Since I’m interested in malicious Python scripts, I found multiple samples that rely on existing libraries. The most-known repository is probably pypi.org[1] that reports, as of today, 567,478 projects! Malware developers are like regular developers: They don’t want to reinvent the wheel and make their shopping across existing libraries to expand their scripts capabilities.

I compiled a list of libraries that are often used by malicious scripts. Warning! These libraries are NOT malicious, they are also used for totally legit purposes. Like many Windows API calls, they are just (ab)used by developers. Here is my top list:

Module	Description
pyWinhook	Python wrapper for out-of-context input hooks in Windows. The pyWinhook package provides callbacks for global mouse and keyboard events in Windows. Python applications register event handlers for user input events such as left mouse down, left mouse up, key down, etc. and set the keyboard and/or mouse hook.
pyperclip	Pyperclip is a cross-platform Python module for copy and paste clipboard functions.
psutil	psutil (process and system utilities) is a cross-platform library for retrieving information on running processes and system utilization (CPU, memory, disks, network, sensors) in Python. It is useful mainly for system monitoring, profiling and limiting process resources and management of running processes.
win32gui	Python extensions for Microsoft Windows’ Provides access to much of the Win32 API, the ability to create and use COM objects, and the Pythonwin environment
win32process	An interface to the win32 Process and Thread API's
pythoncom	This module supports the Microsoft Component Object Model (COM). COM is a technology that allows you to use “objects” from your favorite language, even if the object isn’t implemented in your language. Many applications for Windows (including Microsoft Office) can be controlled using COM, making it particularly suitable for scripting-related tasks.
tkinter	This module provides the standard Python interface to the Tcl/Tk GUI toolkit. It is used to design and display GUI elements in some malicious scripts to simulate a player or a small game.
ctypes	This module is a "foreign function library". It provides C compatible data types, and allows calling functions in DLLs or shared libraries. It can be used to interact with any Windows API calls. Often used for code injection.
winreg	This module integrates with the Windows registry and can read/write keys.
ftplib	Easy implementation of the FTP protocol to exfiltrate data or download next stages.
discord	This module helps to integrate with a Discord servers. Often used as a C2 protocol.
pyautogui	scripts control the mouse and keyboard to automate interactions with other applications.
PIL	The Python Imaging Library adds image processing capabilities to your Python interpreter.
getpass	Portable password input but provides getpass.getuser() to retrieve information about the current user.
faker	Faker is a Python package that generates fake data for you. Whether you need to bootstrap your database, create good-looking XML documents, fill-in your persistence to stress test it, or anonymize data taken from a production service, Faker is for you.
cloudscraper	A simple Python module to bypass Cloudflare's anti-bot page (also known as "I'm Under Attack Mode", or IUAM), implemented with Requests. Cloudflare changes their techniques periodically, so I will update this repo frequently.
fernet	Fernet guarantees that a message encrypted using it cannot be manipulated or read without the key. Fernet is an implementation of symmetric (also known as “secret key”) authenticated cryptography.
qrcode	This modules manages (generates) QR codes.
secrets	The secrets module is used for generating random numbers for managing important data such as passwords, account authentication, security tokens, and related secrets, that are cryptographically strong.
smtplib	Easy implementation of the SMTP protocol to exfiltrate data.
pytesseract	Python-tesseract is an optical character recognition (OCR) tool for python. That is, it will recognize and “read” the text embedded in images.
telebot	Helps to create a Telegram bot
telethon	Talks to Telegram
pyinput	This library allows you to control and monitor input devices. Currently, mouse and keyboard input and monitoring are supported.
win32api	Helps to call Win32 API
wmi	Provides an interface to the Windows Management Instrumentation framework
win32crypt	Provides an interface to the win32 Cryptography API
wave	Provides an interface to the Waveform Audio “WAVE” (or “WAV”) file format.
sounddevice	Provides bindings for the PortAudio library and a few convenience functions to play and record NumPy arrays containing audio signals. Combined with the wave module (see above) it helps to use the microphone and exfiltrate conversations.
pythonnet	Embeds .Net into Python.
dropbox	Used to exfiltrate data via Dropbox.
win32pdh	Used to encapsulate the Windows Performance Data Helpers API[2] and perform a footprint of the targeted computer (ex: user's activity)
py7zr	Used to manipulate 7Z archives and exfiltrate collected data.
pyzipper	Used to manipulate ZIP archives and exfiltrate collected data.
browser_cookie3	This module loads cookies used by your web browser into a cookie jar object. Often used by infostealers.
browser_history	Simple python package used o retrieve (almost) any browser's history on (almost) any platform. Like the previous module, used by infostealers.
marshal	This modules ontains functions that can read and write Python values in a binary format. Used for obfuscation purposes.
py_compile	This module generates a byte-code file from a source file. This is used as obfuscation technique. Once compiled, the initial script is deleted.
firebase_admin	Used to integrate Firebase into scripts. This is often used for easy exfiltration of data.

If not available on the victim's computer, these modules can be easily installed using a few lines of code:

import time
from sys import executable

required_modules = [ "module1", "module2", "moduleN" ]
for m in required_modules:
    try:
        import m
    except:
        subprocess.Popen(f"\"{executable}\" -m pip install {m} --quiet", shell=True)
        time.sleep(3)

If you discover more Python libraries sometimes used for malicious reasons, please share! I'd like to keep this list up-to-date!

