Search
100 results for “silversearcher”
-
Hold op, hvor er Coldplays “Charlie Brown” et fedt nummer. #genopdagelse #coldplaycph #coldplayconcert #dkmusik
-
Dagens nye viden: Jeg vidste ikke at H.C. Andersen-skoven ved Odense ser sådan ud fra oven. #visitodense #ferie #skov
-
Medier og forskere taler ofte om at politiske og værdimæssige kløfter med tiden vil blive dybere p.gr.a. algoritmers “selvforstærkende” effekt. Men hvordan med kulturelle og værdimæssige kløfter mellem mænd og kvinder? Er det en af grundene til at vi ser en snigende stigning i singles/enlige? #some #parforhold #singler #algoritmer #meta
-
Hot Off The Press
To start with let’s see what kind of file this is.
“UHARC is a compression/archiving system for PC platforms, which appears to be neglected since around 2005. It achieves better compression than most other archivers, at the expense of being much slower.”
I scoured the internet looking for a copy of UHARC to download. I’m not going to link any here as many if not all may contain malware. Since this is a Windows only tool, (or Wine under Linux), we’ll open this one in a sandboxed Windows system.
When the file extracts we are presented with hot_off_the_press.ps1.
OMG that’s a lot of obfuscation! Let’s see if we can clean this up and make it more readable. First let’s remove all the ”+”
That’s a little bit better. There’s another obfuscation method going on where specific numbers are used to represent different letters. Originally, I tried to determine the substitution by completing terms I knew. Early ahead I saw (”Sc{2}i’pt{1}loc{0}Logging”) which to me reads like ScriptBlockLogging. So all 2’s are i’s, 1’s are B’s, and 0’s are k. I do a find/replace through the script with replacements on {0},{1}, and {2}. Now it looks like a block of Base64 in the middle block. I copy it over to CyberChef and … NADA. Something’s not right.
If you look closer at the code, you’ll see that each one of the strings that had a {#} substitution in it ends with “-f” followed by other letters in quotations. The first character after -f is substituted for {0}, the next for {1}, etc. So I run the same substitution pattern on the script using the correct letters for this string this time.
Replace the {0} with L.
Replace the {1} with E.
Now we’ve got a nice clean block of Base64.
Bring that over to CyberChef for decoding and:
We’ve got a script within the script.
If you scroll down in the output, you’ll see that there’s something else encoded as well.
We’ll run that through CyberChef.
Interesting we have an encoded_flag. Let’s add URL decode to the recipe.
HumanTwo
There were 1,000 files in the zip container. Easy comparison options like file size, modification date etc. don’t help as they are the same for all the files. It’s something in the content that has to be different. How the ‘f’ am I going to find the outlier in 1,000 files?! Meld and diff are two options coming up in the Discord. I install Meld, which is really a gui for diff, and start getting a feel for it. You can compare files or directories. If doing files you could do a 3 way comparison between 3 files. But not 1000. As I was looking through the files with Meld it struck me that all of the file contents we also the same with the exception of one line.
Let’s run through all the files with the_silver_searcher and isolate on String.Equals
Scrolling down through the output we see that one is a definite outlier, or as we like to say around here, an Irregular.
Once more to CyberChef, this time from Hex.
PHP Stager
Heavily obfuscated PHP. This is going to be fun.
Let’s see if ChatGPT can give some insight into what’s going on here.
After several hours of back and forth from PHP to Python to PowerShell, online IDE’s, more ChatGPT, googling, and back again I was able to roughly reproduce the PHP in a Python and get it to execute.
Looks like we’re not done yet. In the middle of the output we can see another block of Base64. What happens if we toss that into CyberChef.
Great! Now we have a Perl script. How far down does this challenge go? It’s like those Matryoshka dolls from Russia. One inside another inside another. But wait… there’s something interesting in the Perl script.
There’s a reference to UU encoding and a string. We’ll copy the string and bring it over to another of my favorite decoding sites, dcode.fr.
Sure enough it handles the decoding and we have our flag.
Zerion
Yay (said no one), another crazy PHP file.
Looks to be using Base64 encoding, Rot13, and some other options to obfuscate the code. Back to school (ChatGPT) to see what’s going on.
Let’s copy the large encoded text block to CyberChef. We’ll apply Rot13, then Reverse the text by Character, and finally – decrypt using Base64.
And that’s our flag!
