This new version of 1768.py brings option -H to include file hashes, introduces shellcode type detection and has updated statistics.
MD5: F7E85586045AA76C573E010E6FF5F701
SHA256: 33B43A5AB059556C17083E824D407891CD14544B5CA416223020076C5878D310
Sunday 17 April 2022
Update: 1768.py Version 0.0.13
MD5: F7E85586045AA76C573E010E6FF5F701
SHA256: 33B43A5AB059556C17083E824D407891CD14544B5CA416223020076C5878D310
Saturday 16 April 2022
Update: cut-bytes.py Version 0.0.14
This new version of cut-bytes.py adds access to the read data for Python expressions in prefix and suffix options.
cut-bytes_V0_0_14.zip (http)MD5: EC3434DAAEE06C6F35BD57B77F86833F
SHA256: BCCCE7A73C921BD2CC195155A3A709FBAD7ADC0A267288A4F7F58695A2F103D1
Saturday 9 April 2022
New Tool: myjson-filter.py
A couple of my tools can produce JSON output, using my own format (myjson).
This output can then be piped into another tool, like strings.py or file-magic.py.
I’m now releasing a tool that can be put into a command pipe to filter the JSON data: myjson-filter.py
For example, here I use myjson-filter.py to remove all items that are XML files (based on the content: starting with <?xml) before strings are extracted with strings.py:
More info in this ISC diary entry I wrote: “Method For String Extraction Filtering“.
MD5: 15DDC15DE65F447CE6DA94F8B34C5066
SHA256: EB330FE49421A13A8743F18064788DC2E8189A9B63FD19D517F0B830D1569321
Wednesday 30 March 2022
Tuesday 29 March 2022
Update: oledump.py Version 0.0.64
This new version of oledump brings option -u. This option is used to look for data past the end of the streams.
oledump_V0_0_64.zip (http)MD5: D2FE33398A2BA85A760518972C0207D3
SHA256: C44F11D31CDCFDE0E7207363A9F35ED07A98A69A4A4228A8CA49292BA8EE9683
Saturday 26 February 2022
Update: 1768.py Version 0.0.12
I included a new Cobalt Strike 4.5 private key in this released, shared with me by a user.
Further, ZIP files with AES encryption are supported. And a few other bug fixes
1768_v0_0_12b.zip (https)MD5: C1675CD1CD5E817BDBC4B10D8850D6DD
SHA256: 0694F52EFA2332E8FCFFA739AD123ABF4A75F20ACB5DE3174376FE5D816DE071
Wednesday 23 February 2022
Update: oledump.py Version 0.0.63
This is a bug fix update for oledump.py.
It fixes a bug that occurred when you calculated the hash of decompressed VBA code:
MD5: 52440972347843FF56B8F754910BFE4A
SHA256: F92660FFA0F484B46A14944A8B7B475C3D34E80D9C197FA1E99C444CA9ED533B
Monday 21 February 2022
Beta: smtp-honeypot.py
This Python script is essentially a wrapper for the smtpd Python module.
I use it to receive emails, and write them to disk.
Sometimes I use this to exfiltrate (malicious) emails.
Tuesday 8 February 2022
Update: jpegdump.py Version 0.0.9
This new version of jpegdump.py adds option -E to display extra info for each segment.
This extra data is a hash of the segment’s data: md5, sha1, sha256.
MD5: 1736DA65F7355308DC698E29DE8F5432
SHA256: 1E5AE79BB060F59D255999DBD74786F8A8A45DDB2C5F9C85A6FB2FA04CFD4D6C
Friday 31 December 2021
Update: base64dump.py Version 0.0.20
This new version brings a new encoding: zxcn
zxcn stands for “zero x comma no-leading zero”, and is very similar to zxc encoding (zero x comma).
Example of zxc: 0x90,0x0A,0x4D,0x5A
Remark the leading zero for value 0x0A (values smaller than 0x10).
With zxcn encoding, there is no leading zero for values smaller than 0x10.
Thus the example for zxcn becomes: 0x90,0xA,0x4D,0x5A
base64dump_V0_0_20.zip (https)MD5: 10E130F7B989EDDBF03092B8AA0585E1
SHA256: BD7ADF465CA89B10D0591A6D73E6E97DA3EF313EA7C28C90DD59F0A5CBBEB9CD