[1] https://pypi.org/
[2] https://learn.microsoft.com/en-us/windows/win32/perfctrs/using-the-pdh-functions-to-consume-counter-data

Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

Today, Microsoft released its scheduled September set of patches. This update addresses 79 different vulnerabilities. Seven of these vulnerabilities are rated critical. Four vulnerabilities are already being exploited and have been made public. 

Noteworthy Vulnerabilities:

CVE-2024-43491: This "downgrade" vulnerabilities. An attacker can remove previously applied patches and exploit older vulnerabilities. This issue only affects Windows 10 Version 1507, which is EOL. It appears to differ from the similar vulnerabilities (CVE-2024-38202 and CVE-2024-21302) made public by Alon Leviev during Blackhat this year. These two vulnerabilities appear to remain unpatched.

CVE-2024-38014: A Windows Installer issue could lead to attackers gaining System access.

CVE-2024-38217: Yet another "Mark of the Web" bypass that is already exploited and could be used to trick a victim into installing malware.

CVE-2024-38226: Similar to the above vulnerability, a security feature bypass in Publisher.

Microsoft also patched four remote code execution vulnerabilities in Sharepoint, but the lower CVSS score indicates that exploitation will require access and specific prerequisites.

CVE-2024-38119: A critical vulnerability in the Windows NAT code. The low CVSS score is likely because this is not enabled by default.

 

