Malwrologist Profile picture
Cybersecurity Research @Microsoft, Ex Assistant Professor. Opinions are mine; not my employer's. DM is open. Author of xlmdeobfuscator and
Jul 6, 2022 6 tweets 2 min read
#VBA declare statement: from libname #obfuscation to remote dll loading 🧵

Declare is used to declare a ref to an external proc in a DLL

[Public | Private] Declare Function name Lib "libname" [Alias "aliasname"] [ ( [arglist] ) ] [As type]

ref:… 0⃣ both "kernel32" and "kernel32.dll" are acceptable libnames
1⃣ padding with space chars " kernel32 "
2⃣ adding arbitrary . to the mix " kernel32 .. .. . "
Oct 9, 2018 8 tweets 9 min read
#linux #bash #obfuscation #technique #bashfuscation
padding commands with history expansion characters (#exclamation mark (!))
! ! ! ! echo this is test
(removed the previous tweet as I revealed too much info !) #linux #bash #obfuscation #bashfuscation

using history expansion character -> !! (i.e. last command)

!!t really

is equivalent to
cat really

(only 4 interactive shell)
Aug 4, 2018 5 tweets 7 min read
#linux #bash #path #obfuscation
goal: obfuscate /etc/passwd
1) #directorytraversal: /mnt/././../etc/././passwd
2) escape characher: /etc/.\/\/\/\/\/passwd /etc/.\/.\/.\/.\/passwd /\e\t\c/passwd
3) null character /et$'c/pa\u0000/notexist/path'sswd
.... #path #obfuscation using #symbolic #link
ln -s / anything
head -n 2 anything////../etc/passwd

ln -s ../../ wow
head -n 2 ././wow/../etc/passwd

* ../ after a sym link applies to the sym link not the current path
Jul 30, 2018 6 tweets 6 min read
#linux #bash #obfuscation using shell parameter expansion:

${alphabet:2:1}at really
${alphabet: -24:-23}at really
${alphabet: -24:1}at really
${alphabet:2:-23}at really…
similar #bat #windows (…) The goal is to obfuscate the following command:
cat really
in which, really is a file.
Jul 29, 2018 13 tweets 6 min read
#linux #bash #obfuscation using octal vals
$'\143\141\164' really…
"Words of the form $'string' are treated specially. The word expands to string, with backslash-escaped characters replaced as specified by the ANSI C standard."

Image Variations
$'\143'$'\141'$'\164' really
$'\143'''$'\141'''''''''''''$'\164' really
$'\143'''$'\141'''""''''""''$'\164' really

'' -> empty string
""-> empty string
'a''b' -> 'ab' (concatenation)

(deleted the previous one, as the picture had a problem) Image