Kali Linux

Heyserial : Programmatically Create Hunting Rules For Deserialization Exploitation

Heyserial will Programmatically create hunting rules for deserialization exploitation with multiple

  • keywords (e.g. cmd.exe)
  • gadget chains (e.g. CommonsCollection)
  • object types (e.g. ViewState, Java, Python Pickle, PHP)
  • encodings (e.g. Base64, raw)
  • rule types (e.g. Snort, Yara)

Usage

Help: python3 heyserial.py -h

Examples:

python3 heyserial.py -c ‘ExampleChain::condition1+condition2’ -t JavaObj
python3 heyserial.py -k cmd.exe whoami ‘This file cannot be run in DOS mode’
python3 heyserial.py -k Process.Start -t NETViewState -e base64 “base64+utf16le”

Utils

utils/checkyoself.py

This is a tool to automate bulk testing of Snort and Yara rules on a variety of sample files.

Usage: python3 checkyoself.py [-y rules.yara] [-s rules.snort] [-o file_output_prefix] [--matches] [--misses] -d malware.exe malware.pcap

Examples: python3 checkyoself.py -y rules/javaobj -s rules/javaobj -d payloads/javaobj pcaps --misses -o java_misses

utils/generate_payloads.ps1

YSoSerial.NET v1.34 payload generation. Run on Windows from the ./utils directory.

  • Source: https://github.com/pwntester/ysoserial.net
  • License: ysoserial.net_LICENSE.txt

utils/generate_payloads.sh

YSoSerial payload generation. Run on Linux from the ./utils directory.

  • Source: https://github.com/frohoff/ysoserial
  • License: ysoserial_LICENSE.txt

utils/install_snort.sh

Installing Snort on a Debian based system was a bit finnicky for me, so I wrote my install notes here.

Use at your own risk in a VM that you have snapshotted recently.

utils/server.py

Simple Python script that runs an HTTP server on 127.0.0.1:12345 and accepts POST requests.

Handy for generating test PCAPs.

R K

Recent Posts

Bash Scripting Best Practices Every Beginner Should Know

Introduction Bash scripting is a powerful way to automate Linux tasks, but writing a script…

1 day ago

How To Create A Self-Signed SSL Certificate Using Bash And OpenSSL

Introduction A self-signed SSL certificate is a certificate that is created and signed by the…

1 day ago

How To Debug Bash Scripts Using bash -x And set Commands

Introduction Debugging is an important part of Bash scripting. When a script does not work…

1 day ago

How To Use Cron Jobs With Bash Scripts For Automation

Introduction Cron jobs are used in Linux to run commands or Bash scripts automatically at…

1 day ago

How To Use Pipes In Bash Scripts For Command Chaining

Introduction Pipes are an important feature in Linux and Bash scripting. A pipe allows you…

1 day ago

How To Use grep, awk, And sed In Bash Scripts

Introduction The grep, awk, and sed commands are powerful text-processing tools in Linux. They are…

2 days ago