Don't Use CyberChef. Use This Instead.

Key Takeaways

cyers Chef is one awesome web-based application where you can do a ton of data manipulations hey altering the format doing whatever operations you might like for whatever purpose whether it's Capture the Flag whether it's just general research maybe cutting up some malware and malware analysis it could be anything and it is all client side it just runs JavaScript in your browser but I'll be the first to admit and I'll be honest I have usually poo pooed the use of cyers Chef because it's not a saved sort of Standalone solution that you could reuse or share with anyone else unless it's some long disgusting URL that you just sort of copy and paste around I have just always preferred maybe putting together a script in some language like python or bash or whatever so that you have a captured solution and it's not some temporary thing that just lives and dies in the browser but I know the value of cyberchef and it just being a Swiss army knife for whatever you want to do and I thought I might show you this tool called chy or sheppy I don't know however you want to call it here it is a python library with a handy CLI or command line interface that's aimed to mirror some of the capabilities of cybers Chef it is compatible with just about all the functionality of cybers cheef in a pure pythonic manner so this is awesome The Best of Both Worlds we'll dig into the documentation hey we can look through some examples but they showcase just how it might compare to cyberchef and look the code is super duper easy say you give it a file that you want to work with and you can do whatever operations you might might naturally already do within cyberchef they roll through their advantages hey you've got the command line interface support in scripting which is awesome extendable via plugins and all the sweet stuff but they do note some of the disadvantages maybe not every single thing that cyers Chef does sheppy can do as well and don't get me wrong you can do incredible things with cybers Chef one of my good friends and a past colleague MB research is always sharing these awesome YouTube videos or even tutorials tips and tricks on Twitter or X that all you can do with cyers Chef especially for the purpose of malware analysis in this video that I pulled up here he's digging into some of those Advanced cyers Chef techniques like flow control cryptography AES decryption regular Expressions registers all this awesome stuff and I thought maybe it would be cool to Showcase this just as well in the scripting language here using sheepy and putting it together in Python but hey big shout out to MB research credit work credit is due seriously if you haven't seen his stuff go check it out it's awesome so I am inside of my Cali Linux virtual machine hey we're up to version 20241 now so that's pretty exciting but look I could go ahead and install sheppy pip install sheppy I think you could add in extras as it noted in the documentation if you wanted to get a little bit more features and functionality I do already have it installed but that would be ready to rock for you if you wanted to install it just as well now MB did share the file or at least the hash of the Mau sample that he was looking at in that video if we dig into the comments here here we can see it is provided look at that this befc 2 whatever whatever whatever we can go track this down and pull it off virus total no secret sauce nothing special there hey we can just go ahead and paste in that hash and we can track it down this file had only nine detections but I could just go ahead and download this and I know not everyone has access to virus total Enterprise so look I'll check in with MB research if I can go ahead and slap this up on Mal share I don't believe that is available yet but let me check in and make sure I can share that with his permission so back on the command line I do have that downloaded in a malware directory this was the Nets supportor loader. vbs.org in Python I'm just in my home base let me open this up in my text editor Sublime Text and I'll show you what we are up against and again this is the exact same sample that MB shared in his video I just wanted to demo it with some scripting and using sheepy that command line python rendition of cyers Chef now now note there is a ton of data here A bunch of decimal numbers uh that end up being manipulated some way somehow we actually could see at the very top of the file it looks like it ends up subtracting out a qqt value and that's set to 787 and that is going to end up being returned as characters so this might be something that we could dig into if we pull all of this data out and subtract that value let's try to do that with sheppy now we could go ahead and use this just from the command line if I wanted to fire up any data that I wanted to supply I could just use sheppy and pass in that Nets support loader. vbs.tv it as our input but if I hit tab you can see all of the different things that sheppy or chy again however we want to call it could do and look it's just about all the same stuff that cyers Chef offers I keep pressing the down arrow to see all of these options here and I really recommend if you're interested and hey you want to play with this you do the very same just scroll through see what sweet stuff you might be able to do but all the same sort of States all the same sort of flow all the registers stuff that you could do for some more logic and advanced use of cyberchef is still in the mix here even if I scroll all the way down you'll get to see some green options for stuff that you could do just from the command line the CLI gives you a whole lot of capability to do a little bit more work with the state or history or even just where you are in the process of working with the data that you're working with right so say I could