emanuelduss

OLLVM-16 Compilation Tutorial

Obfuscator-LLVM is a modified version of the LLVM compilers/toolchain to obfuscate source code. This can e.g. be used to bypass EDRs.

Someone might find this useful, since there was no step-by-step instructions on how to correctly compile OLLVM-16.

Prerequisites

Required software:

emanuelduss

Keybase proof

I hereby claim:

• I am emanuelduss on github.
• I am emanuelduss (https://keybase.io/emanuelduss) on keybase.
• I have a public key whose fingerprint is 7994 C89B 04BD 13C0 318E 75E1 08D1 B760 6E3F ADB6

To claim this, I am signing this object:

emanuelduss

#!/usr/bin/env python3

from scapy.all import *

inputfile = 'input.pcapng'
outputfile = 'output.raw'
serveraddr = '10.5.23.42'
sourceport = 2323

file = open(outputfile, "wb")

emanuelduss

$original = "c:\tmp\certificate.pem"
$cloned = "c:\tmp\cloned.p12"
$password = "Password-1234"

$cert_original = Get-PfxCertificate -FilePath  $original
$export_password = ConvertTo-SecureString -String $password -Force -AsPlainText
$cert_cloned = New-SelfSignedCertificate -CloneCert $cert_original -CertStoreLocation "Cert:\CurrentUser\My\"
$cert_cloned | Export-PfxCertificate -FilePath $cloned -Password $export_password
Remove-Item $cert_cloned.PSPath

emanuelduss

curl -w "DNS: %{time_namelookup}\nTCP: %{time_connect}\nTLS: %{time_appconnect}\nTotal: %{time_total}\n" -o /dev/null -s https://example.net/test

emanuelduss

cdf(){
  local path="$(pwd | rev | cut -d/ -f2- | rev | grep -o -E ".*$1[^/]*")"
  echo cd -- "$path"
  cd -- "$path"
}

emanuelduss

<macro name="Card10Fun" icon="MAGIC">
   <assert-service description="Ensure 42230200-2342-2342-2342-234223422342 service" uuid="42230200-2342-2342-2342-234223422342">
      <assert-characteristic description="Ensure Vibra" uuid="4223020f-2342-2342-2342-234223422342">
         <property name="WRITE_WITHOUT_RESPONSE" requirement="MANDATORY"/>
      </assert-characteristic>
      <assert-characteristic description="Ensure 42230210-2342-2342-2342-234223422342 characteristic" uuid="42230210-2342-2342-2342-234223422342">
         <property name="WRITE_WITHOUT_RESPONSE" requirement="MANDATORY"/>
      </assert-characteristic>
      <assert-characteristic description="Ensure 42230211-2342-2342-2342-234223422342 characteristic" uuid="42230211-2342-2342-2342-234223422342">
         <property name="WRITE_WITHOUT_RESPONSE" requirement="MANDATORY"/>

emanuelduss

# Metasploit DHCP Server
# Start: msfconsole -q -n -r dhcpserver.rc

use auxiliary/server/dhcp
set SRVHOST 10.5.23.1
set DHCPIPSTART 10.5.23.100
set DHCPIPEND 10.5.23.200
set NETMASK 255.255.255.0
set ROUTER 10.5.23.1
set DNSSERVER 8.8.8.8

emanuelduss

Description='GPN18 secure WPA2 802.1X config'
Interface=wlp4s0
Connection=wireless
Security=wpa-configsection
IP=dhcp
ESSID=GPN18
WPAConfigSection=(
    'ssid="GPN18"'
    'proto=RSN WPA'
    'key_mgmt=WPA-EAP'

emanuelduss

for i in IMG-????????-WA????.jpg
do
  YEAR=`ls $i | cut -c 5-8`
  MONTH=`ls $i | cut -c 9-10`
  DAY=`ls $i | cut -c 11-12`
  jhead -mkexif $i
  jhead -ds$YEAR:$MONTH:$DAY $i
done