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
#base64 #CyberChef #decodeFr #DFIR #diff #meld #Perl #PowerShell #Python #theSilverSearcher #uuencode
-
Det er sgu’ på flere måder trist at en lav f-16-overflyvning ved bisættelsen af en pensioneret sports- og militærmand koster en anden pensioneret topatlet livet. Dressurhesten Horsebo Smarties vandt to bronzemedaljer ved de paralympiske lege i Rio, EM-guld og to gange VM-guld. https://www.dr.dk/sporten/ridning/dekoreret-dressurhest-doed-efter-panikreaktion-paa-lavtflyvende-kampfly #dksport #ridning #dressage #paralympics
-
Professor i jura Michael Gøtze om de nye ejendomsvurderinger: Det er en ny tendens at vores klageret fjernes eller indskrænkes. https://politiken.dk/debat/debatindlaeg/art9591253/Forsker-Der-ligger-et-andet-interessant-problem-bag-de-mange-skandalevurderinger #dkpol #dkmedier #ejendomsskat #ejendomsvurderinger #folketinget #regeringen #retsstat
-
Ugrep – a more powerful, fast, user-friendly, compatible grep
https://ugrep.com/
#ycombinator #ugrep_manual #regex #agrep #ack #grep #ripgrep #silver_searcher #grep_compatible #grep_alternative #grep_replacement #file_search #file_indexing #Google_search_files #fuzzy_search #zip_search #tar_search #tarball_search #gzip_search -
Ugrep – a more powerful, ultra fast, user-friendly, compatible grep
https://ugrep.com/
#ycombinator #ugrep_manual #regex #agrep #ack #grep #ripgrep #silver_searcher #grep_compatible #grep_alternative #grep_replacement #file_search #file_indexing #Google_search_files #fuzzy_search #zip_search #tar_search #tarball_search #gzip_search -
Valgsprogsbingo ;). #frederikX #tronskifte
-
Det er ikke en “underlig diskussion” hvorvidt Venstres skandaløse og skadelige vandmiljøpakke fra 2015 er skyld i at vandmiljøet ikke er forbedret, men er uhyggelig dårligt. Jeg håber sådan at medierne stiller kritiskt skarpt på det - politikere må lære at der kommer konsekvenser af lave miljøpakker i ond tro. Desværre er der stor risiko for samme handlemåde igen. #dkgreen #vandmiljø #dkpol #videnskab
-
Tankevækkende artikel i lyset af vores konfliktramte verden. Hvordan slutter krig egentlig? https://www.zetland.dk/historie/segJkj9J-a8dQKjjz-84967 #dkpol #dkhistorie
-
Dagens spændende lyt: Historien om de svenske bernadotter, fra den franske marskal Bernadotte og hans vej til at blive konge af Sverige, og til Folke Bernadotte, hans “hvide busser” og hans drab i Israel pga. hans to-stats-fredsforslag. https://share.podimo.com/s/JsW7TYVK #podcast #folkebernadotte #israel
#sverige #palæstina #dkpol #dkhistorie -
Så er det vist på tide at komme i gang! #peberfrugt #chili #gardening
-
Et citat der jævnligt kan tages frem:
“At se fremad. Det er politikerdansk for: Vi vil ikke tage ansvaret.”
Citat Martin Krasnik.
#dkpol #miljø #vandmiljø #iltsvind #trolex #folketing #dkpol #dkmedier -
Et citat der jævnligt kan tages frem:
“At se fremad. Det er politikerdansk for: Vi vil ikke tage ansvaret.”
Citat Martin Krasnik.
#dkpol #miljø #vandmiljø #iltsvind #trolex #folketing #dkpol #dkmedier -
Et citat der jævnligt kan tages frem:
“At se fremad. Det er politikerdansk for: Vi vil ikke tage ansvaret.”
Citat Martin Krasnik.
#dkpol #miljø #vandmiljø #iltsvind #trolex #folketing #dkpol #dkmedier -
Et citat der jævnligt kan tages frem:
“At se fremad. Det er politikerdansk for: Vi vil ikke tage ansvaret.”
Citat Martin Krasnik.
#dkpol #miljø #vandmiljø #iltsvind #trolex #folketing #dkpol #dkmedier -
@asbjornn man fristes til den lavthængende joke at hæren ikke kan tåle at se blod. #dkpol #værnepligt #forsvaret #værdatkæmpefor
-
Der er 27% frivillige kvinder i Forsvaret, men ifølge formanden for Hærens konstabel- og korporalforening er der så meget praktiske problemer med at kvinder har menstruation og en anden kropsform, så værnepligt for kvinder er ikke en god ide endnu. Jesus F. Christ. #dkpol #værnepligt #værdatkæmpefor
-
#TheSilverSearcher (#ag) is a fast file #search program.
ag is a quick, multi-threaded search program which is great at searching for strings in source trees. ag supports full regex, and can be made to ignore certain files using a .gitignore or any other .*ignore file. ag also can search through compressed and binary files.
Website 🔗️: https://geoff.greer.fm/ag/
apt 📦️: silversearcher-ag
-
Vinterferiesysler (1). #hnefatafl #vikingespil
-
Denne artikel er både til at grine og græde over. En fond købte deres landmandsnabos jord for at plante skov. Nu græder de “hver dag” fordi de frygter at miste udsigten over kornmarken. #forandring #skovrejsning
-
Here comes the (little) sun. ❤️
#dandelion #mælkebøtte -
Den gode gamle håndbog til husholdningen, Farmaceut’s Gode Raad, er en decideret guldgrube udi hjemmeblandet fluelim, fregnefjerner, flyversalve og, æh, fyrværkeri. Proceed with care. #goderåd #kemi #hjemmeblanderi