Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrated PacketWhisper to Python3 #2

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Migrated PacketWhisper to Python3 #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4256cc
Removed trailing whitespaces
dasm Oct 1, 2020
a32c0a9
Migrated to Python3
dasm Oct 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 27 additions & 27 deletions cloakify.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,29 @@
#!/usr/bin/python
#
# Filename: cloakify.py
#
# Filename: cloakify.py
#
# Version: 1.1.0
#
# Author: Joe Gervais (TryCatchHCF)
#
# Summary: Exfiltration toolset (see decloakify.py) that transforms any filetype (binaries,
# archives, images, etc.) into lists of words / phrases / Unicode to ease exfiltration of
# data across monitored networks, hiding the data in plain sight. Also facilitates social
# engineering attacks against human analysts and their workflows. Bonus Feature: Defeats
# archives, images, etc.) into lists of words / phrases / Unicode to ease exfiltration of
# data across monitored networks, hiding the data in plain sight. Also facilitates social
# engineering attacks against human analysts and their workflows. Bonus Feature: Defeats
# signature-based malware detection tools (cloak your other tools during an engagement).
#
# Used by cloakifyFactory.py, can be used as a standalone script as well (example below).
#
# Description: Base64-encodes the given payload and translates the output using a list
# of words/phrases/Unicode provided in the cipher. This is NOT a secure encryption tool,
# Description: Base64-encodes the given payload and translates the output using a list
# of words/phrases/Unicode provided in the cipher. This is NOT a secure encryption tool,
# the output is vulnerable to frequency analysis attacks. Use the Noise Generator scripts
# to add entropy to your cloaked file. You should encrypt the file before cloaking if
# secrecy is needed.
#
# Prepackaged ciphers include: lists of desserts in English, Arabic, Thai, Russian,
# Hindi, Chinese, Persian, and Muppet (Swedish Chef); PokemonGo creatures; Top 100 IP
# Addresses; Top Websites; GeoCoords of World Capitols; MD5 Password Hashes; An Emoji
# cipher; Star Trek characters; Geocaching Locations; Amphibians (Scientific Names);
# Prepackaged ciphers include: lists of desserts in English, Arabic, Thai, Russian,
# Hindi, Chinese, Persian, and Muppet (Swedish Chef); PokemonGo creatures; Top 100 IP
# Addresses; Top Websites; GeoCoords of World Capitols; MD5 Password Hashes; An Emoji
# cipher; Star Trek characters; Geocaching Locations; Amphibians (Scientific Names);
# evadeAV cipher (simple cipher that minimizes size of the resulting obfuscated data).
#
# To create your own cipher:
Expand All @@ -32,13 +32,13 @@
# - Remove all duplicate entries and blank lines
# - Randomize the list (see 'randomizeCipherExample.txt' in Cloakify directory)
# - Provide the file as the cipher argument to the script.
# - ProTip: Place your cipher in the "ciphers/" directory and cloakifyFactory
# - ProTip: Place your cipher in the "ciphers/" directory and cloakifyFactory
# will pick it up automatically as a new cipher
#
# Example:
#
# Example:
#
# $ ./cloakify.py payload.txt ciphers/desserts > exfiltrate.txt
#
#

import os, sys, getopt, base64

Expand All @@ -50,9 +50,9 @@ def Cloakify( arg1, arg2, arg3 ):

payloadFile = open( arg1, 'rb' )
except:
print ""
print "!!! Error opening file", arg1
print ""
print("")
print("!!! Error opening file", arg1)
print("")
return

payloadRaw = payloadFile.read()
Expand All @@ -62,10 +62,10 @@ def Cloakify( arg1, arg2, arg3 ):
with open( arg2 ) as file:
cipherArray = file.readlines()
except:
print ""
print "!!! Oh noes! Problem reading cipher '", arg2, "'"
print "!!! Verify the location of the cipher file"
print ""
print("")
print("!!! Oh noes! Problem reading cipher '", arg2, "'")
print("!!! Verify the location of the cipher file" )
print("")
return