load a file and that would give me everything that's included in the file here but doing this from the command line again doesn't give me all that I want I'd love to be able to pull this in to a python script so let me exit out here and I'll create a new script to pull I don't know uh URLs referenced uh because we will just ultimately try to extract and carve out some of the different layers or the stages of that malware sample to eventually find different URLs or pieces that it pulls more post exploitation stuff from so now that I've got that created here I'll use my user bin environment Python 3 shebang line and let me go ahead and import sheppy one thing that we could do is do a simple from sheppy import Capital sheppy to get that object and if we wanted to dig into the documentation we could do that just as well but we saw in the GitHub repository look this is pretty easy we can just Supply a sheppy object here where we pass in our file that we wanted to work with that was in home Cali malware it was like net support loader or whatever I got to go track that down we could probably save that as another variable just as well let me say file name here and yeah that was Nets supportor loader. vbs.tv where maybe you wrap this in parentheses and that way you could just as easily do a DOT whatever on separate lines that will be kind of neat hey you could convert do whatever anything you might like in that sort of structure and style but you could just as easily work with the c variable or the object that you create and do some more procedural stuff with that just as well honestly I kind of prefer that route because that allows us to work with the registers or data that we might extract and pull out of it in the way that we might like calling back the data as we need it so let me do that I'll just start with a simple C load file and if I wanted to just print out C validate that it's working here I'll h contrl b on my keyboard and that will spit out all of the output everything that it has just read from the file now we can start to try and pull out this 787 value and subtract it from all of the stuff here in an automated way and I'll be honest I would recommend just as well hey scrolling through the documentation or trying to take a look at all the other functions that you might be able to use here if we wanted to search for anything like a register something that we might be able to use to save some data as we pull it out we could set a register with some functions or use the get register or just even the function the method register that will extract data from the input and store it in a register like a variable for us to hold and work with and of course if you wanted to you could just play an experiment with the command line interface trying to see hey if we could load a file and then maybe we wanted to use some of the other functions we could work with that and learn how those all work in an interactive way but the cool thing about creating a register is that we could use like a regular expression pattern to be able to track down find and extract info that we might like to use later on like that 787 number that we want to subtract from all the other variables or values in that big long array list so let me look for any regular expression with a word character multiple times using the plus operator there with an equal sign in the mix and then hey just trying to see is it actually going to have a decimal value set or digits or just numbers right could I find that and see what we pull out I could actually examine those if I wanted to check out my registers with an underscore there for C sheppy object let me see what this does Okay cool so we have one register defined dollar sign r0 very very similar to cyers shev syntax just as well well we're getting this qqt variable set to 787 now I just want to pull out that value on its own so I'm going to wrap this in parenthesis use that as a capture group it also found some other interesting one JF but can I pull that I can so now I have whenever I need it this uh get register function that I could call with the name dollar sign r0 and that should give me the uh sub value let me use that print that out to make sure that it is what it should be and it is now again you could just do this with python as you would like but I think it is kind of nice to have this whole Swiss Army knife readily available to you cuz when we get into some more complex stuff like oh just AES decryption or whatever it's nice to have a rapid syntax to be able to do that without pulling in all those other libraries and we've got look literally the Swiss army knife to do what we want because again Mau analysis is an awesome use case for this but you may just as well be using this for capture the flag firing off exploits beating up vulnerabilities and actually as we mentioned vulnerabilities look I'm trying my best with a whole lot of videos like these trying to cons consistently get free education out for you all but the only way that we can do that is with the help of sponsors and sponsorship so please allow me to tell you about sneak hey don't trust this artificial intelligence can't always be trusted to write secure code you've got to audit and review to make sure there aren't any vulnerabilities and you shouldn't use the same tool to both write and secure any AI generated code sneaks deep code AI takes a hybrid approach it combines symbolic and generative AI alongside machine learning methods and the expertise of sneak security researchers to provide the best code fixes without any hallucinations deep code AI makes it easy to find and fix security issues in AI generated code by scanning in real time and I know Chad GPT and GitHub co-pilot can speed up development time but they should be paired with security tools to make sure that your AI generated code is secure and that is where