Description
CVE	Disclosed	Exploited	Exploitability (old versions)	current version	Severity	CVSS Base (AVG)	CVSS Temporal (AVG)
Azure CycleCloud Remote Code Execution Vulnerability
%%cve:2024-43469%%	No	No	-	-	Important	8.8	7.7
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
%%cve:2024-38188%%	No	No	-	-	Important	7.1	6.2
%%cve:2024-43470%%	No	No	-	-	Important	7.3	6.4
Azure Stack Hub Elevation of Privilege Vulnerability
%%cve:2024-38216%%	No	No	-	-	Critical	8.2	7.1
%%cve:2024-38220%%	No	No	-	-	Critical	9.0	7.8
Azure Web Apps Elevation of Privilege Vulnerability
%%cve:2024-38194%%	No	No	-	-	Critical	8.4	7.3
DHCP Server Service Denial of Service Vulnerability
%%cve:2024-38236%%	No	No	-	-	Important	7.5	6.5
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
%%cve:2024-38241%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38242%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38238%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38243%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38244%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38245%%	No	No	-	-	Important	7.8	6.8
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
%%cve:2024-38237%%	No	No	-	-	Important	7.8	6.8
Microsoft AllJoyn API Information Disclosure Vulnerability
%%cve:2024-38257%%	No	No	-	-	Important	7.5	6.5
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
%%cve:2024-43492%%	No	No	-	-	Important	7.8	6.8
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
%%cve:2024-43476%%	No	No	-	-	Important	7.6	6.6
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
%%cve:2024-38225%%	No	No	-	-	Important	8.8	7.7
Microsoft Excel Elevation of Privilege Vulnerability
%%cve:2024-43465%%	No	No	-	-	Important	7.8	6.8
Microsoft Management Console Remote Code Execution Vulnerability
%%cve:2024-38259%%	No	No	-	-	Important	8.8	7.7
Microsoft Office Visio Remote Code Execution Vulnerability
%%cve:2024-43463%%	No	No	-	-	Important	7.8	6.8
Microsoft Outlook for iOS Information Disclosure Vulnerability
%%cve:2024-43482%%	No	No	-	-	Important	6.5	5.7
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
%%cve:2024-43479%%	No	No	-	-	Important	8.5	7.4
Microsoft Publisher Security Feature Bypass Vulnerability
%%cve:2024-38226%%	No	Yes	-	-	Important	7.3	6.4
Microsoft SQL Server Elevation of Privilege Vulnerability
%%cve:2024-37965%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-37341%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-37980%%	No	No	-	-	Important	8.8	7.7
Microsoft SQL Server Information Disclosure Vulnerability
%%cve:2024-43474%%	No	No	-	-	Important	7.6	6.6
Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
%%cve:2024-37966%%	No	No	-	-	Important	7.1	6.2
%%cve:2024-37337%%	No	No	-	-	Important	7.1	6.2
%%cve:2024-37342%%	No	No	-	-	Important	7.1	6.2
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability
%%cve:2024-37338%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-37335%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-37340%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-37339%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-26186%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-26191%%	No	No	-	-	Important	8.8	7.7
Microsoft SharePoint Server Denial of Service Vulnerability
%%cve:2024-43466%%	No	No	-	-	Important	6.5	5.7
Microsoft SharePoint Server Remote Code Execution Vulnerability
%%cve:2024-38018%%	No	No	-	-	Critical	8.8	7.7
%%cve:2024-43464%%	No	No	-	-	Critical	7.2	6.3
%%cve:2024-38227%%	No	No	-	-	Important	7.2	6.3
%%cve:2024-38228%%	No	No	-	-	Important	7.2	6.3
Microsoft Windows Admin Center Information Disclosure Vulnerability
%%cve:2024-43475%%	No	No	-	-	Important	7.3	6.4
Microsoft Windows Update Remote Code Execution Vulnerability
%%cve:2024-43491%%	No	Yes	-	-	Critical	9.8	8.5
PowerShell Elevation of Privilege Vulnerability
%%cve:2024-38046%%	No	No	-	-	Important	7.8	6.8
Win32k Elevation of Privilege Vulnerability
%%cve:2024-38246%%	No	No	-	-	Important	7.0	6.1
Windows Authentication Information Disclosure Vulnerability
%%cve:2024-38254%%	No	No	-	-	Important	5.5	4.8
Windows Graphics Component Elevation of Privilege Vulnerability
%%cve:2024-38249%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38250%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38247%%	No	No	-	-	Important	7.8	6.8
Windows Hyper-V Denial of Service Vulnerability
%%cve:2024-38235%%	No	No	-	-	Important	6.5	5.7
Windows Installer Elevation of Privilege Vulnerability
%%cve:2024-38014%%	No	Yes	-	-	Important	7.8	6.8
Windows Kerberos Elevation of Privilege Vulnerability
%%cve:2024-38239%%	No	No	-	-	Important	7.2	6.3
Windows Kernel-Mode Driver Information Disclosure Vulnerability
%%cve:2024-38256%%	No	No	-	-	Important	5.5	4.8
Windows MSHTML Platform Spoofing Vulnerability
%%cve:2024-43461%%	No	No	-	-	Important	8.8	7.7
Windows Mark of the Web Security Feature Bypass Vulnerability
%%cve:2024-38217%%	Yes	Yes	-	-	Important	5.4	5.0
%%cve:2024-43487%%	No	No	-	-	Moderate	6.5	6.0
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
%%cve:2024-38119%%	No	No	-	-	Critical	7.5	6.5
Windows Networking Denial of Service Vulnerability
%%cve:2024-38232%%	No	No	-	-	Important	7.5	6.5
%%cve:2024-38233%%	No	No	-	-	Important	7.5	6.5
%%cve:2024-38234%%	No	No	-	-	Important	6.5	5.7
Windows Networking Information Disclosure Vulnerability
%%cve:2024-43458%%	No	No	-	-	Important	7.7	6.7
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
%%cve:2024-38240%%	No	No	-	-	Important	8.1	7.1
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
%%cve:2024-38231%%	No	No	-	-	Important	6.5	5.7
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
%%cve:2024-38258%%	No	No	-	-	Important	6.5	5.7
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
%%cve:2024-43467%%	No	No	-	-	Important	7.5	6.5
%%cve:2024-38260%%	No	No	-	-	Important	8.8	7.7
%%cve:2024-38263%%	No	No	-	-	Important	7.5	6.5
%%cve:2024-43454%%	No	No	-	-	Important	7.1	6.2
Windows Remote Desktop Licensing Service Spoofing Vulnerability
%%cve:2024-43455%%	No	No	-	-	Important	8.8	7.7
Windows Security Zone Mapping Security Feature Bypass Vulnerability
%%cve:2024-30073%%	No	No	-	-	Important	7.8	6.8
Windows Setup and Deployment Elevation of Privilege Vulnerability
%%cve:2024-43457%%	No	No	-	-	Important	7.8	6.8
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
%%cve:2024-38230%%	No	No	-	-	Important	6.5	5.7
Windows Storage Elevation of Privilege Vulnerability
%%cve:2024-38248%%	No	No	-	-	Important	7.0	6.3
Windows TCP/IP Remote Code Execution Vulnerability
%%cve:2024-21416%%	No	No	-	-	Important	8.1	7.1
%%cve:2024-38045%%	No	No	-	-	Important	8.1	7.1
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
%%cve:2024-38252%%	No	No	-	-	Important	7.8	6.8
%%cve:2024-38253%%	No	No	-	-	Important	7.8	6.8
Windows libarchive Remote Code Execution Vulnerability
%%cve:2024-43495%%	No	No	-	-	Important	7.3	6.4

Vulnerabilities: 79

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

New IP address functions have been added in Wireshark 4.4 (if you use Wireshark on Windows, there's a bug in release 4.4.0: the DLL with these functions is missing, it will be included in release 4.4.1; all is fine with Linux and Mac versions of Wireshark).

These are the functions:

They are explained in the Wireshark filter manual under "Functions".

Function ip_rfc1918, for example, returns True when the argument of this function is a private use IPv4 address. It can be used as a display filter, like this:

These functions can also be used in custom columns, like function ip_special_name that returns the IP special-purpose block name as a string:

To summarize: these functions were introduced with Wireshark release 4.4, but this will not work only if you are using Windows version 4.4.0. I used release candicate 4.4.1 to take these screenshots, as the missing dll (ipaddress.dll) is present in that package.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

Here are more details on the power consumption of my desktop computer when I crack passwords (cfr diary entry "Quickie: Password Cracking & Energy").

