merces / bashacks

A set of functions to increase productivity while hacking with Bash

Hello, stranger! 👋

So, you found me.

• 🔭 I’ve spent the past 10 years working as a threat researcher in Trend Micro.
• 💚 I run a non-profit organization called Mente Binária to educate people in computing.
• ⚡ Fun fact: I play guitar.

Things I love

Recent Publications ✍️

• How BPF-Enabled Malware Works: Bracing for Emerging Threats
• Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant
• Detecting BPFDoor Backdoor Variants Abusing BPF Filters
• Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals
• DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
• Defending NAS Devices Against Evolving Threats
• Modern Ransomware's Double Extortion Tactics and How to Protect Enterprises Against Them
• VirusTotal Now Supports Trend Micro ELF Hash
• Grouping Linux IoT Malware Samples With Trend Micro ELF Hash
• VPNFilter Two Years Later: Routers Still Compromised

---

📊 Github Stats

bashacks's Issues

ROT functions not working on OS X

ROT functions are not working on OS X. Perhaps tr is not the best option to get it done. Should we consider Perl or tcc?

bh_strxor have a bug

$ bh_strxor 15 'hack'

sed: -e expression #1, char 22: Invalid preceding regular expression

this bug may be related to bh_hex2str script, look this:

$ set -x
$ bh_strxor 15 'hack'

. . .

+ bh_hex2str ' 67 6e 6c 64'
+ [[ 1 -ne 1 ]]
+ local hex
+ local oIFS
+ local i
++ echo ' 67 6e 6c 64'
++ sed -r 's/(0x|\\x| |{\|}|,)//g'
sed: -e expression #1, char 22: Invalid preceding regular expression

Create delivery continuous

I would like to make a PKGBUILD and make available in the AUR however the most stable way would be to pull the releases, but it is interesting to create a DC. What do you think?

websearch presenting some problems

bug in the type free, not force validate domain.
needs more options.

Split manpage by function

The goal is to better organize this area, because, today is very confusing and difficult maintenance

Extend string functions to work with strings and not only chars

Some string functions like bh_isgraph() only works with characters. It would be good to have them extended to work with strings.

bh_hashcrack returning nothing

This function wasn't returning anything on my computer so i went to check upon the source files and it seems that at line 5 of bh_hashcrack it is written like this:
4 local hash="$1"
5 local site="http://hashtoolkit.com/reverse-hash/?hash=$sHash"

and i believe it should be like this:
4 local hash="$1"
5 local site="http://hashtoolkit.com/reverse-hash/?hash=$hash"

i changed mine and now it's all working.

make != gmake (BSD variants)

ifeq is a GNU Make extension and is used in the project's Makefile, if we do what de installation asks for. We got an error in * BSD, because your make tool is another variant.

doc update

I'll be working on updating all the documentation "next week"...
any comment, send below...

new function iscntrl()

validate whether char is a control char.

Fix hashing functions on OS X

All hashing programs may be different (and have a different name) on OS X. We have to handle that.

new function ispunct()

check whether the char is punctuation,
basically is 'isgraph()' that is not alphanumeric.

new function isascii()

validate whether char or string is compatible with ascii table.

Why deliver those codes as functions?

I think using functions and embedding them in .bash_profile puts a lot of pressure on the environment space. Why not to use plain shell scripts? It would be as easy to install and be made globally available as:

$ find ./ -type f -name 'bh_*' -exec cp "{}" /usr/local/bin/ \;

Due to bh_ prefix, this cannot give us any problems with colliding filenames (since 'bh_' can be seen as a namespace). And I would get rid of .sh filename extension as well...

Take a look at a modified version of bh_hashcrack, for instance (of course, there is a minor problem here if wget fails).