sneak comes in sneak makes securing apps just as easy as it is to generate Lightning Fast scans find vulnerabilities as you work and can generate a fix that you can Implement with just a single click sign up for sneak for free with my link below in the video description jh. live sneak a huge thanks to sneak for sponsoring this video okay so now that we've extracted that value let's pull all of those decimal things that we saw in that net loader VBS doxt all of this junk over here we want to be able to subtract that out and turn it into what would be in the asky range 255 cuz that's probably more bytes for a second stage or layer of the malware right so we could use a Rex search and look for maybe the regular Expressions prefix with r with an array starting here with the literal parenthesis so I'll backslash to escape that and then any decimal value over and over and over again because there could be multiple of them any digit here with a comma that follows and we'll wrap that in sort of a I don't know Square braces to match that in its own group in a sense and I want to get multiple of those will that work for me let me just see if I can print out the C value and let's see what we have here okay yeah looks like we're getting all of that out and a couple iterations of it to a certain extent do they do that multiple times in this do they have other arrays yeah they do okay uh I guess I'm just curious about the first one so we could pull that out and again we could do this pythonic way if we want print out that index at whatever value we could do that from the states as we see that should be returned out and that's literally a list of ones that have been returned for us granted it's just zero the only state that's present right now but maybe we just tune this to only return that single result with uh uh not using the plus sign there but actually say look maybe we'll just get a 100 or more of them so comma denoting that will continue onward will that return out well for us let me just print C that should give me just one one result now yeah looks like it does okay but I only want the decimal digits there so let me wrap that in parentheses there we go that should set that as a capture group so now I don't have the array and the opening closing parenthesis and with that we could now maybe split by a character I believe I could just specify the comma here to denote look this will now just have a ton of these in their own bite representations given a list oh but that does include our uh opening Square bra is kind of treating the actual list representation in python as part of the value so what we could do is before we split it up let's actually convert that list to a string list to Str Str how about that there we go now I don't have the prefix Square brace at the very top and we don't need to print the sub value anymore but that is one that we can know about now what I could do is just actually Loop through a whole list and that would be something that's really kind of cool because look as I have all of these items kind of in the que with sheppy and cybershift in a pythonic way I could actually call some other functions or use a call back for other methods like converting them all to an INT that's passed as a string but if you're curious we could check out the documentation let me do a quick search for that Loop list method that I'm referring to and take a look it is something that you can use looping over array and running a method on it now all of these values are just integers and since you are inside of python again you can sort of deviate whenever you want between the tooling that sheppy offers you and just sort of natural python syntax if we wanted some syntactic sugar maybe we could say hey let's get the state just the zero State that's present there that should just be what C naturally is as we saw down below yep that's all the integers there but if that is an array we could just as easily do some list comprehension if we wanted to maybe say um I for I in that value that's just the list but if I wanted to treat that as an integer and then subtract out our sheppy get register noting that we stored that value above in r0 uh that will be a string by default right because we didn't cast that earlier it does give us an error about the int and string so let me go ahead and cast that with wrapping parentheses of int uh if I run this now look at all these values that should be a normal natural asky decimal range that we could just convert into a character but we'll bring that into sheppy one more time if I were to change this print statement to a set state where I could at any point just change whatever the input that cyber Chef or sheppy is working with right now again seriously I can just print whatever I want see that's all here now we could convert that all to the decimal values or the character representation of the next stage of malware since that currently is a list we could go ahead and use c. looplist one more time and then say maybe from decimal right because that will be treated as the character and if I print all this out you can see they're all bytes now but hey the B prefix of all these letters what if I were to join these together I can just do a simple c.join and now we have what looks like another stage or sliver another layer of this malware let me copy all this out if I bring this to another file and zoom out a bit it looks like this is Powershell uh so I could probably try to set the syntax to Powershell within Sublime Text let me turn word wrap on just as well uh and if I wanted to clean this up just in a quick way hey let's replace all those semicolons with new lines spread that out a little bit and this is doing something kind of interesting right we have this data a a a AA whatever whatever Bas 64 encoded and then some other base 64 string but then it uses some other variables