This new version of oledump brings updates to .msg plugins plugin_msg and plugin_msg_summary.
Plugin plugin_msg_summary can now produce JSON output for attachments (plugin option -J).
Plugin plugin_msg now parses porperty streams.
More details can be found in my SANS ISC diary entry “Analyzing MSG Files“.
oledump_V0_0_76.zip (http)I developed a Wireshark dissector (fl-dissector) in Lua to dissect TCP protocols with fixed field lengths. The dissector is controlled through protocol preferences and Lua script arguments.
The port number is an essential argument, if you don’t provide it, default port number 1234 will be used.
Example for TCP port 50500: -X lua_script1:port:50500.
The protocol name (default fldissector) can be changed with argument protocolname: -X lua_script1:protocolname:firmware.
The length of the fields can be changed via the protocol preferences dialog:
Field lengths are separated by a comma.
Field lengths can also be defined by Lua script argument fieldlengths, like this: -X lua_script1:fieldlengths:1,1,2:L,2:L.
When field lengths are defined via a Lua script argument, this argument takes precedence over the settings in the protocol preferences dialog. fieldlengths can also specify the field type, but only via Lua script argument, not via protocol preferences (this is due to a Lua script dissector design limitation: protocol preferences can only be read after dissector initialization, and fields have to be defined before dissector initialization). Field types are defined like this: length:type. Type can be L (or l) and defines a little-endian integer, or B (or b) and defines a big-endian integer. The length of the integer (8, 16, 24 or 32 its) is inferred from the fieldlength. Fields without a defined type ate byte fields.
The length of the last field is not specified, it contains all the remaining bytes (if any).
Field names are specified with Lua script argument fieldnames: -X lua_script1:fieldnames:Function,Direction,Counter,DataLength,Data.
fl_dissector_V0_0_1.zip (http)metatool.py is a tool to help with the analysis of Metasploit or Cobalt Strike URLs.
I added option -a to provide URLs via the command-line.
metatool_V0_0_4.zip (http)This update to 1768.py, my Cobalt Strike beacon analysis tool, adds “runtime configuration” extraction.
Although 1768.py could already search for beacon configurations inside process memory dumps, the dump was just processed as a raw file.
With this update, 1768.py will also search for the runtime configuration inside a process memory dump. The runtime configuration, is a C/C++ array with integers and pointers, that is created in the heap by the beacon’s C/C++ code from the obfuscated configuration (e.g., XOR 0x2E).
Because this requires pointer calculations for the heap, Python module minidump is required. A warning will be displayed if it is not installed and it is needed.
The hexadecimal dump screenshots in this blog post show a runtime configuration.
Example of 1768.py finding a runtime configuration:
This is a 32-bit runtime config.
As the runtime config uses pointers, its structure is different for 32-bit and 64-bit beacons (because pointer size is different).
In this process memory dump, 1768.py only found the runtime config, not the embedded config.
Here is an example where both configs are found:
This new version of format-bytes.py adds IPv6 representations:
Big-endian (b), little-endian (l) and 4 32-bit little-endian unsigned integers (l4).
And if you use a # to pass on literal data (here in hexadecimal: #h#), then the data is also printed.
format-bytes_V0_0_15.zip (http)Some extra information when signature is found.
1768_v0_0_19.zip (http)This update adds ZIP support for binary files, and a –prompt option.
When this option is used, the user is prompted after each request, and processing of new requests is suspended until the user reacts to the prompt.
simple_listener_v0_1_4.zip (http)This update adds option –group: with this option, all lines are stored as a list in variable lines, and the Python expression is evaluated just once after each file is processed.
python-per-line_V0_0_11.zip (http)This new version adds YARA support.
myjson-filter_V0_0_5.zip (http)This new version adds two new values for option -l.
One could already use option -l P to locate all PE files inside an arbitrary binary file.
Option -l PE also adds entries for the extra (E) data, e.g., the data in between found PE files.
Option -l PO is like PE, but adds some more information for the other (O) files: the magic header (hex & ASCII).
pecheck-v0_7_16.zip (http)
