Vue lecture

Bypassing Detections with Command-Line Obfuscation

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity. This post demonstrates how command-line obfuscation, a shell-independent technique that exploits executables’ parsing “flaws”, can bypass such detections. It also introduces ArgFuscator, a new tool that documents obfuscation opportunities and generates obfuscated command lines.


Permalink
  •  

Cliget Catalog

Tout un ensemble d'outils en ligne de commande sour Linux (CLI)
Par exemple, jless pour parcourir un fichier JSON


name repo description
  ab  

a tool for benchmarking your Apache Hypertext Transfer Protocol (HTTP) server
  ag x

A code-searching tool similar to ack, but faster.
  amber x

a programming language transpiled into Bash Script
  arc x

Easily create & extract archives, and compress & decompress files of various formats
  aria2 x

lightweight multi-protocol & multi-source command-line download utility
  asciinema  

Record and share your terminal sessions
  asdf x

manage developement environments for many languages with multiple concurrent versions
  atuin x

Magical shell history
  axel x

Lightweight CLI download accelerator
  bat x

A cat(1) clone with syntax highlighting and Git integration
  benthos x

Fancy stream processing made operationally mundane
  bfs x

A breadth-first version of the UNIX find command
  bottom x

A customizable cross-platform graphical process/system monitor for the terminal
  br x

Get an overview of a directory, even a big one
  btop x

A monitor of resources
  chezmoi x

Manage your dotfiles across multiple diverse machines, securely
  claws x

websocket interactive client
  cliget  

install various tools in your user profile
  curl x

transferring data with URL syntax
  d2 x

a diagram scripting language that turns text to diagrams
  delta x

A syntax-highlighting pager for git, diff, grep, and blame output
  diagram x

CLI app to convert ASCII arts into hand drawn diagrams
  difft x

diff tool that compares files based on their syntax, not line-by-line
  diskonaut x

Terminal disk space navigator, disk tree-map
  dslcad x

a programming language & interpreter for building 3D models
  dt x

duct tape for your unix pipes
  dua x

View disk space usage and delete unwanted data, fast.
  duf x

Disk Usage/Free Utility - a better 'df' alternative
  exa x

modern replacement for ‘ls’ ; unmaintaned, prefer eza
  eza x

enhanced ls (active clone of exa)
  fail x

this entry will fail, for test purpose
  fd x

A simple, fast and user-friendly alternative to `find`
  feh x

feh is an X11 image viewer aimed mostly at console users
  fend x

Arbitrary-precision unit-aware calculator
  ffmpeg  

A complete, cross-platform solution to record, convert and stream audio and video
  fgron x

fast version of gron (use simdjson pull parser) also provide a fast jq for simple expression
  fio  

io benchmark
  flyscrap x

A standalone and scriptable web scraper in Go
  fq x

jq for binary formats - tool, language and decoders for working with binary and text formats
  fzf  

fuzzy search
  gat x

cat alternative written in Go
  glances  

a better top/htop
  glow x

markdown viewer
  gotty  

Share your terminal as a web application
  grex x

build regular expressions from samples
  gron x

flatter json to make it greppable
  grype x

A vulnerability scanner for container images and filesystems
  hey x

HTTP load generator, ApacheBench (ab) replacement
  hishtory x

Better Shell History
  htop x

an interactive process viewer
  httpie  

A simple yet powerful command-line HTTP and API testing client for the API era.
  httpx  

fully featured HTTP client for Python 3, which provides sync and async APIs, and support for both HTTP/1.1 and HTTP/2
  hurl x

run HTTP requests defined in a simple plain text format
  hx  

text editor, inspired by vim
  hyperfine x

benchmarking tool
  ijq  

interactive jq tool. Like jqplay for the commandline
  jaq x

A jq clone focussed on correctness, speed, and simplicity
  jc x

converts the output of popular command-line tools, file-types, and common strings to JSON
  jinja2 x

CLI for Jinja2
  jj x

A Git-compatible DVCS that is both simple and powerful
  jless x

a command-line JSON viewer designed for reading, exploring, and searching through JSON data
  jp x

dead simple terminal plots from JSON data
  jq x

json query
  jqp x

a TUI playground to experiment with jq
  just x

a handy way to save and run project-specific commands.
  k3d x

a lightweight wrapper to run k3s (Rancher Lab's minimal Kubernetes distribution) in docker.
  k3s x

Lightweight Kubernetes
  ko x

a simple, fast container image builder for Go applications.
  lazygit x

simple terminal UI for git commands
  lidecli x

Linux Desktop CLI - An unified command-line tool to interact with Desktop Environments and Window Managers
  litestream x

Streaming replication for SQLite.
  lnav x

An advanced log file viewer for the small-scale
  lsd x

next gen ls command
  mc  

minio client
  micro x

a modern and intuitive terminal-based text editor
  minify x

minifiers for web formats
  minijail x

sandboxing and containment tool used in ChromeOS and Android
  minijinja x

a powerful template engine for Rust with minimal dependencies based on the syntax and behavior of the Jinja2 template engine for Python
  mintotp x

generate TOTP from the terminal
  mintproxy  

interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.
  mlr x

Miller is like awk, sed, cut, join, and sort for name-indexed data such as CSV, TSV, and tabular JSON
  mosh x

Remote terminal application that allows roaming, supports intermittent connectivity, and provides intelligent local echo and line editing of user keystrokes.
  navi x