The vertical scale of this chart is expressed in Watts:

1. 0 Watt: my desktop computer is turned off
2. 76 Watt average: my desktop computer is turned on & idling
3. 151 Watt average: hashcat is running in dictionary attack mode cracking SHA256 hashes
4. 445 Watt average: hashcat is running in brute-force attack mode cracking SHA256 hashes

The most power is required (445 Watt) when hashcat is using the GPU ( NVIDIA GeForce RTX 3080) in brute-force attack mode. For comparison, 445 Watt average continuous is enough to heat my office in winter to a nice & comfy temperature, I don't need central heating in that room when hashcat is running for many hours.

You might wonder if 445 Watt is enough for that, given that electrical heaters typically come in 1000+ Watt models. But electrical heaters don't consume electrical power constantly to heat a room, they have a thermostat that shuts of current flow regularly when the desired room temperature is reached. They are more powerfull so that they can heat up a room faster. While my desktop computer requires 445 Watt continuously when cracking with the GPU.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

PythonScript is a Notepad++ plugin that provides a Python interpreter to edit Notepad++ documents.

You install PythonScript in Notepad++ like this:

Use "New Script" to create a new Python script:

As an example, I will create a template substitution script, something that I use often. You provide a substitution template as input, and then each line of the open document is substituted according to the given template.

First we create the script substitute.py:

This is the template substitution script I developed:

def Substitute(contents, lineNumber, totalLines):
    contents = contents.rstrip('\n\r')
    if contents != '':
        editor.replaceLine(lineNumber, template.replace(token, contents))

token = notepad.prompt('Provide a token', 'Substitute token', '%%')
template = notepad.prompt('Provide a template', 'Substitute template', '')
if token != None and template != None:
    editor.forEachLine(Substitute)

You can paste it into Notepad++:

I will now demonstrate the script on a new document I created in Notepad++: the list of today's top 10 scanning IP addresses:

For each IP address, I want to generate a command that I will then execute.

The script can now be invoked to be executed on this open document like this:

The first line of Python script substitute.py to be executed, is line 6 (token = notepad.prompt...). It prompts the user for a token string (default %%), this is a string that, when used in the template string, will be replaced by each line in the open document

Line 7 prompts the user for a template string:

When the user has not cancelled answering the prompts (tested in line 8), line 9 (editor.forEachLine(Substitute)) is executed: it runs function Substitute on each line of the document:

Then I can copy/paste all these generated commands into a cmd.exe console:

This example is a bit contrived, as you could also use a for loop in the scripting shell to achieve the same result.

I also use this Python script often when I'm programming. Say that I want to hardcode this list of scanning IP addresses in a Python script. I can quickly create a Python list as follows:

And then I add the variable assignment statemnt and create a list:

 

Didier Stevens
Senior handler
blog.DidierStevens.com

I like to enrich my honeypot data from a variety of sources to help understand a bit more about the context of the attack. This includes the types of networks the attacks are coming from or whether malware submitted to a honeypot is new. I use a variety of sources to enrich my cowrie data using cowrieprocessor [1]:

• Internet Storm Center / DShield API [2]
• URLhaus [3]
• SPUR [4]
• VirusTotal [5]

I was curious how often the data changed and how "fresh" the data needs to be in order to be accurate. In a previous diary I went into details about VirusTotal data and vendor comparisons [6]. 

Data Collection

Data was pulled from the above sources using my cowrieprocessor script [1]. The script keeps a local copy of most enrichment data, which means I can always go through the JSON files at a later date to extract different information. The data I have goes back as far as May 2022. My honeypots schedule this data enrichment to happen once a day for attacks that happened the previous day. This means a minimum gap of time of 24 hours between enrichment data queries. This process was scheduled to run more frequently in 2022 and 2023 and may have a smaller gap between enrichment queries of 6-12 hours. 

VirusTotal Data

I extracted the following fields for comparison:

• ID (file hash)
• Malicious (number of vendors/engines that label the file as malicious)
• Suspicious  (number of vendors that label the file as suspicious)
• Undetected (number of vendors that did not have any detection)
• Harmless (number of vendors that label the file as harmless)
• Timeout (number of vendors that had a timeout)
• Confirmed-timeout (number of vendors that confirmed the timeout)
• Failure (number of vendors where a failure was reported)
• Type-unsupported (number of vendors that did not support the indicator type)
• Type_tag (type of file)
• Type_description (type description)

More details about the VirusTotal data fields can be found in their documentation [7]. The data was reviewed to look for hashes that showed a wide range of total "malicious" indicators as determined by different products. 

 

Date	Time	Hash	Malicious	Suspicious	Type Description
12/29/2023	120001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
12/29/2023	180002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
12/30/2023	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	1	0	ELF
3/3/2024	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	2	0	ELF
4/21/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	2	0	ELF
7/18/2024	003001	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	22	0	ELF
8/10/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	26	0	ELF
8/13/2024	003002	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	25	0	ELF
8/15/2024	003003	062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a	25	0	ELF

Figure 1: VirusTotal results over time for hash 062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a [8].

 

Date	Time	Hash	Malicious	Suspicious	Type Description
12/21/2023	180002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	1	0	ELF
12/22/2023	003002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	1	0	ELF
4/7/2024	003001	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	2	0	ELF
7/31/2024	003002	47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c	29	0	ELF

Figure 2: VirusTotal results over time for hash 47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c [9].