#!/bin/bash
# vim: set ts=2 sw=2 et:

# NOTICE: I'm using ANSI to colorize some messages.

# We need a single parameter for this script. Ignore the rest, if any.
if [ -z "${1}" ]
then
  echo -e "\e[33;1mUsage\e[0m: bh_hashcrack <hash>\n"
  exit 1
fi

# If it isn't an hexadecimal string...
if [ ! -z "$(sed -n '/[^0-9A-Fa-f]/p' <<< "${1}")" ]
then
  echo -e "\e[31;1mERROR\e[0m: Invalid hash format."
  exit 1
fi

BH_SITE="http://hashtoolkit.com/reverse-hash/?hash=${1}"

# FIXME: Is this the best method?
BH_DATA="$(wget -qO - "${BH_SITE}")"

# if wget didn't fail, this substring is present on the result string!
if grep -qF 'No hashes found' <<< "${BH_DATA}"
then
  echo -e "\e[31;1mERROR\e[0m: No hashes found."
  exit 1
fi

BH_RES=$(echo "${BH_DATA}" \
 | grep -FA1 'res-text' \
 | sed -n 's/^.*<span>\(.*\)<\/span>.*$/\1/p')

if [ "${BH_RES}" != "${1}" ]
then
  echo -e "\e[33;1mFound\e[0m:"
  echo "${BH_RES}" | sort -u
fi

Notice the renaming of 'local' vars, now uppercase and prefixed with BH_. "Local" because they are not exported.

PS: Of course, if multiple hashes could be used as arguments, we can, always, use a loop with $@ var.
PS2: It should be clear that I don't like some bash/shell scripts shortcuts as well... :)

[]s
Fred

Create function to organize files in a directory

Let's say I have a directory A with hundreds of thousands of files. I would like to move these files to new subdirectories, containing for instance 100 files each.

Source: http://unix.stackexchange.com/questions/63265/distributing-thousands-of-files-over-subfolders

Adjust code style all functions

adjust code with new code style after approved.

see

https://github.com/merces/bashacks/blob/develop/codestyle.md

new function isspace()

check whether the char is white-space

' ' (0x20) space (SPC)
'\t' (0x09) horizontal tab (TAB)
'\n' (0x0a) newline (LF)
'\v' (0x0b) vertical tab (VT)
'\f' (0x0c) feed (FF)
'\r' (0x0d) carriage return (CR)

coding style

how about we create a configuration file in the repository to standardize the indentation?
[like this]

Question about bash strict/portable/valid syntax

I saw you write some $() bash expressions without nested double quotes:

bashacks/src/filesystem/bh_findmime.sh

Lines 40 to 43 in c83169e

	matches=$(for i in "$dir"/*; do
	filetype=$(file -Nb --mime-type "$i")
	[[ "$filetype" =~ application/$opt ]] && echo "${i#./*}"
	done)

bashacks/src/reversing/bh_zerostring.sh

Lines 9 to 15 in c83169e

	local pos=$(strings -t d "$fil" | grep -F "$search" | tr -s ' ' ' ' | cut -d' ' -f2)
	siz=${#search}
	for i in $pos; do
	[[ $i -gt 0 ]] || continue
	dd conv=notrunc bs=1 count=$siz seek=$i if=/dev/zero of="$fil"
	done

bashacks/src/crypto/bh_hashcrack.sh

Lines 16 to 18 in c83169e

	cache=$(grep "${hash}:" "${BASHACKS_CACHEDIR}/hash")
	if [[ "$cache" ]]; then

It might be not much important in particular code. But there is some discussion exists:

https://stackoverflow.com/questions/68588306/nested-double-quotes-in-bash-scripts
https://unix.stackexchange.com/questions/289574/nested-double-quotes-in-assignment-with-command-substitution

Why not just always put the output into nested double quotes:

myvar="$(... "...")"

Isn't that more safer and faster (command line substitution is skipped)?

I've found that the absence of nested double quotes just gives you random errors dependent on the output and context. So better to just always use the nested double quotes to avoid that.

On another hand, there is a fork with quite opposite fixes:

1d1e93d#r86797412

Build wiki.

Wiki with information of each function I/O examples, the propose of project, code style, standards and more.

Add support for OS X

Correct if I'm wrong but recent OS X versions have Bash by default. We could easily extend bashacks to support OS X version of Linux commands, as I did on 1f7efcf for bh_md5reanme() function. What do you say @wesleyleite? That may require us to remove some functions, but I suspect some functions like dumpmem() or asm2sc() are rarely used anyway. We must apply KISS methodology here. ;)