Author: q38pvbsclbvx

Crowdmark Labeler

This is a Python package which automatically labels exams outputted by Crowdmark using the names of students provided in a pandas dataframe. This script depends on pdfrw, reportlab, and pandas. This is designed for assessments which have the “Enable automated matching” option enabled when booklets are generated in Crowdmark. The script will fill the name box that looks like this:

to make it look like this

Enviroment

You can install this package with:

pip install clabeler

CLI

This package can be called from the command line using the clabeler command. It has three required arguments and several optional arguments to set the output and to allow for different column labels in the inputted data.

usage: clabeler [-h] [-O OUTPUT] [--colfname COLFNAME] [--collname COLLNAME] [--colid COLID] labels booklets pagecount

Label exam PDFs from Crowdmark with names of students.

positional arguments:
  labels               path to a csv containing labels
  booklets             path to PDF of unlabeled exams
  pagecount            number of pages per exam

optional arguments:
  -h, --help           show this help message and exit
  -O OUTPUT            path to output unlabeled exams
  --colfname COLFNAME  column label for student's first name
  --collname COLLNAME  column label for student's last name
  --colid COLID        column label for student ID

Function

In addition to the command line interface, this package defines the function labelbooklets defined in the following way:

def labelbooklets(labels, pagecount, booklets="booklets.pdf", output="labeled_booklets.pdf", colfname="fname", collname="lname", colid="netID"):

the function takes the same arguments:

labels: A pandas dataframe containing the student names and netIDs
pagecount: The number of pages in each exam
booklets: The path to the exam booklets generated by Crowdmark; defaults to “booklets.pdf” in the working directory
output: The path to output the labeled booklets; defaults to “labeled_booklets.pdf” in the working directory
colfname: The name of your student first name column in your labels dataframe; defaults to “fname”
collname: The name of your student last name column in your labels dataframe; defaults to “lname”
colid: The name of your student ID column in your labels dataframe; defaults to “netID”

Example

An example is provided in the example folder. It contains:

an excel spreadsheet of fake names called labels.xlsx and an identical tab delimited file called labels.txt
a fake exam with a Crowdmark name box called booklets.pdf
a script that calls the labelbooklets function called example.py

The output of this example is the included labeled_booklets.pdf

License

Crowdmark Labeler is licensed under the MIT License.

FAQ

Why does the inserted text look different/bad on my device?

The script uses the font “Courier” when inserting text. While all versions of Acrobat reader, Windows, and Mac OSX have this font, not all readers and systems do (eg. Android). This is not a limitation unless you intend to print with a device that does not support this font.

Does this support documents with A4, legal, etc. paper?

No, it only supports letter paper at the moment. It should be easy to add other formats. Please create an issue (or pull request) if you would like to see any other paper size supported.

Malware Samples

This repository is intended to provide access to a wide variety of malicious files and other artifacts.

All of the samples are in a password protected ZIP archive using a password of: infected

Malware Analysis Exercises

In addition to providing artifacts from samples, I will regularly post malware anlaysis exercises. These exercises will cover a wide range of malware analysis topics and come with detailed solutions and walk-throughs.

Training PCAPs

PCAP files that exhibit specific network activity, to help with analysis, rule writing or whatever comes your way! Relevant capture filters are applied to help limit the scope of what is in the PCAP file.