 

Date	Time	Hash	Malicious	Suspicious	Type Description
5/7/2023	060002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	2	0	ELF
5/7/2023	120001	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/7/2023	180002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/8/2023	003002	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	3	0	ELF
5/10/202	003001	306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6	24	0	ELF

Figure 3: VirusTotal results over time for hash 306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6 [10].

This demonstrates that VirusTotal data can take months to have a large increase in malicious hits. The hash from Figure 3 was first submitted on March 10, 2023, so even though it looks like a very quick change in my sample of data, this was approximatey two months from the initial submission. Even if the data looks stable, it may have a dramatic change.

 

URLhaus Data

URLHaus can be a good location of malicious URLs that may be used in phishing or other attacks, such as those seen in Cowrie honeypots. The data was reviewed to look for IP addresses that had a reported URL count change over time. In figure 4, the URL count increased by approximately 1 URL a day until it increased more dramatically between 11/8/2022 and 11/11/2022.

Figure 4: URLhaus reported URL changes over time for %%ip:179.43.175.5%%.

 

In figure 5, the IP address URL count almost doubled in a couple of days.

Figure 5: URLhaus reported URL changes over time for %%ip:193.42.33.81%%.

 

SPUR Data

The data compared was retrieved from SPUR, but this kind of WHOIS data is available from a variety of sources. First, I wanted to take a look at how many differences were seen in the registration data by IP address. I limited the information compared to the IP address, organization and location information.

 

Figure 6: Breakdown of IP addresses and how many unique sets of data were seen per IP address.

 

Over 3/4 of the IP addresses didn't have any change in the information reported. For the most part, the data doesn't change often. However, there were several IP addresses that had multiple changes. In figure 7, there were changes on average about once a month for the location.

Figure 7: IP Address %%ip:201.186.40.250%% showing changes in geographic regions over time.

 

In figure 8, the organization changed every couple of months between March and July of 2024. It may have changed more frequently, but was not recorded by my honeypot.

Figure 8: IP Address %%ip:101.32.114.105%% showing changes in organization name over time.

 

The raw WHOIS information for %%ip:101.32.114.105%% contains information that refers to both organizations listed from the SPUR data.

% Information related to '101.32.112.0 - 101.32.175.255'

% Abuse contact for '101.32.112.0 - 101.32.175.255' is 'qcloud_net_duty@tencent.com'

inetnum:        101.32.112.0 - 101.32.175.255
netname:        ACEVILLEPTELTD-SG
descr:          16 COLLYER QUAY
country:        SG
admin-c:        APA7-AP
tech-c:         APA7-AP
abuse-c:        AA1875-AP
status:         ALLOCATED NON-PORTABLE
mnt-by:         MAINT-ACEVILLEPTELTD-SG
mnt-irt:        IRT-ACEVILLEPTELTD-SG
last-modified:  2022-02-16T17:35:17Z
source:         APNIC

irt:            IRT-ACEVILLEPTELTD-SG
address:        16 COLLYER QUAY, # 18-29, INCOME AT RAFFLES, SINGAPORE
e-mail:         qcloud_net_duty@tencent.com
abuse-mailbox:  qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
auth:           # Filtered
remarks:        qcloud_net_duty@tencent.com is invalid
mnt-by:         MAINT-ACEVILLEPTELTD-SG
last-modified:  2024-05-22T13:07:48Z
source:         APNIC

role:           ABUSE ACEVILLEPTELTDSG
address:        16 COLLYER QUAY, # 18-29, INCOME AT RAFFLES, SINGAPORE
country:        ZZ
phone:          +000000000
e-mail:         qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
nic-hdl:        AA1875-AP
remarks:        Generated from irt object IRT-ACEVILLEPTELTD-SG
remarks:        qcloud_net_duty@tencent.com is invalid
abuse-mailbox:  qcloud_net_duty@tencent.com
mnt-by:         APNIC-ABUSE
last-modified:  2024-05-22T13:08:48Z
source:         APNIC

role:           ACEVILLE PTELTD administrator
address:        16 COLLYER QUAY, #18-29, INCOME AT RAFFLES, SINGAPORE
country:        SG
phone:          +8613923479936
fax-no:         +8613923479936
e-mail:         qcloud_net_duty@tencent.com
admin-c:        APA7-AP
tech-c:         APA7-AP
nic-hdl:        APA7-AP
mnt-by:         MAINT-ACEVILLEPTELTD-SG
last-modified:  2023-03-17T12:36:41Z
source:         APNIC

 

Regardless of where you get your enrichment data, it will change over time. Get updated information when you can and use multiple sources of enrichment data for comparison.

