Deobfuscating Python Bytecode

Introduction During an investigation, the FLARE team came across an interesting Python malware sample MD5: 61a9f80612d3f7566db5bdf37bbf22cf that is packaged using py2exe. Py2exe is a popular way to compile and package Python scripts into executables. When we encounter this type of malware we...

Linux/x86-64 - Bind Shell Shellcode (Generator)

!/bin/python import socket import sys """ Linux x64 - Bind Shell shellcode Generator --------------------------------------------------------------------------------- Disassemby of bindshell - port 5600 Disassembly of section .text:0000000000400080 : 400080: 48 31 c0 xor %rax,%rax 400083: 48 31 f...

Linux x64 - Bind Shell Shellcode Generator

Linux x64 - Bind Shell Shellcode Generator. Shellcode exploit for linx86-64 platform !/bin/python import socket import sys """ Linux x64 - Bind Shell shellcode Generator --------------------------------------------------------------------------------- Disassemby of bindshell - port 5600 Disassemb...

Extensible Debugger UI For Hackers: Voltron

Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers LLDB, GDB, VDB and WinDbg by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs, you ca...

Linux/x86-64 - Read /etc/passwd Shellcode (65 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x8664 - Read /etc/passwd - 65 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Linux/x86_x64 - execve/bin/sh - 25 bytes

Linux/x86x64 - execve/bin/sh - 25 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 25 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...

Linux/x86_x64 - execve/bin/sh - 26 bytes

Linux/x86x64 - execve/bin/sh - 26 bytes. Shellcode exploit for linx86-64 platform / --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...

Linux/x86-64 - execve(/bin/sh) Shellcode (26 bytes)

/ --------------------------------------------------------------------------------------------------- Linux/x86x64 - execve/bin/sh - 26 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

Firmware Analysis Tool: Binwalk

Binwalk is a fast, easy to use tool for analyzing and extracting firmware images Firmware Analysis Tool Binwalk is: Fast Flexible Extendable Easy to use Binwalk can: Find and extract interesting files / data from binary images Find and extract raw compression streams Identify opcodes for a variet...

Linux/x86 - execve/bin/bash - 31 bytes

Linux/x86 - execve/bin/bash - 31 bytes. Shellcode exploit for linx86 platform / --------------------------------------------------------------------------------------------------- Linux/x86 - execve/bin/bash - 31 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa...

linux/x86 - execve(/bin/bash) - 31 bytes

/ --------------------------------------------------------------------------------------------------- Linux/x86 - execve/bin/bash - 31 bytes Ajith Kp @ajithkp560 http://www.terminalcoders.blogspot.com Om Asato Maa Sad-Gamaya | Tamaso Maa Jyotir-Gamaya | Mrtyor-Maa Amrtam Gamaya | Om Shaantih...

linux/x86 - chmod() 777 /etc/shadow & exit() - 33 bytes

Linux/x86 - chmod 777 /etc/shadow & exit - 33 bytes Greetz : BombermanLeader Author : B3mB4m Concat : email protected Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 50 push %eax 8048063: 68 61 64 6f 77 push $0x776f6461 8048068: 68 63 2f 73 68 push $0x68732f63...

linux/x86 - mkdir HACK & chmod 777 and exit(0) - 29 Bytes

Greetz : BombermanLeader Author : B3mB4m Auxiliary tools 50% time gain ! https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/convertstack.py https://github.com/b3mb4m/Shellcode/blob/master/Auxiliary/ASMtoShellcode.py Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax...

Linux/x86 - Netcat BindShell Port 5555 - 60 bytes

Linux/x86 - Netcat BindShell Port 5555 - 60 bytes. Shellcode exploit for linx86 platform Greetz : BombermanLeader Author : B3mB4m Concat : Do not disturb - Bomberman Netcat openbsd version which is default installed in ubuntu have not "-e" option. So if you are trying to test on ubuntulike me you...

linux/x86 - Netcat BindShell Port 5555 - 60 bytes

Greetz : BombermanLeader Author : B3mB4m Concat : Do not disturb - Bomberman Netcat openbsd version which is default installed in ubuntu have not "-e" option. So if you are trying to test on ubuntulike me you must change version to traditional. Typing this: 1 sudo update-alternatives --config nc ...

Linux/x86 - execve /bin/sh shellcode 21 bytes

Linux/x86 - execve /bin/sh shellcode 21 bytes. Shellcode exploit for linx86 platform Linux/x86 execve /bin/sh shellcode 21 bytes Greetz : KnocKout,curtis,BombermanLeader Author : B3mB4m Disassembly of section .text: 08048060 : 8048060: 31 c0 xor %eax,%eax 8048062: 50 push %eax 8048063: 68 2f 2f 7...

win64/7 Obfuscated Shellcode Download And Execute [Dynamic Lenth]

Title: Obfuscated Shellcode Windows x64 Download And Execute Use PowerShell - Generator length: Dynamic ! depend on url and filename Date: 20 January 2015 Author: Ali Razmjoo tested On: Windows 7 x64 ultimate WinExec = 0x769e2c91 ExitProcess = 0x769679f8 ==================================== Execu...

Lightweight Disassembly Framework: Capstone

Lightweight Disassembly Framework Capstone is a multi-platform, multi-architecture lightweight disassembly framework. Capstone Disassembly Engine v3.0 Released Our target is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community. Features...

Big Batch of Bugs Fixed in Various Versions of IDA

The makers of the popular IDA disassembly and debugging tool have fixed more than a dozen security vulnerabilities in a variety of versions. Some of the vulnerabilities are a couple of years old, and patches are provided for versions from 6.1 up through 6.6. IDA is a tool used by malware analysts...

FLARE IDA Pro Script Series: Automatic Recovery of Constructed Strings in Malware

The FireEye Labs Advanced Reverse Engineering FLARE Team is dedicated to sharing knowledge and tools with the community. We started with the release of the FLARE On Challenge in early July where thousands of reverse engineers and security enthusiasts participated. Stay tuned for a write-up of the...