if ( arg3 != "" ):
Expand All @@ -75,19 +75,19 @@ def Cloakify( arg1, arg2, arg3 ):
if char != '\n':
outFile.write( cipherArray[ array64.index(char) ] )
except:
print ""
print "!!! Oh noes! Problem opening or writing to file '", arg3, "'"
print ""
print("")
print("!!! Oh noes! Problem opening or writing to file '", arg3, "'")
print("")
return
else:
for char in payloadB64:
if char != '\n':
print cipherArray[ array64.index(char) ],
print(cipherArray[ array64.index(char) ],)


if __name__ == "__main__":
if ( len(sys.argv) != 3 ):
print "usage: cloakify.py <payloadFilename> <cipherFilename>"
print("usage: cloakify.py <payloadFilename> <cipherFilename>")
exit

else:
Expand Down
40 changes: 20 additions & 20 deletions decloakify.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,27 +4,27 @@
#
# Author: Joe Gervais (TryCatchHCF)
#
# Summary: Exfiltration toolset (see cloakify.py) that transforms data into lists
# of words / phrases / Unicode to ease exfiltration of data across monitored networks,
# essentially hiding the data in plain sight, and facilitate social engineering attacks
# against human analysts and their workflows. Bonus Feature: Defeats signature-based
# Summary: Exfiltration toolset (see cloakify.py) that transforms data into lists
# of words / phrases / Unicode to ease exfiltration of data across monitored networks,
# essentially hiding the data in plain sight, and facilitate social engineering attacks
# against human analysts and their workflows. Bonus Feature: Defeats signature-based
# malware detection tools (cloak your other tools).
#
# Used by cloakifyFactory.py, can be used as a standalone script as well (example below).
#
# Description: Decodes the output of cloakify.py into its underlying Base64 format,
# then does Base64 decoding to unpack the cloaked payload file. Requires the use of the
# Description: Decodes the output of cloakify.py into its underlying Base64 format,
# then does Base64 decoding to unpack the cloaked payload file. Requires the use of the
# same cipher that was used to cloak the file prior to exfitration, of course.
#
# Prepackaged ciphers include: lists of desserts in English, Arabic, Thai, Russian,
# Hindi, Chinese, Persian, and Muppet (Swedish Chef); Top 100 IP Addresses; GeoCoords of
# World Capitols; MD5 Password Hashes; An Emoji cipher; Star Trek characters; Geocaching
# Locations; Amphibians (Scientific Names); and evadeAV cipher, a simple cipher that
# Prepackaged ciphers include: lists of desserts in English, Arabic, Thai, Russian,
# Hindi, Chinese, Persian, and Muppet (Swedish Chef); Top 100 IP Addresses; GeoCoords of
# World Capitols; MD5 Password Hashes; An Emoji cipher; Star Trek characters; Geocaching
# Locations; Amphibians (Scientific Names); and evadeAV cipher, a simple cipher that
# minimizes the size of the resulting obfuscated data.
#
# Example:
#
# $ ./decloakify.py cloakedPayload.txt ciphers/desserts.ciph
# Example:
#
# $ ./decloakify.py cloakedPayload.txt ciphers/desserts.ciph


import sys, getopt, base64
Expand All @@ -34,10 +34,10 @@
def Decloakify( arg1, arg2, arg3 ):

with open( arg1 ) as file:
listExfiltrated = file.readlines()
listExfiltrated = file.readlines()

with open( arg2) as file:
arrayCipher = file.readlines()
arrayCipher = file.readlines()

clear64 = ""

Expand All @@ -49,13 +49,13 @@ def Decloakify( arg1, arg2, arg3 ):
outFile.write( base64.b64decode( clear64 ))

else:
print base64.b64decode( clear64 ),
print(base64.b64decode( clear64 ),)


if __name__ == "__main__":
if (len(sys.argv) != 3):
print "usage: decloakify.py <cloakedFilename> <cipherFilename>"
exit
if (len(sys.argv) != 3):
print("usage: decloakify.py <cloakedFilename> <cipherFilename>")
exit
else:
Decloakify( sys.argv[1], sys.argv[2], "" )
Decloakify( sys.argv[1], sys.argv[2], "" )

Loading