Nong Hoang Tu dmknght

I. Disclaimer

This script is a copied of https://gist.github.com/tdcosta100/7def60bccc8ae32cf9cacb41064b1c0f but "converted" for Kali inside WSL
Set DPI inside WSL doesn't work (command xfconf-query -c xsettings -p /Gdk/WindowScalingFactor -n -t int -s 2 works but it creates a glitch that windows manager won't run). To increate DPI, user can change WSL settings (however, the quality of text in WSL will be really bad) (check https://github.com/microsoft/wslg/issues/590)

Save this file C:/users/username/.wslgconfig, then wsl --shutdown. File's contents:

[system-distro-env]
WESTON_RDP_HI_DPI_SCALING=true
WESTON_RDP_FRACTIONAL_HI_DPI_SCALING=true

Hand-on Malware Development on Linux Syllabus

Course Overview

This course provides an in-depth exploration of advanced malware development techniques on Linux, focusing on sophisticated methods such as binary injection, process injection, and file hijacking. Designed for learners with a foundational understanding of Linux and programming, the course emphasizes practical application in a safe, controlled environment (virtual machines) and underscores ethical and legal considerations for academic or authorized security testing purposes.

Malin 101

Day 0: Introduction to Malware and Linux System Programming

Objectives:

Researcher and product info

Production: Avast on Linux
Version: 4.5.1
Database Update: 24092704
Research: FIS Security Team
Report by: Nông Hoàng Tú (tunh19@fpt.com)

Insecure update protocol leads to DNS spoofing

Description and Impact

By default, update server of Avast for Linux uses HTTP protocol which is vulnerable to Man-In-The-Middle and DNS Spoofing attack. An attacker in LAN network can use ARP Spoofing attack, redirect update packet to a fake server or even capture response data and tamper update file.

Device info

Device model: DIR-600M C1
Firmware version: 3.08
Download link: https://dlink.co.in/firmware/ftp.aspx

Description and impact

Dlink DIR-600M C1 has buffer overflow in authentication that allows unauthenticated attacker to performce Denial of Service attack. Attacker can send payload to web login or telnet login (which is disabled by default). This vulnerability is as same as CVE-2021-26709 which possibly leads to unauthenticated remote code execution.

	import os
	import subprocess

	"""
	Automatically extract synology firmware and packages inside it. The SynoXtract is from https://github.com/prt1999/SynoXtract. Compile it first.
	Steps:
	1. Extract firmware .pat file
	2. (Start loop): Extract spk file (package)
	3. Extract tar file. It should contain everything, include ELF files.
	4. (End loop) Return 2.

	import tkinter as tk
	from tkinter import ttk, messagebox, filedialog
	import struct
	import os
	import hashlib
	from datetime import datetime
	from dataclasses import dataclass
	from typing import List, Optional, Tuple
	import re

	import "elf"
	import "console"

	/*
	To use this rule, simply run: yara <path to this rule> <pah to dir to scan> -r -p 1 -N
	Explain:
	-r: recursively search
	-p 1: Run single thread only. Show console log won't be messed up
	-N: No follow symlink. Ignore duplicate results from symlink
	Suggestion: In future, run with -s could be good

	#!/usr/bin/python3

	import os
	import requests
	from shodan import Shodan


	API_KEY_PATH = os.path.expanduser("~/.config/shodan/api_key") # read API key from config file
	KEYWORD = "country:cn http.status:200 \"Server: Check Point SVN foundation\""
	URL_REQ = "/clients/MyCRL"

	#!/bin/bash

	# Example of using bash with array
	port_arr=(80 22 3306)
	max_timeout=2 # Timeout requires coreutils (on Debian-based system)

	function do_scan_port {
	# If use array like above, use the line above
	for port in "${port_arr[@]}"; do
	# Otherwise, use the port range

	# Install openjfx first (this package includes openjfx-source and the lib (sudo apt install -y openjfx)
	java --module-path /usr/share/openjfx/lib --add-modules javafx.controls,javafx.fxml,javafx.graphics -jar SCRChart_v2.0.jar