MarkBaggett

import pefile
import sys
import ctypes
import glob
import argparse
import itertools

def search_tables(thefile, pename, search = []):
    if hasattr(thefile, "DIRECTORY_ENTRY_IMPORT"):
        if args.verbose or args.dump:

MarkBaggett

Slides and code examples from my "Pythons Sinister Secrets" presentation.

The slide deck can be downloaded here.

https://github.com/MarkBaggett/MarkBaggett/blob/master/Python's%20Sinister%20Secrets%20SlideDeck.pdf

MarkBaggett

Decorators Demystified

This is the material for SANS Webcast where we deep dive into the internals of how Python Decorators work. To understand this material you will want to watch the associated presentation.

The registration link is here: https://www.sans.org/webcasts/python-decorators-demystified-108900

(update) The talk has been archived here : https://www.youtube.com/watch?v=M4FrdJKGwX4&t=1981s

A quick review of concepts from 573:

1) Variables can hold functions:

MarkBaggett

As requested here is a walk through for the "Escape room" challenge I threw together for a party at my house. This was developeed in about 5 hours.  It took guests about 45 minutes to complete. I have several things I would like to do to improve it over the next could iterations.

Notes to the reader:
 - Requires Home Assistant   https://www.home-assistant.io
 - Requires App Daemon  https://www.home-assistant.io/docs/ecosystem/appdaemon/
 - My home includes Philips Hue lights, Ecobee thermostat, arlo cameras, some smart TV's and other devices used in the challenges. 
 - It is not shown in the code below but I also have printed puzzles and ammo boxes with combination locks throughout the house.  Generally a printed puzzle leads players to physical activity that triggers a "smart home puzzle" which leads them to a combination to unlock the next ammo box containing the next printed puzzle.  Lather, rince, repeat. 
 - Not all puzzles are published here but this is enough to get your creative juices flowing.
 - Th

MarkBaggett

#!/usr/bin/env python3
import argparse
import math
import random
import hashlib
import codecs

"""
Given the following MD5 Rainbow table that was generate using this program, determine
the password for this hash  bcccb2598de87da2952522eae448b356.  You must use this program 

MarkBaggett

#!/usr/bin/env python
#Quick and Dirty Python Interface to Powershell from Python
#Requires pexpect module.  Try "pip install pexpect"
import pexpect
from pexpect.popen_spawn import PopenSpawn
import re
import time

class pxpowershell(object):
    def __init__(self, *args, **kwargs):

MarkBaggett

#!/usr/bin/env python

from lib.core.data import kb
from lib.core.enums import PRIORITY
import string

__priority__ = PRIORITY.NORMAL

def dependencies():
    pass

MarkBaggett

#From here https://pen-testing.sans.org/blog/2017/10/13/scapy-full-duplex-stream-reassembly

def full_duplex(p):
    sess = "Other"
    if 'Ether' in p:
        if 'IP' in p:
            if 'TCP' in p:
                sess = str(sorted(["TCP", p[IP].src, p[TCP].sport, p[IP].dst, p[TCP].dport],key=str))
            elif 'UDP' in p:
                sess = str(sorted(["UDP", p[IP].src, p[UDP].sport, p[IP].dst, p[UDP].dport] ,key=str))