 

[1] https://github.com/jslagrew/cowrieprocessor
[2] https://isc.sans.edu/api/
[3] https://urlhaus.abuse.ch/
[4] https://spur.us/
[5] https://www.virustotal.com/
[6] https://isc.sans.edu/diary/VirusTotal+Result+Comparisons+for+Honeypot+Malware/29040
[7] https://github.com/demisto/content/blob/master/Packs/VirusTotal/Integrations/VirusTotalV3/README.md
[8] https://www.virustotal.com/gui/file/062ba629c7b2b914b289c8da0573c179fe86f2cb1f70a31f9a1400d563c3042a
[9] https://www.virustotal.com/gui/file/47b268c21591069bfe4099833ad66b8138a53ab2dcb866e040d466aee1f8624c
[10] https://www.virustotal.com/gui/file/306f0c79ad9ee76e996556f909306fda5704b456d670aa9daeb54760b4b5e4f6
[11] https://bgpview.io/prefix/101.32.114.0/23#whois

--
Jesse La Grew
Handler

[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program]

Managing the Attack Surface

You’ve begun the journey of reviewing your IT infrastructure and attempting to figure out how to protect yourself from those who might not have the greatest intentions. That’s great! Stop yourself though, before you get too far into the weeds of the different technologies available to you to defend yourself. Before you get to that point, there are some details that need to be fleshed out. Let’s have a look:

• What industry are you in? Depending on the service provided, you may already have a baseline that you need to be at, provided to you by those who came before you and have danced with those who mean you harm.
• Where and who do you do business with? If you’re a utility provider in Topeka, Kansas, does it make sense to have your online presence available to the general public outside of the Continental United States? Think about the potential risk versus limiting access to those who need to manage it.
• What does your organization actually need to be successful? What data do you actually need to survive, what devices are necessary, what software will get you to where you need to be?

These are all pertinent questions to either scaling up or scaling down your attack surface and working towards having chaos-free Friday nights. 

Fortify the Exterior Walls

Defense-in-Depth is the name of the game in the 21st Century, but that doesn’t mean we shouldn’t be doing what we can to make sure the perimeter walls aren’t as imposing as possible. You use firewalls, yes, but are you using them to their maximum potential? Modern firewalls allow for geo-blocking, which is the blocking of traffic based on IP addresses correlated to countries. These databases are updated somewhat regularly, so there is maintenance to be done on your firewalls to make sure they’re up to date. If you’d like even stronger evidence for using geo-blocking, search for “Top 10 Countries where cyber attacks originate”. Lists have been generated by teams across the world to show where many of the world’s cyber criminals are calling home. Now though, what if you do have a business partner that resides in one of those countries that you may not want traffic widely from? Easy enough, create an exception for their ASN in the geo-fence. 

Another tool at your disposal is reputation filtering. This process allows your firewall to reference the IP of either source or destination and forward or drop the packet as per the policy. This can be highly effective at reducing the amount of potentially malicious traffic that is not initially blocked by your geo-fence. Take heed though: Cloud Service Providers may be unintentionally flagged and dropped due to the nature of their business model. There is a way to help you navigate this mystery though, and that is to simply look at who the largest CSP’s are, and weigh that against historical traffic to your assets. You may want to allow AWS, Azure, GCP, and even DigitalOcean, but how about that small-time server farm in Seychelles? Or the Netherlands? Those you can probably block outright, after considering those initial questions we talked about earlier. 

We spoke about traffic coming to the outer walls, but what about traffic trying to get out of the gate? You should consider blocking websites internally. i.e. social media sites. You can go one step further and segment your network to allow certain employees to access those sites, should it be within their role’s purview. If employees want to peruse social media while working, let’s say they’re on downtime, then force them to connect their devices to a well-segmented guest network. It is probably not worth allowing them to access these things from a network that also houses production environments though. 

Email is one of the most widely abused mechanisms for delivering malware and social engineering. What can we do about it though? Well let’s set up an email gateway, so we can filter out the wheat from the chaff. Modern email gateways allow integration of services like VirusTotal, which would scan the email attachments and flag them for being potentially malicious. You could also integrate a sandbox, which would then scan and ‘detonate’ email attachments to find the malicious threats hidden in the mail. Obviously, before implementing these services you need to test them. That goes for all your possible interventions though; don’t just throw things into your infrastructure and hope for the best. 

Another way to protect from bad emails is reputation filtering, much the same way we discussed earlier. There is a problem however- scammers, spammers and all the other generally not-so great people like to use free email services like Gmail, much like the rest of us. So, what could we do? We can’t just block inbound Gmail, that could be disastrous for communications. What we can do is server-side filtering to allow the free email services to go to some internal email addresses but not to another. Your customer service team might need to talk to people who are using Gmail, but how about your engineering team? Or your HR team? 

You can safely assume that these protections can be costly, in terms of both finance and time. If you’re a smaller organization, these might not be feasible to do, at least in-house. You may have to source the assistance of a third party, or perhaps form a consortium with other like-entities and purchase the solutions from a vendor. When considering time, think about your mean time to recovery. If you’re organization is breached, how long do you have until there’s no coming back?

Harden your Outposts

You need to be better at managing your devices. You might find the tone accusatory, which is fine, it’s supposed to be. By reading that statement though, you probably just started doing an inventory of all the things you’ve done to protect your endpoints, to the best of your knowledge and ability. Let’s look at some of the top things you can do to make sure you’re best protected.

First, you need to inventory what you have. You cannot protect what you don’t know exists, so go ahead and run that internal nmap discovery scan to find that web server you stood up 10 years ago but then never touched again. 

Now that you know what you have, let’s take a look at patches. Patching needs to be done, or if not, then you need a good excuse and mechanisms to protect the enterprise from issues that may arise from leaving a weakness in the network defenses. Depending on where that weakness is, you’ll need to increase the surveillance on the assets that connect to that unpatched or out-of-date asset. Patch management also needs to exist, don’t just run “Scan for Updates” on your Windows machine then let it update in the middle of the workday. Have yourself a testing environment, and stage those updates. If you need any other supporting evidence for this notion, then I’ll direct your attention to the recent global CrowdStrike outage. 

