| XZ Backdoor symbol deobfuscation. Updated as i make progress |
| 0810 b' from ' | |
| 0678 b' ssh2' | |
| 00d8 b'%.48s:%.48s():%d (pid=%ld)\x00' | |
| 0708 b'%s' | |
| 0108 b'/usr/sbin/sshd\x00' | |
| 0870 b'Accepted password for ' | |
| 01a0 b'Accepted publickey for ' | |
| 0c40 b'BN_bin2bn\x00' | |
| 06d0 b'BN_bn2bin\x00' | |
| 0958 b'BN_dup\x00' |
This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.
On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that
| ''' | |
| IDA plugin to display the calls and strings referenced by a function as hints. | |
| Installation: put this file in your %IDADIR%/plugins/ directory. | |
| Author: Willi Ballenthin <william.ballenthin@fireeye.com> | |
| Licence: Apache 2.0 | |
| ''' | |
| import idc | |
| import idaapi | |
| import idautils |
| nts-info.website | |
| nts-mailer.website | |
| nts-news.website | |
| nts-post.website | |
| nts-poster.website | |
| nts-viewer.store | |
| ntshome.website | |
| ntsinfo.website | |
| ntsmail.website | |
| ntsmailer.store |
| function Install-DbgHelp { | |
| param ( | |
| [Parameter(Mandatory=$true, Position=0)] | |
| [string] $DbgHelpBaseDir, | |
| [Parameter()] | |
| [string[]] $DbgHelpFiles = @('dbghelp.dll','symsrv.dll','srcsrv.dll'), | |
| [Parameter()] | |
| [switch] $Cleanup |
| # -*- coding: utf-8 -*- | |
| from burp import IBurpExtender | |
| from burp import IHttpListener | |
| import json | |
| # ZDI-CAN-22101 / ZDI-23-1581 - Exchange SSRF PoC exploit with response retrieval for Burp Suite | |
| # by buherator, original research by Piotr Bazydło (@chudypb) | |
| # |
| # Recovering strings objects from .NET Heap | |
| # Using clrMD "Microsoft.Diagnostics.Runtime.dll" - https://github.com/microsoft/clrmd | |
| # Use 32-bit PowerShell to investigate 32-bit process and 64-bit PowerShell to investigate 64-bit process | |
| [System.Reflection.Assembly]::LoadFile([System.IO.Path]::GetFullPath("Microsoft.Diagnostics.Runtime.dll")) | Out-Null | |
| $processID = (Get-Process -Name "TestStrings_confused").Id | |
| $dataTarget = [Microsoft.Diagnostics.Runtime.DataTarget]::AttachToProcess($processID, $false) | |
| $clrInfo = $dataTarget.ClrVersions[0] | |
| $clrRuntime = $clrInfo.CreateRuntime() | |
| $objects = $clrRuntime.Heap.EnumerateObjects().Where{$_.Type.IsString} |
| Twitter Accounts | |
| https://twitter.com/ReVolution44Tm | |
| https://twitter.com/barbbyofficial | |
| https://twitter.com/Team_insane_pk1 | |
| https://twitter.com/anonymusweare | |
| https://twitter.com/PalCyberNews | |
| https://twitter.com/AnonAnonymous | |
| Telegram Channels | |
| https://t.me/s/CyberAv3ngers |
