This new version of pecheck.py adds support for option -g to select a section:
pecheck-v0_7_1.zip (https)
MD5: D5907442424C527A9937CFA65377C9BD
SHA256: BF2F162D108F17F350111645B8DFFE5D3641065CB6EE3CE318FCBEC83507917B
Sunday 5 November 2017
Update: pecheck.py Version 0.7.1
Saturday 4 November 2017
Update: cut-bytes.py Version 0.0.6
This new version of cut-bytes.py brings a small cosmetic change to the way a hex/ASCII dump is displayed:
An extra space is added between the 8th and 9th byte of the hexdump. This was suggested to me by an attendee of the last private training I gave.
cut-bytes_V0_0_6.zip (https)
MD5: 7F726219F6F601018B4BD39E9A407728
SHA256: BFD80EF00455CD938A05A18EAA33551ABEC6B0298A0AEE81052E6F5A12BB86F7
Friday 3 November 2017
Update: byte-stats.py Version 0.0.7
My tool byte-stats.py calculates statistics for the files it analyzes. With option -l (and -p) , it produces a list of values for different parts of the file (buckets), for example a list of entropy values. With this, one can have an idea how the entropy changes inside a file.
But as the saying goes, a picture is worth a thousand words, so I added option -g to produce a very simple graph of these values (just a line, no axis or scale). This does not require any extra Python module, I use Python’s TkInter module, the standard GUI for Python.
byte-stats_V0_0_7.zip (https)
MD5: 9991B5C5BEB3CB7989FE6DC30789EB49
SHA256: 82198195EA9C92832027CC8E2E3ABE161787551A06750E042096CF2DF0AC9384
Monday 30 October 2017
Update: pdfid.py Version 0.2.2
I regularly get ideas to improve my tools when I give (private) training, and last week was not different.
This new version of pdfid.py adds a /URI counter, to help identify PDF documents with embedded URLs, used for phishing or social-engineering users into clicking on links.
I did not hardcode this new counter into the source code of pdfid.py, but it is listed in a new config file: pdfid.ini. You too can add your own identifiers to this configuration file.
pdfid_v0_2_2.zip (https)
MD5: 20614B44D97D48813D867AA8F1C87D4E
SHA256: FBF668779A946C70E6C303417AFA91B1F8A672C0293F855EF85B0E347D3F3259
Sunday 29 October 2017
Update: pdf-parser.py Version 0.6.8
This is a bugfix version.
pdf-parser_V0_6_8.zip (https)
MD5: 7702EEA1C6173CB2E91AB88C5013FAF1
SHA256: 3424E6939E79CB597D32F405E2D75B2E42EF7629750D5DFB39927D5C132446EF
Saturday 21 October 2017
Update: base64dump.py Version 0.0.8
This new version of base64dump adds support to decode strings like UNICODE strings (-t).
base64dump_V0_0_8.zip (https)
MD5: 1B379A08FBC6E7686A89AF099699B076
SHA256: A81AE1AACCB168787CAF6355D582BB5096760893F5CB60E93E408A0475B4FDAC
Monday 16 October 2017
Update: oledump.py Version 0.0.29
This new version of oledump adds support to decode strings like UNICODE strings (-t), and can dump strings (-S).
oledump_V0_0_29.zip (https)
MD5: 7F98DB95E0E9FF645B8411F421387214
SHA256: E00567490A48A7749DF07F0E7ECD8FD24B3C90DC52E18AFE36253E0B37A543C5
Sunday 17 September 2017
Quickpost: Update: Infinite Control For Bash Bunny
This is an update to my Bash Bunny payload Infinite Control: it sends a CONTROL keypress every 10 seconds. I changed the LED colors, and if you uncomment line 27 the BREAK key will be used (function key 15, as some people suggested).
You can find it on HAK5’s GitHub Bash Bunny repository too.
#!/bin/bash # Title: Infinite Control # Author: Didier Stevens (https://DidierStevens.com) # Version: 0.0.2 2017/09/02 # History: 0.0.1 2017/04/08 start # 0.0.2 2017/09/02 changed LED colors, added BREAK # # Hit the CONTROL key every 10 seconds in an infinite loop, # while blinking the CYAN LED with every keypress. # # Can be used to prevent a machine from sleeping or auto-locking. # # Some users have suggested to hit F15 (BREAK) in stead of CTRL. # This can be done by uncommenting line #INFINITE_KEY=BREAK. # # WARNING: Do not type on the machine's keyboard while this script # is running, or your keystrokes might become commands, # for example CTRL-Q: Quit # # Cyan ..............Hitting CONTROL key # Yellow Blinking ...Sleeping # Red Blinking.......Wow! We broke out of the infinite while loop! ATTACKMODE HID INFINITE_KEY=CTRL #INFINITE_KEY=BREAK # infinite while loop while true do LED SPECIAL QUACK $INFINITE_KEY sleep 1 LED ATTACK sleep 9 done # this code will never be reached LED FAIL
Wednesday 6 September 2017
Update: re-search.py Version 0.0.9
A new option in this version: -x (–hex) to produce hexadecimal output.
re-search_V0_0_9.zip (https)
MD5: E9BC3AFF3FA3D6ED0F14EC4941955C2D
SHA256: 4AA92E513A478D02DD12110D3759FFCB2996A3E8A5D2D812124922C5023C3B50
Saturday 12 August 2017
Update: byte-stats.py Version 0.0.6
This new version of byte-stats.py adds option -r (–ranges). This option will print out extra information on the range of byte values (contiguous byte value sequences) found in the analyzed files.
Example for BASE64 data:
Number of ranges: 5 Fir. Last Len. Range 0x2b 1: + 0x2f 0x39 11: /0123456789 0x3d 1: = 0x41 0x5a 26: ABCDEFGHIJKLMNOPQRSTUVWXYZ 0x61 0x7a 26: abcdefghijklmnopqrstuvwxyz
In this example, 5 ranges are reported: they can be thought of as a kind of fingerprint for BASE64 data.
Each range is characterized by 4 properties:
Fir. (First) is the first byte value in the range.
Last is the last byte value in the range (this value is not displayed for ranges of a single byte).
Len. (length) is the number of unique byte values in the range.
Range is the printout of the byte values in the range (. is printed if the byte value is not printable).
byte-stats_V0_0_6.zip (https)
MD5: CA729FF05E314A9CF5C348CB4A720F13
SHA256: 11E41F51EC9911741D71C8BC3278FA22AADBD865F2BF7BE4E73E82A7736A8FA8
Didier Stevens 