-> Training PCAPs

Summary of Samples

2023-02-17: YouTube Video: OneNote Malware Trends – Investigating Script Execution that Leads to QuakBot
2023-02-07: YouTube Video: A .NET Downloader and an Open Directory – Unraveling the Encrypted Payload That Leads to CryptBot
2023-02-04: YouTube Video Series: Investigating NullMixer – Identifying Packing Techniques, Identifying and Unraveling ASPack, and Investigating Network Traffic with Suricata and Evebox
2023-01-23: YouTube Video: OneNote Malware – Tips and Tricks for Investigating OneNote Malware Used to Deliver AsyncRAT
2023-01-12: YouTube Video Series: Getting Started with Detect-It-Easy, Identifying Signs of Packing, Unpacking Vidar Stealer with Time-Travel Debugging
2023-01-02: YouTube Video: The Basics of Overlays in PE Files w/ DCRat
2022-12-15: YouTube: Getting Started with dnSpyEx – Unraveling a .NET Formbook Dropper
2022-03-26: Maldoc Templates – Heodo, AgentTesla, NanoCore, Loki, SilentBuilder, Hancitor, NONE, Quakbot
2022-03-12: Maldoc Templates – Heodo, Formbook, AgentTesla, Loki, NanoCore, NONE, Quakbot
2022-03-05: Maldoc Templates – OskiStealer, RemcosRAT, Loki, NONE, NanoCore, Quakbot, SnakeKeylogger, Formbook, Heodo
2022-02-26: Maldoc Templates – SilentBuilder, Heodo, Quakbot, NanoCore, NONE, Loki
2022-01-22: Maldoc Templates – QuasarRAT, SnakeKeylogger, NONE, Formbook, Loki, AveMariaRAT, AsyncRAT, SilentBuilder, GuLoader, Heodo
2021-12-31: Maldoc Templates – NONE, SnakeKeylogger, QuasarRAT, Quakbot, IcedID
2021-12-25: Maldoc Templates – TrickBot, Dridex, AsyncRAT, SnakeKeylogger, QuasarRAT, RemcosRAT, SilentBuilder, Quakbot, AveMariaRAT, NONE, Heodo, BitRAT, BazaLoader
2021-12-22: Excel document uses VBA macros to execute cmd.exe to run Powershell script -> Downloads WarzoneRAT over HTTPS
2021-12-17: Maldoc Templates – Maldoc Templates – Quakbot, Formbook, IcedID, SilentBuilder, Dridex, Loki, AgentTesla, AsyncRAT, QuasarRAT, NONE
2021-12-16: Excel document uses XLM macros to execute cmd.exe to download/run MSHTA script -> Downloads Powershell script -> Downloads Emotet DLL
2021-12-11: Maldoc Templates – Heodo, Loki, BluStealer, Dridex, Quakbot, NONE, IcedID, AgentTesla, TrickBot
2021-12-04: Maldoc Templates – Heodo, Quakbot, Loki, Hancitor, SilentBuilder, NONE, Formbook, Dridex, BitRAT, IcedID
2021-11-17: BlackNET 3.7.0.0 source code found in an opendir
2021-11-13: Word Document uses Packager Shell Object to Execute VBScript, Run Powershell to Download AgentTesla
2021-10-30: Maldoc Templates – AsyncRAT, Quakbot, AveMariaRAT, Formbook, Loki, TrickBot, AgentTesla, SnakeKeylogger, ArkeiStealer, Hancitor, NONE, Dridex
2021-10-15: Word downloads Formbook EXE
2021-09-27: Excel drops Qakbot (qbot) EXE
2021-08-28: Maldoc Templates – BazaLoader, Loki, NONE, Hancitor, CobaltStrike, Dridex, RedLineStealer
2021-08-07: Maldoc Templates – a310Logger, NONE, AZORult, BuerLoader, Loki, Formbook, TrickBot, Hancitor
2021-07-17: Maldoc Templates – IcedID, Gozi, RustyLoader, NONE, njrat, Loki, CobaltStrike, Formbook, Dridex, TrickBot
2021-07-03: Maldoc Templates – Quakbot, TrickBot, FickerStealer, Dridex, AgentTesla, NONE
2021-06-19: Maldoc Templates – NONE, Adwind, Quakbot, AgentTesla, IcedID, Formbook, Gozi, TrickBot, SnakeKeylogger, Dridex
2021-06-12: Maldoc Templates – NONE, Dridex, TrickBot, BazaLoader, NanoCore, Loki, AsyncRAT, IcedID, SnakeKeylogger, njrat, SilentBuilder, Formbook, RemcosRAT, OskiStealer, Gozi, Quakbot