BYOD, or “Bring Your Own Device”, is an idea that has taken off due to cost, but it does have its issues. The first issue is vulnerability management for that device. You have potentially hundreds or even thousands of different devices that you have no control of whether they are up to date with the latest security patches. If you cannot avoid BYOD, say because of cost, then you’ll need to really be up to date on what devices your employees are hooking to the network. Make a note of the devices they plan on using for work, and if they purchase a new one, have them reach out to your IT staff and let them know about it. If you cannot control what devices are accessing your data, then you’ll need to compensate by working even harder to manage your alerting mechanisms.

Data commingling is another issue. How to control what happens to the business data that is on that device? Applications as well, having no idea what these people are downloading on to their devices and the vulnerabilities they are introducing. More on Application Control: find the best possible software for what you need it to do and stick to that. It does you no favors to use several different IDEs for software development, or package management. This also assists in general IT operations, not just security. 

Managing the attack surface is no easy task, and entire books could be and have been written on what to should do. I hope though, that what I’ve highlighted here today helps you down your path. 

[1] https://www.sans.edu/cyber-security-programs/bachelors-degree/

-----------
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

On August 10th, the popular learning platform "Moodle" released an update fixing %%cve:2024-43425%%. RedTeam Pentesting found the vulnerability and published a detailed blog post late last week. The blog post demonstrates in detail how a user with the "trainer" role could execute arbitrary code on the server. A trainer would have to publish a "calculated question". These questions are generated dynamically by evaluating a formula. Sadly, the formula was evaluated using PHP's "eval" command. As pointed out by RedTeam Pentesting, "eval" is a very dangerous command to use and should be avoided if at all possible. This applies not only to PHP but to most languages (also see my video about command injection vulnerabilities). As I usually say: "eval is only one letter away from evil".

The exploit does require the attacker to be able to publish questions. However, Moodle is used by larger organizations like Universities. An attacker may be able to obtain credentials as a "trainer" via brute forcing or credential stuffing.

I got pointed to "Moodle" after seeing this URL in our "First Seen" list of newly accessed URLs:

/lib/ajax/service.php?info=tool_mobile_get_public_config&lang=en

This "public config" may return additional details in some cases, but from my tests with a demo instance of Moodle, it only returns:

 {"error":"Coding error detected, it must be fixed by a programmer: Invalid json in request: Syntax error","errorcode":"codingerror","stacktrace":null,"debuginfo":null,"reproductionlink":null}

At least this URL could be used to find Moodle instances and probe them later with more specific exploits. I will have to add this case to our honeypot responses to get more details. These scans are not new, but we had only individual scans (one or two per day) so they never passed our threshold as "significant". Only yesterday did they pass the "line".

But in the meantime:

1. Keep Moodle up to date (they do have a decent chart outlining support timeframes for different versions)
2. Audit the "trainer" accounts, not just because of the vulnerability, but in general, they can cause damage to the system.
3. Let me know if you have additional insight into Moodle. Is there something else that this URL could trigger?

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Just like "Protected OOXML Spreadsheets", Word documents can also be protected:

You have to look into the word/settings.xml file, and search for element w:documentProtection:

The hash algorithm is the same as for OOXML spreadsheets. However, you will not be able to use hashcat to crack protected Word document hashes, because the password is encoded differently before it is repeatedly hashed.

A legacy algorithm is used to preprocess the password, and I found a Python implementation here.

# https://stackoverflow.com/questions/65877620/open-xml-document-protection-implementation-documentprotection-class
dHighOrderWordLists = [
    [0xE1, 0xF0],
    [0x1D, 0x0F],
    [0xCC, 0x9C],
    [0x84, 0xC0],
    [0x11, 0x0C],
    [0x0E, 0x10],
    [0xF1, 0xCE],
    [0x31, 0x3E],
    [0x18, 0x72],
    [0xE1, 0x39],
    [0xD4, 0x0F],
    [0x84, 0xF9],
    [0x28, 0x0C],
    [0xA9, 0x6A],
    [0x4E, 0xC3]
]