with AES or that encryption what is that advanced encryption standard uh I might be getting the acronym wrong there but it goes ahead uses this ECB mode with a key that's pulled from the variable that we saw above just base 64 here and then decrypts it and then looks like continues and Carries on its execution but again another stage of malware that we could cut up but cyers Chef sheppy all this tooling makes it super duper easy to cruise through pulling out and then decrypting this AES values so first things first let's try to extract the AE s key which we know is this value as that variable is referenced down below with the key that's defined here so let's try and pull that out it is base 64 encoded and there look to be about what is that 44 characters you can see it just barely down below 44 character selected so let's define a regular expression that we might use for base 64 syntax let's just say base 64 Rex could be any sort of value that's a to z a through capital Z 0 through 9 and they also include uh plus signs uh equal signs and forward slashes correct so let's try to have that stag and I don't know if that needs to be a regular expression right yet uh we'll find out let's try to now use our c. Rex search or maybe we can store that in a register right because we want to use that key for later once we do this operation and we can always pull that into another variable in Python so let's use a register let's say I want look for that hey let's use our format string in the mix our base 64 Rex and then normally where I would use the quantifiers for how many of these that I want knowing that's 44 because I'm using an F string or format string in Python I will need to add two curly braces here so kind of weird doesn't look like real Rex uh but look if I run that now can I check out my registers the underscore prefix and it's looking good we have a whole lot of these um r0o is pulling all of this stuff specific to the AES data itself over and over and over again but I am just wanting this last entry that's the key now in r27 can I make that a little bit more specific what could we hook on to there uh Untitled was the current tab for that value we could have the single quote surrounding it maybe that we'll use uh to to wrap that down let me use a single quote another single quote and then a semicolon but let me use parenthesis es to supply the capture group of just the base 64 rex that I want will that return that out for me yes perfect okay so r0 is what it should be R1 hasn't been clobbered yet for the register when we were looking for numbers previously but that at least tells us that now our C get register and that doesn't have a leading prefix underscore but that should just be our AES key and I can capture that as a variable in case I want to for that python use case but if I were to print that out I'll use my fstring to display nice and easy with the name oh keynot found in register oh that should be the actual r0 dollar sign syntax sorry I was getting State and register mixed up print that out look at that we have the value that we should for our base 64 encoded AES encryption key next we need to pull out the actual AES data itself and that's this DZ XB variable with all the base 64 data here so look we know that that's what's end up using trying to decrypt that so so you can see it ends up being decoded from base 64 and then used later on we could go ahead and just pull that out as well since the register lets us kind of keep something to the side of our not usual cyber Chef kind of recipe that we're building up here if we wanted to we could just keep cruising and adding it more and more to the pipeline with our Rex search as we had done previously but let's search for our regular Expressions that includes our base 64 Rex standard that we supplied and that should be as many of these as it get right what will that return can I print out the current value the state stored in sheppy right now oh there's a lot to it okay I guess that doesn't exactly help granted it does pull it out but it's not in an easy simple way it's not an index that I can readily get to and that might be variable for maybe other samples similar to this so could I just say look when we're looking for a dollar sign variable kind of being set to that uh any specific word elements that we'd like set equal to and that was wrapped in what single quotes yeah let me see if I could pull that WRA in single quotes multiple times ending semicolon will that if I capture strictly the base 64 Rex repeatedly will that return for me let's print the C value out yes it does so now our our zero here as we could see is that return value it is still in a list and it is even getting the other one so maybe we can truncate that maybe say more than hey 50 or more if we might like uh and we should wrap that in two curly braces right because we're using our F string now when I run this we pull only that value out and I want to be able to work with that and that alone since it's a list let me join that together to just pull the original value now this is super easy we can from base 64 to base 64 decode that it won't actually show it to us cuz now it's all raw bytes but if we wanted to you could use o to Output or dot out to be able to see that so let me go ahead and do c. out and I think that'll print it to the screen uh no we need to go ahead and yeah it is just a a value or variable uh that we'll call so c. out is what we will print and that should give us all of the real raw bytes here now if you notice at the very very top these are all the null bytes and that is the initialization Vector in this case for the AES encryption scheme we'll need to carve that out and it's worthwhile hey supplying that for as decryptor but if we actually go take a look at our documentation here say I were to search for AES decrypt it actually has this function that