6 | {%- if page.title -%}
7 |
{{ page.title }}
8 | {%- endif -%}
9 |
10 | {{ content | markdownify }}
11 |
12 |
13 | {% if site.paginate %}
14 | {% assign rawposts = paginator.posts %}
15 | {% else %}
16 | {% assign rawposts = site.posts %}
17 | {% endif %}
18 |
19 |
20 | {% assign posts = ''|split:'' %}
21 | {% for post in rawposts %}
22 | {% if post.hide != true %}
23 | {% assign posts = posts|push:post%}
24 | {% endif %}
25 | {% endfor %}
26 |
27 |
28 | {% assign grouped_posts = posts | group_by: "sticky_rank" | sort: "name", "last" %}
29 | {% assign sticky_posts = ''|split:'' %}
30 | {% assign non_sticky_posts = '' | split:'' %}
31 |
32 |
33 | {% for gp in grouped_posts %}
34 | {%- if gp.name == "" -%}
35 | {% assign non_sticky_posts = gp.items | sort: "date" | reverse %}
36 | {%- else %}
37 | {% assign sticky_posts = sticky_posts | concat: gp.items %}
38 | {%- endif -%}
39 | {% endfor %}
40 |
41 |
42 | {% assign sticky_posts = sticky_posts | sort: "sticky_rank", "last" %}
43 | {% assign posts = sticky_posts | concat: non_sticky_posts %}
44 |
45 | {%- if posts.size > 0 -%}
46 | {%- if page.list_title -%}
47 |
{{ page.list_title }}
48 | {%- endif -%}
49 |
50 | {%- assign date_format = site.minima.date_format | default: "%b %-d, %Y" -%}
51 | {%- for post in posts -%}
52 | -
53 | {%- if site.show_image -%}
54 | {%- include post_list_image_card.html -%}
55 | {% else %}
56 | {%- include post_list.html -%}
57 | {%- endif -%}
58 |
59 | {%- endfor -%}
60 |
61 |
62 | {% if site.paginate and site.posts.size > site.paginate %}
63 |
78 | {%- endif %}
79 |
80 | {%- endif -%}
81 |
82 |
79 | {{ content | toc }}
80 |
81 | {%- if page.comments -%}
82 | {%- include utterances.html -%}
83 | {%- endif -%}
84 | {%- if site.disqus.shortname -%}
85 | {%- include disqus_comments.html -%}
86 | {%- endif -%}
87 |
88 |
89 |
--------------------------------------------------------------------------------
/_notebooks/.gitignore:
--------------------------------------------------------------------------------
1 | .ipynb_checkpoints
2 | */.ipynb_checkpoints/*
3 |
4 | # IPython
5 | profile_default/
6 | ipython_config.py
7 |
8 | # MacOS crap
9 | .DS_Store
10 |
11 | # Python trash
12 | *.py[co]
13 |
--------------------------------------------------------------------------------
/_notebooks/.virtual_documents/2024-07-07-zharkbot.ipynb:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/_notebooks/.virtual_documents/2024-08-26-python-hunting.ipynb:
--------------------------------------------------------------------------------
1 |
2 | import base64
3 |
4 | ZWHmjDkfVvkVdclV = 'bWdzdHN0dWRpby5zaG9w'
5 | RYBTeAeZbiUOxeloi = base64.b64decode(ZWHmjDkfVvkVdclV).decode()
6 |
7 | print(f'https://{RYBTeAeZbiUOxeloi}/sunrise')
8 | print(f'https://{RYBTeAeZbiUOxeloi}/luminous')
9 |
10 |
11 |
12 |
--------------------------------------------------------------------------------
/_notebooks/.virtual_documents/2024-09-02-zharkbot-config.ipynb:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/_notebooks/.virtual_documents/Untitled.ipynb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/OALabs/research/d0a6daae41e7d9bc3b29930de2b6ce9baf1aa277/_notebooks/.virtual_documents/Untitled.ipynb
--------------------------------------------------------------------------------
/_notebooks/2021-05-31-warzone_rat_config.ipynb:
--------------------------------------------------------------------------------
1 | {
2 | "cells": [
3 | {
4 | "cell_type": "markdown",
5 | "id": "593e8507-8d38-42f1-9449-60f1a89d4da0",
6 | "metadata": {},
7 | "source": [
8 | "# WarZone RAT \n",
9 | "> WarZone static config extractor\n",
10 | "\n",
11 | "- toc: true \n",
12 | "- badges: true\n",
13 | "- categories: [warzone,malware,config]"
14 | ]
15 | },
16 | {
17 | "cell_type": "markdown",
18 | "id": "7393edcb-38c6-4f02-a72d-98ce109502e5",
19 | "metadata": {},
20 | "source": [
21 | "## Overview\n",
22 | "\n",
23 | "The config is stored in the `.bss` PE section with the following format.\n",
24 | "\n",
25 | "Key length | key | data\n",
26 | "\n"
27 | ]
