Hello, welcome to the Friday, October 16th, 2020 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Xavier today is talking about an interesting obfuscation technique that he has spotted in a sample of a Python remote access tool that he found on a virus total.

It looks like this tool is, well, yet again, another sort of a red team exercise that he probably sort of came across here.

The tool itself loads actually or contains as part of the code, bytecode that is then decompressed and fed to the Marshall module.

That's a module that will actually then allow you to execute that bytecode.

Now the tricky part here is of course from a reverse analysis point of view, how do you

actually then decompile this bytecode?

Python is not, well, strictly speaking, compiled, but bytecode is sort of somewhat compiled

representation of Python code.

Luckily, well, like there's the Marshall module to actually read bytecode. We have the uncompile module to actually do the opposite and decompile the bytecode, and

decompile the bytecode.

And with that, we get our Python code back, which was readable enough here in this case

for Xavier to do additional analysis on this particular malicious Python code tool.

Then of course we are still keeping an eye on the bad neighbor vulnerably as it's often called now. That's CVE

2020 16898, the Windows ICMPV6 router advertisement vulnerability. A couple more small details here.

No real sort of working exploit yet. And there's some reasons why it may be difficult to come by.

So first of all, again, this vulnerability has to be exploited on the local network, also to actually do remote code execution.

But according to a Rapid 7 block, it turns out you need also, and that's very typical because of various anti-exploit techniques that you find in

modern versions of Windows, you also need information leakage vulnerability to bypass some of

these techniques. While information leakage vulnerabilities are somewhat common in Windows,

nobody has sort of come forward yet that they actually got remote code execution, but there are a number of people that have stated they got the blue screen of death.

...