we could use super duper easy passing in the key that we might use the initialization Vector we might use and then whatever data that's in the pipeline to be decrypted we can pass in the mode we can pass in the key format base 64 for our key as we might have seen previously and since it has a default value for the initialization V ctor we don't really even need to care about it so I don't think we need to parse it out we can just drop those btes let's do that let me do a c. drop bytes and then I think you start from zero the very beginning and then 16 up to it and that should remove all of those leading null byes and bring us right to the data that is the actual encrypted stuff here now at this point we could basically do the AES decryption let me just try c. AES decrypt we know the key can be the value that we've already extracted out the initialization Vector we don't have to pass in because it uses the default for what we're already working with the mode in this case should be ECB as we saw that in the malware and the script here it specifies that but we do need to know that our key format is currently in base 64 not uh hex by default as we saw in the documentation now I got to say I ran into a whole lot of trouble with this because I kept getting a value error that the padding is incorrect and it didn't seem to matter look what I was using for the key or the initialization vector or the data all of it looked to be right but I kept getting this issue and I couldn't figure it out then I realized hey it's trying to call and reference some of the functions that are you know native and inherent to the encryption en coding mechanisms of sheppy but it didn't seem to have that error when Matt or MB research was showcasing this over on YouTube and everything that he kind of demoed so I was just scratching my head trying to figure out what is wrong here and I got to take a look back at cyberchef and if I were to actually go look for that aesd Crypt I noticed hey if you supplied values key IV change the format everything that you already had sort of an interface to with the sheppy library but it also had some other opportunities to use a different mode with ECB and no padding I didn't see MB research use that but it would seemingly work if we weren't getting an error about our padding being incorrect right asz again if I run this the error every single time is the padding is incorrect and I could see what it's trying to call in the error and traceback of this AES decrypt function for the encryption coding. py the source code behind the library where it would try to unpad and decrypt everything that was working with here but I don't want it to worry about padding in this case cuz that what was giving me the error so what I might try to do honestly is just look for this file and Patch it out let me say this is totally just an instance of a little hot fix temporary Band-Aid solution I think what we might like to do is probably put in a PR or I don't know maybe I'm just not smart maybe I'm misunderstanding I think this could be functionality for ECB no padding or other modes added to the library for sheppy but we've got everything that we need to be able to fix this problem if I were to literally locate that encryption and coding. file I'm using the M locate Library you might need to update your DB if you wanted to search across your file system like that but if I open that file up we could go to the exact line number that hey this error was coming from if I actually hit Control G within Sublime Text that was 933 and you can see look this is all the code and syntax that they use when you're working through this ECB mode decryption and it's funny you might have noticed in the documentation I think this was a bad copy paste well it in the pr right decrypt raw State encrypted with Dees or Des when we are talking about AES in this case so maybe a little bit of Easter egg and we can fix that up if we need to but look let's get back to this piece here the snippet of code where padding. unpad is honestly not what we need I just want to decrypt it so let me comment that line out and then remove that function call I swear I know it's weird I know it's dumb but that will give us what we need now if I save this file go back to what we were working with Tred to decrypt this no error and we have the data if we weren't positive what we were looking at hey we could convert it to hex we could represent it in any other way but this is if we actually look back at our code the original malware sample here it ends up using this as gzip data they decompress what would be a gzip stream in this case so we should do that just as well and thankfully cyberchef sheppy makes this super duper easy we could gzip decompress our current data and let's see if that works for me yeah now we're getting some semi- readable next stage and whole another layer of what we're up against on the sample so this is more Powers shell right that was invoked that was just kind of hey inline ran let me see if we could do the very same sort of setup here let's go put this in a another tab remove what we were working with previously set that syntax to Powershell and let's see if I could do a quick and easy replace semicolons to get at least a cursory idea of what this thing does cuz it looks like it has some functions and functionality that will I don't know stage some data have a couple convenience functions but they all use this another sort of obfuscation technique where they have these big numbers hiding the data that's meant to be behind it and this wva function looks to be over and over again used to decrypt that data or de skate it right wva wbva wva on all of these other locations so that function that we see divined right up here in this block here that takes this shy variable and then once again subtracts it as the character representation of