Alexander Gantimurov av-gantimurov

GMK87 manual

#Notes this is a fork from GMK87 adapted to gmk87, if you notice something wrong or add any other feature, just ping me here on github.

English manual for the ZUOYA GMK87 Mechanical Keyboard. Made from the printed version (Original).

GMK87 manual
Description

MS-MSDT 0-day Office RCE

MS Office docx files may contain external OLE Object references as HTML files. There is an HTML sceme "ms-msdt:" which invokes the msdt diagnostic tool, what is capable of executing arbitrary code (specified in parameters).

The result is a terrifying attack vector for getting RCE through opening malicious docx files (without using macros).

Here are the steps to build a Proof-of-Concept docx:

Open Word (used up-to-date 2019 Pro, 16.0.10386.20017), create a dummy document, insert an (OLE) object (as a Bitmap Image), save it in docx.

Google Docs

Raw Threat Intelligence by ClearskySec

GitHub

Twitter

IDA Microcode notes

References

Ilfak's presentation at Recon 2018
Microcode in pictures
Hex-Rays Microcode API vs. Obfuscating Compiler
Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

Arch Linux Full-Disk Encryption Installation Guide

This guide provides instructions for an Arch Linux installation featuring full-disk encryption via LVM on LUKS and an encrypted boot partition (GRUB) for UEFI systems.

Following the main installation are further instructions to harden against Evil Maid attacks via UEFI Secure Boot custom key enrollment and self-signed kernel and bootloader.

Preface

You will find most of this information pulled from the Arch Wiki and other resources linked thereof.

Note: The system was installed on an NVMe SSD, substitute /dev/nvme0nX with /dev/sdX or your device as needed.

	from typing import List

	from capstone import *
	from capstone.x86 import *
	from unicorn import *
	from unicorn.x86_const import *
	from pefile import PE


	class Emulator():

	javascript: Promise.all([import('https://unpkg.com/turndown@6.0.0?module'), import('https://unpkg.com/@tehshrike/readability@0.2.0'), ]).then(async ([{
	default: Turndown
	}, {
	default: Readability
	}]) => {

	/* Optional vault name */
	const vault = "";

	/* Optional folder name such as "Clippings/" */

	function Div (elem)
	if FORMAT:match 'docx' then
	if elem.classes[1] == "notes" then
	elem.attributes['custom-style'] = 'Notes'
	return elem
	else
	return elem
	end
	elseif FORMAT:match 'latex' then
	if elem.classes[1] == "notes" then

	import idaapi, idc, idautils


	class DecryptorError(Exception):
	pass


	def rc4crypt(key, data):
	x = 0
	box = range(256)


	#! /usr/bin/env python

	##########################################################################################
	##
	## RC4 Crypto
	##
	##########################################################################################

	def rc4crypt(key, data):