2021-06-12: Excel drops TransparentTribe (.NET) with CNC Check-in
2021-06-09: Excel downloads AsyncRAT
2021-06-05: Maldoc Templates – Adwind, NONE, Formbook, IcedID, Dridex, RemcosRAT, Loki, DoubleBack, AgentTesla, SnakeKeylogger, Gozi, Quakbot, njrat
2021-05-22: Maldoc Templates – Dridex, NONE, Adwind, RemcosRAT, TrickBot, AgentTesla, FickerStealer, IcedID, Loki, BazaLoader, SilentBuilder, Hancitor, Quakbot
2021-05-17: Diamondfox opendir w/ several modules and documentation
2021-05-15: Maldoc Templates – NONE, njrat, TrickBot, ArkeiStealer, CrimsonRAT, SilentBuilder, Quakbot, Dridex, SnakeKeylogger, IcedID, Adwind, RedLineStealer, AZORult, Hancitor, AgentTesla, Loki
2021-05-08: Maldoc Templates – IcedID, SilentBuilder, AgentTesla, BuerLoader, TrickBot, Loki, ArkeiStealer, RaccoonStealer, AsyncRAT, NONE, Quakbot, Dridex, Hancitor
2021-04-30: Maldoc Templates – SnakeKeylogger, Dridex, Quakbot, AgentTesla, NONE, Hancitor, Loki, TrickBot, SilentBuilder, Heodo, njrat, Formbook, Gozi, AZORult
2021-04-24: Maldoc Templates – April 19 – April 23: Dridex, AgentTesla, IcedID, NONE, Quakbot, RedLineStealer, Loki, Gozi, TrickBot
2021-04-21: Java Network Launch Protocol (jnlp) / JAR, Downloads Gozi DLL
2021-04-20: Word Document Uses Template Injection that downloads an RTF Document, Exploits CVE-2017-11882 to Drop Nanocore
2021-04-17: Maldoc Templates – April 12 – April 16: Formbook, TrickBot, Dridex, SilentBuilder, AgentTesla, SnakeKeylogger, njrat, Quakbot, AZORult, Hancitor, Heodo, Loki, Gozi
2021-04-10: Maldoc Templates – April 05 – April 09: TrickBot, IcedID, NONE, BuerLoader, Formbook, Heodo, Hancitor, SilentBuilder, Dridex, Gozi
2021-04-08: Purple Fox Exploit Kit Activity – Landing Page and Other Artifacts
2021-04-03: Maldoc Templates – March 29 – April 02: Gozi, BuerLoader, AgentTesla, BitRAT, IcedID, Loki, SilentBuilder, NONE, gozi, Dridex, Quakbot
2021-04-01: Excel drops IcedId – Uses VBA macros to execute Excel 4 macros in hidden sheet/hidden columns
2021-03-31: QBot Open directory w/ Access to Proxy Scripts, .HTACCESS File
2021-03-26: Rig EK, unalbe to obtain payload(s)
2021-03-27: Maldoc Templates – March 22 – 22, 2021: AgentTesla, SilentBuilder, IcedID, AsyncRAT, Loki, Dridex, Formbook, NanoCore, TrickBot, BazaLoader, Quakbot, LemonDuck
2021-03-16: Maldoc Templates – March 15 – 19, 2021: Dridex, TrickBot, QuakBot, AgentTesla, SilentBuilder, Gozi, IcedID, Hancitor
2021-03-13: Maldoc Templates – March 08 – 12, 2021: BuerLoader, SilentBuilder, TrickBot, Gozi, AgentTesla, BazaLoader, NetWire, AveMariaRAT, Loki, NONE, Quakbot, IcedID, ZLoader, Dridex, BazarCall
2021-03-06: Maldoc Templates – March 01 – 05 – Gozi, BazarCall, SilentBuilder, Quakbot, Loki, CobaltStrike, SnakeKeylogger, TrickBot, AgentTesla, Dridex, NONE, Hancitor
2021-02-27: Maldoc Templates for February 22 – 26, 2021: SilentBuilder, TrickBot, Hancitor, Dridex, AsyncRAT, Quakbot, MassLogger, Formbook
2021-02-20: Maldoct Templates for February 15 – 19: NetWire, TrickBot, SilentBuilder, AgentTesla, AveMariaRAT, SnakeKeylogger, njrat, NONE, ZLoader, Dridex, Loki, Quakbot, RemcosRAT, FickerStealer
2021-02-13: Maldoc Templates for February 08 – 12, 4 groups: Dridex, Heodo/Emotet, Unknown
2021-02-06: Maldoc templates for Feb 01 – 05, 3 groups: SilentBuilder and Emotet
2021-01-30: Maldoc templates for Jan 25 – 29, 2 groups: Emotet, Unknown
2021-01-30: Maldoc templates for Jan 18 – 22, 4 groups: Emotet, Dridex
2021-01-23: Maldoc templates for Jan 11 – 15, 8 groups: Emotet, Dridex