all of those numbers digits here so that is 4274 we can do the exact same process extract that out and then subtract as we need to so you know the drill let's go ahead and create another register here where we could use a regular expression to search for in this case I'll look for the dollar sign anchor right declaring a variable and maybe that could be the start of a string or whatever uh where we have a word character that shy variable being set to another decimal value over and over again and hey that will have a semicolon to denote the end of it can I pull this out let's see what our c. registers are in a quick and easy way and I'll comment out the whole output so we don't need that right now looks like it doesn't seem to track it down hm what did I get wrong there let me look back at that sample oh there are no spaces in between okay so that is just readily supplying the value let's remove those spaces see if this gets it there we go r0o is now the value that we want 4274 that is working well for us and now we could go pull out all of the actual values that we wanted to try to deuse gate or subtract that value from just to see what that is just to be able to do some quick deobfuscation in that automated way so let me try to find any of those wva and again I don't know maybe that function would vary in other samples but if we just blindly look for any array allocated and defined with the at symbol parenthesis that could work for us but hey you know what it's worth for the Showcase let me try to use that reject search and look for R for regular Expressions given a opening parenthesis and I'll add an at sign there as the prefix of any data inside ins those parentheses where we have our decimal value the number over and over and over again and it could include a comma but look we want as many of those as we can get so let me wrap that in some Square braces and then use a plus sign to get as many as we can will this work for me if I print out C in this case C do out C it doesn't matter in this case it will pull out those values and you'll notice look this is an array this is a list and just ending our single quote for one item are multiple of these because we saw a couple different occurrences of those we see one here um above there's a second there's a third there's a fourth so I'm curious what those all could be and because we have multiple occurrences different items in the list what if we just simply Loop through it you could use a fork you could use some of the logic and flow that sheppy or cyberchef offers you but again whenever you want to you can just bail out bounce to power bounce to python whoa jeez I said po shell cuz I was staring at that for a little bit you can use whatever syntactic sugar or libraries or modules or whatever you want all inside of the script and since these are all stored just in our state variable and again that is a list of these elements we could do a little Loop if we wanted to we could do a fouri or Whatever item it doesn't matter in our C do state we'll note that each of those individually is one occurrence of those decimal values and look if we wanted to subtract through them we could we could do a I.S split given the comma there and then for each of the elements in there we can just say x we'll subtract out the value of the register that we saved just above which again could be a variable could be anything that we want that's the beauty of this let's do an X do or subtract sorry and look that should be an integer representation of the subtracting integer value of our register C.G register that should be our dollar sign r0 and that should give us now once again characters within the asy range and look since we're already here we could just make this super duper easy let's just wrap this as a character representation just plap that around in some more parentheses and then we could join all of this together as its own individual string and then we merge it all and now we have some of those URLs some of those other hey external locations or more obfuscated pieces that tells us hey potentially indicators of compromise or where it's grabbing its next stage other malware other things it could Branch off from and look I mean at this point we've been able to carve out some of those URLs or other interesting tidbits in the malware sample and if I like remove my comments Scrappy code that I've just been cutting up here look this is what maybe 30 lines plus or minus hey stuff that I was just kind of staging for convenience and for use and if you wanted to you could dig into anything else like we can pull out the whole sample unravel these layers and then find other things like look different locations on the file system that might be reference different names of artifacts that could be left behind the dotzip the what infos pad. exe those would be really cool to rapidly rip out with cyberchef or chy and I think doing it with python having it scripted in from the command line gives us at least a little bit more reusable kind of captured save and stored solution that can stand on its own and be shared with anyone anyway maybe it's just personal preference and maybe I am muddying the waters when you start to mix o sheppy cyers Chef use case whatever python syntax you want but I think it does give you a whole lot of power and I honestly just think that's a little bit nicer than the web browser web app interface that lives and dies from a URL I hope you thought that was cool I hope you're willing to give chy a try and please hey if you're interested please do give sneak a try Link in the video description huge thanks to all their support and sponsoring the channel and helping create videos just like these thank you so much for watching hope you enjoyed this video if you did please do all those YouTube algorithm things like comment subscribe and I'll see you in the next one