28 | },
29 | {
30 | "cell_type": "code",
31 | "execution_count": 25,
32 | "id": "be322404-96a4-46ab-b93f-1a3ab3722fa5",
33 | "metadata": {},
34 | "outputs": [],
35 | "source": [
36 | "# First lets setup our imports\n",
37 | "import argparse\n",
38 | "import struct\n",
39 | "import pefile\n",
40 | "import re\n",
41 | "import binascii"
42 | ]
43 | },
44 | {
45 | "cell_type": "markdown",
46 | "id": "8800c159-3130-400b-bc1f-00d7f11fe968",
47 | "metadata": {},
48 | "source": [
49 | "Now a quick reminder ddof binary data hex encoding for Python3"
50 | ]
51 | },
52 | {
53 | "cell_type": "markdown",
54 | "id": "581df870-90dc-4c2b-af87-66ace7987b1e",
55 | "metadata": {},
56 | "source": [
57 | "## RC4 Encryption\n",
58 | "The data is encrypted using RC4. For more information on RC4 check out our RC4 tutorial video.\n",
59 | "\n",
60 | "> youtube: https://youtu.be/CiJocXXMXK4"
61 | ]
62 | },
63 | {
64 | "cell_type": "code",
65 | "execution_count": 26,
66 | "id": "40e72184-8fb2-40e3-a84a-463379a48ade",
67 | "metadata": {
68 | "tags": []
69 | },
70 | "outputs": [],
71 | "source": [
72 | "# Now lets implement a simple RC4 decryption function\n",
73 | "def rc4crypt(data, key):\n",
74 | " #If the input is a string convert to byte arrays\n",
75 | " if type(data) == str:\n",
76 | " data = data.encode('utf-8')\n",
77 | " if type(key) == str:\n",
78 | " key = key.encode('utf-8')\n",
79 | " x = 0\n",
80 | " box = list(range(256))\n",
81 | " for i in range(256):\n",
82 | " x = (x + box[i] + key[i % len(key)]) % 256\n",
83 | " box[i], box[x] = box[x], box[i]\n",
84 | " x = 0\n",
85 | " y = 0\n",
86 | " out = []\n",
87 | " for c in data:\n",
88 | " x = (x + 1) % 256\n",
89 | " y = (y + box[x]) % 256\n",
90 | " box[x], box[y] = box[y], box[x]\n",
91 | " out.append(c ^ box[(box[x] + box[y]) % 256])\n",
92 | " return bytes(out)"
93 | ]
94 | },
95 | {
96 | "cell_type": "markdown",
97 | "id": "63c05d4d-b9f9-4fef-9e77-3ed85f19d043",
98 | "metadata": {},
99 | "source": [
100 | "## Helper functions"
101 | ]
102 | },
103 | {
104 | "cell_type": "code",
105 | "execution_count": 32,
106 | "id": "f0c2018f-45c2-4a57-8857-614bb601b71d",
107 | "metadata": {
108 | "tags": []
109 | },
110 | "outputs": [],
111 | "source": [
112 | "import binascii\n",
113 | "data = binascii.unhexlify(b'')\n",
114 | "key = binascii.unhexlify(b'')\n",
115 | "\n",
116 | "def unicode_strings(buf, n=4):\n",
117 | " import re\n",
118 | " ASCII_BYTE = b' !\\\"#\\$%&\\'\\(\\)\\*\\+,-\\./0123456789:;<=>\\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\\[\\]\\^_`abcdefghijklmnopqrstuvwxyz\\{\\|\\}\\\\\\~\\t'\n",
119 | " if type(buf) == str:\n",
120 | " buf = buf.encode('utf-8')\n",
121 | " reg = b'((?:[%s]\\x00){%d,})' % (ASCII_BYTE, n)\n",
122 | " uni_re = re.compile(reg)\n",
123 | " out = []\n",
124 | " for match in uni_re.finditer(buf):\n",
125 | " try:\n",
126 | " out.append(match.group().decode(\"utf-16\"))\n",
127 | " except UnicodeDecodeError:\n",
128 | " continue\n",
129 | " return out\n",
130 | "\n",
131 | "def tohex(data):\n",
132 | " import binascii\n",
133 | " if type(data) == str:\n",
134 | " return binascii.hexlify(data.encode('utf-8'))\n",
135 | " else:\n",
136 | " return binascii.hexlify(data)"
137 | ]
138 | },
139 | {
140 | "cell_type": "code",
141 | "execution_count": 43,
142 | "id": "5043ce7a-5966-49eb-98a8-f2075c59acb4",
143 | "metadata": {},
144 | "outputs": [
145 | {
146 | "name": "stdout",
147 | "output_type": "stream",
148 | "text": [
149 | "host: 165.22.5.66, port: 1111\n"
150 | ]
151 | }
152 | ],
153 | "source": [
154 | "import pefile\n",
155 | "import struct\n",
156 | "\n",
157 | "warzone_file = b'/tmp/work/warzone.bin'\n",
158 | "data = open(warzone_file, 'rb').read()\n",
159 | "pe = pefile.PE(data=data)\n",
160 | "section_data = None\n",
161 | "for s in pe.sections:\n",
162 | " if s.Name == b'.bss\\x00\\x00\\x00\\x00':\n",
163 | " section_data = s.get_data()\n",
164 | "## size (DWORD) | key | data\n",
165 | "key_size = struct.unpack('
7 | {% if include.caption %}
8 | 
52 |
53 | 
57 |
58 | 
62 |
63 | 
67 |
68 |