2021-01-15: Excel drops Qakbot (qbot) DLL
2021-01-15: Word doc w/ embedded Hancitor loader, IP check and C2 activity
2021-01-09: Maldoc templates for Jan 04 – 08, 6 groups: Emotet, Trickbot, Dridex
2021-01-07: Excel doc drops Raccoon
2021-01-02: Maldoc templates for Dec 28 – Jan 01, 3 groups: Emotet, Dridex, Emotet
2020-12-26: Maldoc templates Dec 21 – Dec 25, 11 groups: Emotet, Dridex and 1 unknown
2020-12-19: Maldoc templates Dec 14 – Dec 18. 17 groups: Dridex, TA505 and Emotet
2020-12-15: Maldoc templates Dec 07 – Dec 11. 7 groups: 1 – 5 Dridex, 6 BitRat, 7 Emotet
2020-12-15: Excel Decodes DLL (Campo Loader) w/ Certutil for next stage retrieval – includes analysis on YouTube and IDA Plugin for String Deobfuscation
2020-12-05: Maldoc templates for the week of Nov 30 – Dec 04
2020-11-28: Maldoc templates for the week of Nov 23 – Nov 27
2020-11-27: Excel drops Qakbot (qbot) DLL
2020-11-24: FickerStealer w/ IP check
2020-11-24: Word document drops Smokeloader
2020-11-24: Word document drops Dridex DLL w/ Check-In
2020-11-21: Maldoc templates for the week of Nov 16 – Nov 20
2020-11-14: Maldoc templates for the week of Nov 09 – Nov 13
2020-11-10: Emotet maldoc – Embedded DLL and CertUtil for Base64 Decoding, includes analysis on YouTube
2020-11-07: Maldoc templates for the week of Nov 02 – Nov 06
2020-10-31: Maldoc templates for the week of Oct 26 – Oct 30
2020-10-29: Excel doc drops Qakbot
2020-10-24: Maldoc templates for the week of Oct 19 – Oct 23
2020-10-16: Emotet templates for the week of Oct 12 – Oct 16
2020-10-09: Emotet templates for the week of Oct 05 – Oct 09
2020-10-02: Emotet templates for the week of Sept 28 – Oct 02
2020-10-05: Word doc uses Lua for follow-on activity
2020-09-17: Word doc drops Betabot (Uses CVE-2017-11882)
2020-08-29: ArkeiStealer sample with data exfil
2020-08-21: Azorult drops AsyncRat, REMCOS possible others
2020-08-15: Cerber ransomware with check-in
2020-08-02: Raccoon stealer drops crypto-currency miner
2020-07-24: Amadey bot with payloads and check-in
2020-07-24: Raccoon stealer w/ CnC check-in
2020-07-19: Excel doc drops GuLoader
2020-07-13: Word doc drops Hancitor loader
2020-06-29: Trickbot version 1000512 and gtag ono51, drops new nwormDll64 module – includes 12hour PCAP
2020-06-29: Two Excel docs that drop Netwire, includes C2 check-ins
2020-06-20: ZLoader with chekc-in
2020-06-01: Excel doc drops Guloader
2020-06-01: IcedID with Image used for Steganography
2020-05-29: Maldoc uses template injection for macro execution
2020-05-13: Gamma Ransomware with HTTP check-in
2020-05-13: Cryptbot sample
2020-05-13: Danabot sample with beaconing
2020-05-04: Trickbot w/ GTAG tt002 and version 1000509, 12 hour PCAP w/ beacons
2020-04-26: Gomorrah stealer (.NET binary)
2020-04-16: Trickbot w/ GTAG MAN6 and version 1000507 – Uses revocation.txt config
2020-04-16: AgentTesla data exfil through SMTP
2020-04-14: Vidar sample with data exfil via ZIP file
2020-04-13: Azorult drops Blackout Ransomware
2020-04-04: Ave-Maria/Warzon RAT
2020-03-27: Word drops Ursnif through MSHTA.exe
2020-03-26: Word drops Banload banking trojan
2020-03-26: Excel drops AgentTesla
2020-03-26: Word drops IcedId
2020-03-25: NanoCore sample with dumped plugins (.NET assemblies)
2020-03-24: Blue Botnet
2020-03-19: Formbook
2020-03-14: Excel drops LokiBot
2020-02-29: Buer loader
2020-02-18: Remcos
2020-02-13: Turkojan
2016-02-28: Angler EK from Alexu.edu.eg