Interactive cheatsheet tool for the command-line
  ndcu  

a disk usage analyzer with an ncurses interface
  nnn x

n³ The unorthodox terminal file manager
  nvtop x

GPUs process monitoring for AMD, Intel and NVIDIA
  outrun x

Delegate execution of a local command to a remote machine.
  pagefind x

Static low-bandwidth search at scale
  pandoc x

Universal markup converter
  pet x

Simple command-line snippet manager
  pueue x

processes a queue of shell commands
  pup x

Parsing HTML at the command line
  pylufic  

Let's upload that file CLI
  qjs  

a small and embeddable Javascript engine.
  qr x

generate qr code
  qsv x

CSV sliced, diced & analyzed
  redo x

create reusable functions from your history in an interactive way
  relpipe  

Relational pipes are an open data format designed for streaming structured data between two processes.
  rg x

improved grep
  rlwrap x

A readline wrapper, with history and completion
  rq x

A tool for doing format transformation. Supports Avro, CBOR, JSON, MessagePack, Protocol Buffers, YAML, TOML, CSV
  sake x

a command runner for local and remote hosts
  scc x

Sloc, Cloc and Code: scc is a very fast accurate code counter with complexity calculations and COCOMO estimates
  sd x

intuitive find & replace CLI (sed alternative)
  semgrep x

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
  semgrepx x

xargs for semgrep
  sg x

fast and polyglot tool for code structural search, lint, rewriting at large scale
  sk x

general fuzzy finder ; like fzf
  slugify x

generate sluged version of input
  slurp  

put whole input in memory before processing ; this allow to overrite input file ; like `sed -i` ; prefer `sponge` from moreutils package
  so x

A terminal interface for Stack Overflow
  sqlite-utils  

manipulate sqlite db (ETL)
  stork x

full text search, index in terminal, query in terminal or embed in web page
  tab  

A modern text/number processing language for the shell.
  task x

A task runner / simpler Make alternative written in Go
  teip x

Highly efficient "Masking tape" for Shell
  termdbms x

A TUI for viewing and editing database files, CSV and SQLite.
  terminews x

RSS client in the terminal
  tqdm  

a better pv
  tre x

a better tree
  trivy x

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
  ttyd x

share terminal over the web
  typst  

A new markup-based typesetting system that is powerful and easy to learn.
  ugrep x

a more powerful, ultra fast, user-friendly, compatible grep
  up x

interactively edit pipe
  ups x

Command line tools for manipulating UPS patch files
  vd  

interactive multitool for tabular data
  vhs x

Write terminal GIFs as code for integration testing and demoing your CLI tools.
  viddy x

modern watch command, time machine and pager
  vuls x

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
  watchexec x

Executes commands in response to file modifications
  watchgod  

Watch a directory and execute a python function on changes.
  websocat x

client for web sockets, like netcat/curl/socat but for ws://
  wrk x

Modern HTTP benchmarking tool
  ww  

creates ephemeral pipes between computers
  xh x

Friendly and fast tool for sending HTTP requests
  xidel x

extract data from HTML/XML document
  xsv x

a fast CSV command line toolkit
  yazi x

terminal file manager
  yq x

yq is a portable command-line YAML, JSON, XML, CSV, TOML and properties processor
  yq-py x

Command-line YAML, XML, TOML processor - jq wrapper for YAML/XML/TOML documents
  z x

A smarter cd command. Supports all major shells, inspired by z and autojump.
  zee  

modern text editor for the terminal
  zf x

a commandline fuzzy finder designed for filtering filepaths
  zq x

process data with Zed queries
  zsync  

file transfer program ; based on rsync ; downloads only new parts of the file
Permalien
  •  

Note: *Tiny success*

Contexte : Je me suis relancé dans l'écriture. Pas au point de me refaire un NaNoWriMo, mais voilà, l'envie d'écrire un peu au km…
J'écris en markdown et je voulais conserver facilement les différentes versions ; alors merci fossil https://fossil-scm.org/home/doc/trunk/www/index.wiki .

Mais bon, faut reconnaître que c'est un peu velu.

Vu que je n'édite pas du code, mais du texte, mes lignes dépassent largement 80 caractères. Du coup les diff n'ont pas trop de sens.

Alors : 

./fossil diff --command meld

me permet de lancer meld dont j'adore l'interface


Permalien
  •  

Note: changement automatique de thème LXDE

Pour modifier le thème LXDE en ligne de commande (en mode bidouille), j'utilise cron :

0 0-8 * * * sed -i 's#sNet/ThemeName=.*#sNet/ThemeName=Adwaita-dark#' ~/.config/lxsession/LXDE/desktop.conf
0 9-20 * * * sed -i 's#sNet/ThemeName=.*#sNet/ThemeName=Adwaita#' ~/.config/lxsession/LXDE/desktop.conf
0 21-23 * * * sed -i 's#sNet/ThemeName=.*#sNet/ThemeName=Adwaita-dark#' ~/.config/lxsession/LXDE/desktop.conf

La nuit, soit de 21h jusqu'à 9h le lendemain, le thème sombre Adwaita sera utilisé.
Le reste du temps, ça sera le thème clair Adwaita.

Utiliser cron tel quel permet de s'assurer chaque heure que le thème souhaité est en cours d'utilisation. Sur un PC portable, c'est nécessaire surtout lorsque la machine risque de ne pas être allumée si on définit des job ne se lançant que deux fois dans la journée (par exemple à 9h puis 21h où la machine risque ne rater ces heures précises).

Enfin, paramétrer le navigateur pour utiliser un thème basé sur l'apparence de l'OS, idem pour tout service tiers comme GitHub.


Permalink
  •