dEncryptionMatrix = [
    [[0xAE, 0xFC], [0x4D, 0xD9], [0x9B, 0xB2], [0x27, 0x45], [0x4E, 0x8A], [0x9D, 0x14], [0x2A, 0x09]],
    [[0x7B, 0x61], [0xF6, 0xC2], [0xFD, 0xA5], [0xEB, 0x6B], [0xC6, 0xF7], [0x9D, 0xCF], [0x2B, 0xBF]],
    [[0x45, 0x63], [0x8A, 0xC6], [0x05, 0xAD], [0x0B, 0x5A], [0x16, 0xB4], [0x2D, 0x68], [0x5A, 0xD0]],
    [[0x03, 0x75], [0x06, 0xEA], [0x0D, 0xD4], [0x1B, 0xA8], [0x37, 0x50], [0x6E, 0xA0], [0xDD, 0x40]],
    [[0xD8, 0x49], [0xA0, 0xB3], [0x51, 0x47], [0xA2, 0x8E], [0x55, 0x3D], [0xAA, 0x7A], [0x44, 0xD5]],
    [[0x6F, 0x45], [0xDE, 0x8A], [0xAD, 0x35], [0x4A, 0x4B], [0x94, 0x96], [0x39, 0x0D], [0x72, 0x1A]],
    [[0xEB, 0x23], [0xC6, 0x67], [0x9C, 0xEF], [0x29, 0xFF], [0x53, 0xFE], [0xA7, 0xFC], [0x5F, 0xD9]],
    [[0x47, 0xD3], [0x8F, 0xA6], [0x0F, 0x6D], [0x1E, 0xDA], [0x3D, 0xB4], [0x7B, 0x68], [0xF6, 0xD0]],
    [[0xB8, 0x61], [0x60, 0xE3], [0xC1, 0xC6], [0x93, 0xAD], [0x37, 0x7B], [0x6E, 0xF6], [0xDD, 0xEC]],
    [[0x45, 0xA0], [0x8B, 0x40], [0x06, 0xA1], [0x0D, 0x42], [0x1A, 0x84], [0x35, 0x08], [0x6A, 0x10]],
    [[0xAA, 0x51], [0x44, 0x83], [0x89, 0x06], [0x02, 0x2D], [0x04, 0x5A], [0x08, 0xB4], [0x11, 0x68]],
    [[0x76, 0xB4], [0xED, 0x68], [0xCA, 0xF1], [0x85, 0xC3], [0x1B, 0xA7], [0x37, 0x4E], [0x6E, 0x9C]],
    [[0x37, 0x30], [0x6E, 0x60], [0xDC, 0xC0], [0xA9, 0xA1], [0x43, 0x63], [0x86, 0xC6], [0x1D, 0xAD]],
    [[0x33, 0x31], [0x66, 0x62], [0xCC, 0xC4], [0x89, 0xA9], [0x03, 0x73], [0x06, 0xE6], [0x0D, 0xCC]],
    [[0x10, 0x21], [0x20, 0x42], [0x40, 0x84], [0x81, 0x08], [0x12, 0x31], [0x24, 0x62], [0x48, 0xC4]]
]


def WordEncodePassword(password):
  password_bytes = password.encode('utf-8')
  password_bytes = password_bytes[:15]

  password_length = len(password_bytes)

  if password_length > 0:
    high_order_word_list = dHighOrderWordLists[password_length - 1].copy()
  else:
    high_order_word_list = [0x00, 0x00]

  for i in range(password_length):
    password_byte = password_bytes[i]
    matrix_index = i + len(dEncryptionMatrix) - password_length

    for j in range(len(dEncryptionMatrix[0])):
      # Only perform XOR operation using the encryption matrix if the j-th bit is set
      mask = 1 << j
      if (password_byte & mask) == 0:
        continue

      for k in range(len(dEncryptionMatrix[0][0])):
        high_order_word_list[k] = high_order_word_list[k] ^ dEncryptionMatrix[matrix_index][j][k]

  low_order_word = 0x0000

  for i in range(password_length - 1, -1, -1):
    password_byte = password_bytes[i]
    low_order_word = (
      (((low_order_word >> 14) & 0x0001) | ((low_order_word << 1) & 0x7fff))
      ^ password_byte
    )

  low_order_word = (
    (((low_order_word >> 14) & 0x0001) | ((low_order_word << 1) & 0x7fff))
    ^ password_length
    ^ 0xce4b
  )

  low_order_word_list = [(low_order_word & 0xff00) >> 8, low_order_word & 0x00ff]

  key = high_order_word_list + low_order_word_list
  key.reverse()

  # `key_str` is a hex string with uppercase hexadecimal letters, e.g. '7EEDCE64'
  key_str = ''.join(f'{c:X}' for c in key)

  return key_str

This password preprocessing code can then be used with the same hashing function as for Excel, like this:

def CalculateHash(password, salt):
    passwordBytes = password.encode('utf16')[2:]
    buffer = salt + passwordBytes
    hash = hashlib.sha512(buffer).digest()
    for iter in range(100000):
        buffer = hash + struct.pack('<I', iter)
        hash = hashlib.sha512(buffer).digest()
    return hash

def WordCalculateHash(password, salt):
    return CalculateHash(WordEncodePassword(password), binascii.a2b_base64(salt))

Using password "P@ssword" and the salt seen in the screenshot above, we can calculate the hash:

This calculated hash (BASE64 representation) is the same as the stored hash, thus the password is indeed "P@ssw0rd".

 

Didier Stevens
Senior handler
blog.DidierStevens.com

Display filters are used to define expressions that decide which packets get displayed, and which not in Wireshark's packet list.

Berkeley Packet Filter (BPF) expressions decide which packets get captured, and which not when Wireshark is capturing traffic.

Both expression types have a different syntax.

Wireshark release 4.4 brings a new feature to convert display filter expressions to BPF expressions.

Type your display filter expression into the display filter box, and then select this menu entry: Edit / Copy / Display filter as pcap filter.

The capture filter expression is put on the clipboard:

tcp dst port 443

If Wireshark can not convert an expression, the menu option will be grayed-out:

 

Didier Stevens
Senior handler
blog.DidierStevens.com