Samples from Trainings and Workshops

Sample files and other artifacts from public trainings, talks and workshops.

2021

2021-01-13: FloCon – Workshop: Intrusion Analysis and Threat Hunting with Open Source Tools – Demo files and Workshop on YouTube
2021-08-08: DefCon 29 Workshop – Modern Malware Analysis for Threat Hunters
2021-06: R0 Virtual Vegas: Malware Unpacking
2021-08-26: HITBLab: Modern Malware Analysis for Threat Hunters (HITB Singapore)

2020

2020-11-19: Hack-in-the-Box Cyber Week Workshop: Analyzing Malicious Word and Excel Documents – Demo files and Workshop on YouTube

Maldocs

Will contain Office documents identified to be used to distribute malware based on organizing folder structure. For example, the emotet folder will contain maldocs identified to have dropped Emotet. These samples are organized by year/month that I obtained and executed them – this may deviate slightly from when they were first discovered in the wild (for example, first submission date on VirusTotal).

To the max extend possible I will also include associated PCAPs. PCAPs may contain the resuling Emotet binary that was dropped, as well as follow-on C2 communication. However, I can not guarantee that each PCAP will contain this full sequence of events.

Current maldocs include:

AgentTesla
Banload
Emotet
Hancitor
IcedId
Lokibot
Trickbot
Unknown

Maldoc Templates

The image analysis script used to generate maldoc image graphs can be found at: https://github.com/jstrosch/graph-maldoc-similar-images

Memory Dumps

Will contain full VM memory and individual process memory dumps from malware samples. Most will come from dumpming memory via Cuckoo Sandox. Due to the size of the memory dumps, links to an archived version of them are provided for download. Current memory dumps include:

Emotet
LokiBot

Binaries

This will contain binaries (i.e. PE/.NET, Java, etc) from known malware families. Currently, this archive contains samples from:

Agenttesla
Ave Maria / Warzone RAT
Azorult
Blue Botnet
Buer Loader
Dridex
Emotet
Gandcrab
Lokibot
Nanocore
Remcos
Socelars
Trickbot
Troldesh
Turkojan
Vidar

Warnings and Disclaimers

This repository is intended for educational and research purposes. The samples provided here are all real-world malware, please handle with all of the necessary caution.

Please note, all samples/artifacts will be in a password-protected archive using a password of: infected

TODO App

Live Link- https://todo-app-codemen.netlify.app/

Description

The TODO App is a simple yet powerful frontend application built to manage employee profiles and their associated tasks. The app leverages browser local storage for data persistence and includes functionalities like CRUD operations, search, and filtering.

Features

1. Employee Management

Create Employee Profile: Add employees with details such as:
- Name
- Employee ID
- Designation
- Email Address
- Phone Number
View Employee List: Display a searchable list of employees.
Preview Employee Profile: View detailed information about an employee.
Update Employee Profile: Edit existing employee details.
Delete Employee Profile: Remove an employee from the system.

2. Task Assignment

Assign Task:
- Select an available employee from a dropdown list.
- Add tasks under the selected employee.
Task Reassignment: Reassign a task to another employee.

3. Task Management

Task List: View all tasks associated with employees.
Update Task: Edit the task description, status, or assigned employee.
Delete Task: Remove tasks from the list.
Search and Filter:
- Search tasks by keywords.
- Filter tasks by completion status (Complete or Incomplete).

4. Notifications

Toast Notifications:
- Display success, error, or informational messages for actions like creating, updating, or deleting employees and tasks.

5. Data Persistence

All data (employees and tasks) is stored in the browser’s local storage for persistent use across sessions.

Technologies Used

Frontend: React.js, Tailwind CSS
Libraries:
- React Router for navigation
- React Toastify for toast notifications
- React Icons

Installation

Prerequisites

A modern web browser to run the application.
Node.js (only for running the development server).
npm

Steps

Clone the repository:

git clone https://github.com/Monwar23/TODO-App

Navigate to the project directory:
```
cd TODO-App
```
Install the dependencies:
```
npm install
```
Running the App
```
npm run dev  
```

measure_text_entry_performance

MeasureTextEntryPerformance is a Python library designed to measure and record text entry performance.
It tracks typing activities, including the addition of new inputs, deletions, and the end of phrases.
The library exports the data in a structured format for further analysis.

