)MD5: D11D64222CD77407FCEE5E6235470828
SHA256: 916B44513620FD2BB3F7263D279E8219419A87F89CDA1253011D7338896405DD
Wednesday 3 November 2021
New Tool: cs-extract-key.py
cs-extract-key.py is a tool designed to extract cryptographic keys from Cobalt Strike beacon process memory dumps.
This tool was already available in my beta repository.
This tool can extract cryptographic keys from process memory dumps of a version 3.x beacon directly:
And from version 4.x together with encrypted data extracted from network capture:
More details can be found in the man page, and in and upcoming blog post.
cs-extract-key_V0_0_1.zip (https)MD5: 4102A5A5BFD4D432DA4A721D43F568F5
SHA256: BBEDF6CBFFF51669187694F463C32A49F53420BEDF8B76508D06850643DE334F
Monday 1 November 2021
Overview of Content Published in October
Here is an overview of content I published in October:
Blog posts:
- New Tool: onion-connect-service-detection.py
- Update: 1768.py Version 0.0.8
- “Public” Private Cobalt Strike Keys
- New Tool: cs-decrypt-metadata.py
YouTube videos:
- CVE-2021-40444 Maldocs: Extracting URLs
- Cobalt Strike: Decrypting C2 Traffic With A “Leaked” Private Key
- Phishing ZIP With Malformed Filename
Videoblog posts:
- Strings Analysis: VBA & Excel4 Maldoc
- CVE-2021-40444 Maldocs: Extracting URLs
- Cobalt Strike: Decrypting C2 Traffic With A ?Leaked? Private Key
- Phishing ZIP With Malformed Filename
SANS ISC Diary entries:
- Video: CVE-2021-40444 Maldocs: Extracting URLs
- Wireshark 3.4.9 Released
- YARA Release v4.1.3
- Reader Malware: ZIP/HTML Phish
- Phishing ZIP With Malformed Filename
- Decrypting Cobalt Strike Traffic With a “Leaked” Private Key
- Sysinternals: Autoruns and Sysmon updates
- Video: Phishing ZIP With Malformed Filename
NVISO blog posts:
Didier Stevens 