nguyenl95

#!/usr/bin/env bash
# Production settings for Elasticsearch in Ubuntu 16.04

set -eux

CURRENT_USER=$(whoami)
CURRENT_DIR=$(dirname $0)

cd ${CURRENT_DIR}

nguyenl95

# use x.sh <share-name> <mounted-folder>

sudo vmhgfs-fuse .host:/${1} ${2} -o allow_other -o uid=1000

nguyenl95

<Sysmon schemaversion="4.1">
   <!-- Capture all hashes -->
   <HashAlgorithms>*</HashAlgorithms>
   <EventFiltering>
      <!-- Event ID 1 == Process Creation. Log all newly created processes except -->
      <ProcessCreate onmatch="exclude">
	      <Image condition="contains">splunk</Image>
	      <Image condition="contains">btool.exe</Image>
	      <Image condition="contains">SnareCore</Image>
	      <Image condition="contains">nxlog</Image>

nguyenl95

#!/usr/bin/env python

from base64 import b64decode
from urllib import unquote

base64_strs = ['xU5LNJhXeo9B6o4Ri%2FxFHodARXWqgtNufNrYzqG05nGOLNboDgJtkw%3D%3D',
         '%2BjAd73J7RAZgLxAUkIG5l0cMPLQEBAtZRMP3WdXr1%2BMYdrg2cZKaow%3D%3D']

for bstr in base64_strs:
    unquoted_bstr = unquote(bstr)

nguyenl95

## uploaded by @JohnLaTwC
https://www.virustotal.com/en/file/0c30d700b131246e302ff3da1c4180d21f4650db072e287d1b9d477fe88d312f/analysis/
https://docs.microsoft.com/en-us/windows/desktop/api/wininet/nf-wininet-internetconnecta
void InternetConnectA(
  HINTERNET     hInternet,
  LPCSTR        lpszServerName,
  INTERNET_PORT nServerPort,
  LPCSTR        lpszUserName,
  LPCSTR        lpszPassword,
  DWORD         dwService,

nguyenl95

import idautils 
import idaapi

def memdump(ea, size, file):
    data = idc.GetManyBytes(ea, size)
    with open(file, "wb") as fp:
        fp.write(data)
        print "Memdump Success!"

nguyenl95

import idautils 
import idaapi

def memdump(ea, size, file):
    data = idc.GetManyBytes(ea, size)
    with open(file, "wb") as fp:
        fp.write(data)
        print "Memdump Success!"

nguyenl95

Powershell Remoting to a Non-Domain Host

1. From an admin shell, enable PS remoting on the machine you wish to access:

New-ItemProperty -Name LocalAccountTokenFilterPolicy `
  -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System `
  -PropertyType DWord -Value 1

Enable-PsRemoting -Force

nguyenl95

Get-ChildItem -Path c:\ -Recurse | Sort-Object Length -Descending | Select-Object length,name,directory -First 100 | Format-Table -AutoSize

nguyenl95

The file install-vmware-tools is from REMnux v6 scripts: https://launchpad.net/~remnux/+archive/ubuntu/stable/+files/remnux-scripts_0.1.50.tar.gz

install-vmware-tools_TrietPTM is my patch for the "install-vmware-tools" script that’s present on REMnux v6 to fix a compatibility issue between VMware Tools and the Linux kernel included in Ubuntu, which prevents shared folders from working.

Other Ways You Can Help With REMnux: https://zeltser.com/remnux-v6-release-for-malware-analysis/