+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [Python] Need a Phython "Expert" (/showthread.php?tid=5291026)
Need a Phython "Expert" - Tinkabell - Jun 2, 2016
Hello, i have a .doc exploit from a friend coded in Phython and i dont understand enithing, please help
Thanks Jonas🤝
* - SIM-1866423 - Jun 2, 2016
Let me guess its CVE2012 RTF or CVE2010.And your vague question actually "how can i refud this script", right?
ps : you dont need any "Phython Expert" coz its just create a file.
* - ItsUzi - Jun 2, 2016
Step 1: Spell Python correctly
* - Goodies - Jun 3, 2016
Do you know what python does in this scenario?
I'll give you an example. I recently wrote a crack for cobalt strike. I just had to replace a few functions in a compiled .class file. When I was done, I took the class file, compressed it with bzip, and encoded it with base64 so I can store it in my bash script... this is the result
PHP Code
<?php
read -d '\n' PATCHFILE << ENDOFFILE
QlpoOTFBWSZTWfLg51oABP///P///+Rr///9///////////0AAQQAw452QAwAAVQBRvTK6drbtnN
3Doolw0JNNE1T2kxEHhR6m1DQeo9T1PUaep6NEep4p6jyjagAAGgAB6jTRmU/Sj1MgZBJEmIETU2
NSn6FNmJpR4U2keoGTRoaA0AAGgADQANAAAD1ANMkig8lP1MpkZGj0nqNBp6jJpoNGQ0ANAABkwg
xABo0A9TT0jTTE0QYBMRgmTCDCYmBMAQwjAQwJgTCYIwAAE0MJiaYECSSFT9NJinqeNMlP1T1NPR
qGgD1D1AaBoBkABkDQeoAAAAAHpAIqr/lRTCKOBYG+qu2zrkae1U68drq5FyLI1oOjvlXmRmDOYF
NM9JVifeuGKxdiFOL9mq+ZjBADrb0z99hmAvt/ImcEUihoKKMwCD2G0Ahomi+IeLQoWm4pSgTSME
xSZBKinECyr0BuiBGk0+eN64p2kH45Ycvr698yS9ntMeViKE1zNqZmaZorVYwzM2Hy7HJjnpNkVI
6cTIq0K777bgsC7KsrFWfJlupaOtO1l4yqEUDOMc+atpIauZPQliK2SnO+6oBReREziSpGFn7kh8
CPiDTP1MRqHNdZ+f+3FKYWJLCocyq/MvUm8K/YDz9NTzz3jQ75o9DhYH4TbbWp9mmQLUbZ4EUhuN
aLnDg88n+Nt1rJX7K9T2ToWSmlzBkSZB1bAjpfk5z2BmAFX30n4/ajSe5GhEBEPHO6YlStLsad+D
BMdIaHzS8YiUUsVVWvpo2/q4V7VQgujev34IMH3yJoethEUiQGoxwDHwH4nO5NSplZbuX9vvjfi/
dIRJdkruSxGI26DBuWQPFGkbfVDTCqCbtwuxMxDkTxjqqqyhzGSJXEeOcywYp4dcsK5LuionQE8Y
mgczBLC4iIhxOMAvFYgGI8lhFxkiWxrXBWy9epuK2H0sFDdlXRK6gaNB5Jdu7GbAkgyLZyFMRoEZ
NSHHdyI2c7x1NiYaINtL1/uhnjS4xspkLNvskuj1kBKMmonEqRAECSGkmN5QEJZziNOGjJix/MnB
YXprKQClQxCWRmQPhrUM5pLB7eYtjMn2hjGQldI8Ld1fbPxDQqrn20IMzECGOyejDDd7nUooV433
0XXWyUTy6B2pl9jwFLmsCkUbOaXpDWGefLtjfuRHgb/GIy4uLqaZHwsK8mOjUDAHGWRBTwsseH0G
/YykiQnhByayS5dzaaEy2hV4wRiAHFK8IKkCtRwlfCSMU3eUbYJ3Crzic63K2dEM4C1LxQ9ZfuFZ
MqPKx3w7cOJTxIzQiqClIDBzwHI4OaRicX6ULYi1o1z7Ey0R3oBRgUgiEyIewHBBEFAWKJDO2m51
99899oX1gKzaJq09TTcJrA5dWIrtoxm9VSMPI93EVal/BvWqxqMIWmXnaRq2HZDHHoMmm0JuKJiG
pZwS0U9jmy0LYmYFVcFSxLksQGHWKUczTLhHQba2AYGdsjpGvpLzdfS0yjAZbKjgZI3b25BVmIZb
RHNiTDDYlQyNFEYJLRp4zMwGYw50JBZVtIlHmQ5lcSTqOy7rrjbwpNVilVN06TMjb6a2BYunJDhv
g2CU4EhkUzYpE8GTpJkh2LycoSGg4yYccnqh/Yr6MMIWZqw1DjFA9IpFZgTNr2QKImtTmKlua3nG
SMMGG8Wq1aSUxyraI4PyaSwojY554KCdZKI4YHDplvEEVsMaxmCJkkqpblogOMrKHU7KlQti0yXR
5+CKIMpKMKyZHW2pVjDE7CAoDHlci+VF2GVirRDx93Yo4bg3acd69hfRVfuFlhRkmRJ08hiqblJB
mWdy1zEgM+WIwps7DfJjAgW4ljV19KShSGYGBkKqFdUyMkkDTZwgvrU8MxzNk5KMKhG+UJ4kOLDD
0JMNMx4qYmqThUmHv1ixwBdLidZ+z2xm5PNm+WMJNDnPwcSNcG5mVhxIufr7zWxaeNr/8XckU4UJ
Dy4OdaA=
ENDOFFILE
Now, it is true that this is actually bash scripting... however, if you decode/decompress that with something like this, you can open it up in a java decompiler and find out that it's actually a class file:
PHP Code
<?php
echo $PATCHFILE | sed 's/\s//g' | base64 --decode | bunzip2 > testfile.class
To reiterate, it's a FUCKING JAVA CLASS FILE encoded in base64, stored in a bash script. The only thing bash is doing in delivering the data.
If the crack stopped working, you wouldn't ask for a fucking 'byash' scripting expert.
You wouldn't ask for a base64 expert.
You would ask a fucking java programmer because that's what the payload is written in...
Python is nothing but the syringe. It's the delivery method. It's NOT the god damn exploit...
Fucking christ. How many more of these threads are there going to be?