Usage

To measure the performance of text entry:

Initialize the MeasureTextEntryPerformance class with a set of phrases.
Call the add_new_input method whenever there’s a new input.
Call the add_delete method when a deletion occurs.
Call the end_phrase method when a phrase is completed.
Use the export method to retrieve the recorded data in a structured format.

example

# Initialize the library with a set of phrases
mtep = MeasureTextEntryPerformance(["hello world", "python is great"])

# simulates ambiguous enty
mtep.add_new_input(None)
mtep.add_new_input(None)
mtep.add_new_input("hello")

mtep.add_new_input(None)
mtep.add_new_input(None)
mtep.add_new_input("world")

mtep.end_phrase("hello world")


mtep.add_new_input(None)
mtep.add_new_input(None)
mtep.add_new_input("python")

mtep.add_new_input(None)
mtep.add_new_input(None)
mtep.add_new_input("is")

mtep.add_new_input(None)
mtep.add_new_input(None)
mtep.add_delete(1)
mtep.add_new_input(None)
mtep.add_new_input("great")

mtep.end_phrase("python is great")


# Retrieve recorded data
data = mtep.export()
print(data)

exported data

[
  {
    "phrase": "hello world",
    "phrase_number": 0,
    "start_time": 0000000000.0000000,
    "end_time": 0000000000.0000000,
    "entered_phrase": "hello world",
    "events": [
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": "hello"
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": "world"
      },
      {
        "event_type": "end_phrase",
        "timestamp": 0000000000.0000000,
        "entered_phrase": "hello world"
      }
    ]
  },
  {
    "phrase": "python is great",
    "phrase_number": 1,
    "start_time": 0000000000.0000000,
    "end_time": 0000000000.0000000,
    "entered_phrase": "python is great",
    "events": [
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": "python"
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": "is"
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "delete",
        "timestamp": 0000000000.0000000,
        "deleted_length": 1
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": ""
      },
      {
        "event_type": "add_new_input",
        "timestamp": 0000000000.0000000,
        "added_input": "great"
      },
      {
        "event_type": "end_phrase",
        "timestamp": 0000000000.0000000,
        "entered_phrase": "python is great"
      }
    ]
  }
]

initramfs-cryptsetup-keyscript-usb

Keyscript for decrypting a full-encrypted luks disk using a usb/mmc storage.

If the decryption process fails you be asked for a password at boot, like usual.

Prerequisites

A Linux distribution with an initramfs system.
If you use a complete systemd init you might want to use a PasswordAgent to achieve the same goal.

Usage

Create a hidden “key” on your USB Memory device

Read the start of your device partition

sudo fdisk -l /dev/sdb

Fill the free space with random stuff. Set count to the value of of your first partion – 2

sudo dd if=/dev/urandom of=/dev/sdb bs=512 seek=1 count=60

Add the key to your LUKS Partition

sudo dd if=/dev/sdb bs=512 skip=1 count=4 > tempKeyFile.bin
sudo cryptsetup luksAddKey /dev/sda5 tempKeyFile.bin
sudo rm -f tempKeyFile.bin

Fill the decryptkeydevice.conf File with the details of your key you createt in Step 1 and 2 and put it to

/etc/decryptkeydevice/decryptkeydevice.conf

Add path to keyscript.sh to /etc/crypttab and make in executeable

sudo chmod +x /etc/decryptkeydevice/decryptkeydevice_keyscript.sh

Copy decryptkeydevice.hook to

/etc/initramfs-tools/hooks/decryptkeydevice.hook

and make it executeable in the same way as described in Step 4

Finally Update your initramfs. If you see no warnings you should be able to reboot.

sudo update-initramfs -k `uname -r` -c

License

CC-BY-NC-SA 2.0 de

Due to the License of the original source.
May not be nothworthy, because the level of creativity is not high enough or the original authors provided a different license.

Source

Original Source: https://wiki.ubuntuusers.de/System_verschl%C3%BCsseln/Entschl%C3%BCsseln_mit_einem_USB-Schl%C3%BCssel/

Author: q38pvbsclbvx

crowdmark-labeler

Crowdmark Labeler

Enviroment

CLI

Function

Example

License

FAQ

malware-samples

Malware Samples

Malware Analysis Exercises

2022

2021

2020

Training PCAPs

Summary of Samples

Samples from Trainings and Workshops

Maldocs

Maldoc Templates

Memory Dumps

Binaries

Warnings and Disclaimers

TODO-App

TODO App

Live Link- https://todo-app-codemen.netlify.app/

Description

Features

1. Employee Management

2. Task Assignment

3. Task Management

4. Notifications

5. Data Persistence

Technologies Used

Installation

Prerequisites

Steps

measure_text_entry_performance

measure_text_entry_performance

Usage

example

exported data

initramfs-cryptsetup-keyscript-usb

initramfs-cryptsetup-keyscript-usb

Prerequisites

Usage

License

Source