5 ms·

Offensive Nim

106 points by weitzj 4y ago

tgv 4y ago
It would help if the submitter explained what this was about. What's so offensive about calling 'MessageBox WinApi without using the Winim library'? Or how it is a weapon: is it going to help Ukraine drive Russia back or help Putin achieve his dreams of a Greater Russia?
- deleted 4y ago
  [deleted]
- roblabla 4y ago
  "Offensive <Language>" is about using a programming language for red teams. Stuff like writing malware, privilege escalation, antivirus evasion, etc... The "weaponization" here is about using the language for malicious apps. There's nothing offensive about the MessageBox example, it's mostly showing how to use Win32 APIs in various ways, which is going to be necessary for a lot of the more malicious stuff, such as calling VirtualAllocEx to allocate executable code[1]. I doubt this will help either Russia nor Ukraine. [0]: https://github.com/trickster0/OffensiveRust https://github.com/trickster0/OffensiveRust [1]: https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/dynamic_shellcode_local_inject_bin.nim https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/...
  - cb321 4y ago
    I think @tgv was A) trying to be funny/sarcastic, and B) using 2 different definitions of "offensive" (of which the dictionary has a few, actually [0])..all to make the point that the meaning of "offensive nim" is somewhat ambiguous without more context. EDIT: @tgv might have been more understood himself had he said "title should be changed to 'Offensive (Red Team) Nim'" or something along those lines. [0] https://www.dictionary.com/browse/offensive https://www.dictionary.com/browse/offensive
    - tgv 4y ago
      I was not trying to be funny. I just didn't understand it, and had no idea this was a regular term. There are two common meanings for offensive, and one of them matches "weaponize", but none of them fitted the README. I did try to avoid sounding condescending or negative by giving light-hearted examples in the only context I knew for those words.
      - cb321 4y ago
        Ah. Thanks for the clarification and apologies for my own misinterpretation. EDIT: FWIW I think in this case the origin is just "opposite of 'defensive'" as in "offense & defense" in sports..red & blue teams, etc.
synergy20 4y ago
nim truly deserves more love,it is my lang to pick up this year,safe c++ with python syntax,great combination to me,and it is also mature,cross platform,production ready.
- weitzj 4y ago
  Yeah. That is my goal as well. I struggled choosing between learning Rust, Zig, Ocaml or F# and landed at Nim Given the compilation step to C allows nice FFI and using all kinds of compilers
  - cb321 4y ago
    I think it's a pretty nice prog.lang (PL). You may be very happy. Though nothing is perfect, there is much to recommend it. By now I've written over 150 command-line tools with https://github.com/c-blake/cligen https://github.com/c-blake/cligen . A few are at https://github.com/c-blake/bu https://github.com/c-blake/bu or https://github.com/c-blake/nio https://github.com/c-blake/nio { screw 1970s COBOL-esque SQL ;-) } or in their own repos. I use quite a few every day..(EDIT: some even dozens of times per day - "production" is more an aspect of code than a PL itself - e.g., is poorly tested Python code "production"). If it helps, I like to use the "mob branch" [0] of TinyCC/tcc [1] for really fast builds in debugging mode, but this may only work if you toss `@if tcc: mm:markAndSweep @end` or similar in your nim.cfg. Then I have a little `@if r: ...` so I can say `nim c -d:r foo` for a release build with gcc/whatever. [0] https://repo.or.cz/w/tinycc.git https://repo.or.cz/w/tinycc.git [1] https://en.wikipedia.org/wiki/Tiny_C_Compiler https://en.wikipedia.org/wiki/Tiny_C_Compiler
    - sva_ 4y ago
      > https://github.com/c-blake/bu https://github.com/c-blake/bu That's quite an impressive amount of cmdline tools.
      - cb321 4y ago
        Thanks. Just a fraction published as I try to motivate/document/clean up before doing so. I kind of live at the Zsh prompt and tend to fill gaps as I find them & iterate on that. Also, if you think of an idea for more, please feel free to raise an issue - maybe it's already done somewhere. Or even better, use it as an excuse to learn Nim and file a PR or even better do your own repo. :)
cb321 4y ago
Not sure what program initially seemed malicious to the makers of anti-virus software, but work like this combined with laziness/unresponsiveness of AV software makers Re: fixing false positives can create trouble for almost any small userbase programming language. Many mentions with Nim can be seen at https://forum.nim-lang.org/search?q=av https://forum.nim-lang.org/search?q=av (and probably other queries as well). I think at some point the binary executable for the Nim compiler itself was flagged. :-(
luma 4y ago
Is type safety a critical concern when developing red team tooling? What exactly is the threat model?
- V1ndaar 4y ago
  Well, type safety is not only relevant for security related things. It plain and simply makes working with a language much more pleasant and less error prone. Less time wasted debugging code etc.
  - spijdar 4y ago
    I'll add that beyond strictly "offensive" tooling, Nim has more or less replaced Python in my toolkit for things like reimplementing custom encryption routines during an engagement. Static types are a huge benefit in staying sane, IMO, especially when doing bit/structure twiddling. Sure, there are ways of accomplishing this is dynamic languages, but Nim is both fast and fun to use.
    - cb321 4y ago
      I would say the value of distinction is related to how many things you distinguish..Re-stated, the likelihood you mix things up (and thus the value of a checker) depends upon how many things. Perhaps nigh tautological, but a rapid corollary of this is that if everything is a string/line in a file, the distinction is less valuable than if you have many kinds of CPU register (say). In fact, there is even https://en.wikipedia.org/wiki/Typed_assembly_language https://en.wikipedia.org/wiki/Typed_assembly_language .
      - gavinray 4y ago
        Typed ASM sounds neat, I googled for it but what references I found were quite dated. Does anyone know of a working implementation you can play with today?
    - freedomben 4y ago
      How common would you say it is for red teamers to use Nim over Python?

106 points by weitzj 4y ago

tgv 4y ago

It would help if the submitter explained what this was about. What's so offensive about calling 'MessageBox WinApi without using the Winim library'? Or how it is a weapon: is it going to help Ukraine drive Russia back or help Putin achieve his dreams of a Greater Russia?

deleted 4y ago
[deleted]
roblabla 4y ago
"Offensive <Language>" is about using a programming language for red teams. Stuff like writing malware, privilege escalation, antivirus evasion, etc... The "weaponization" here is about using the language for malicious apps. There's nothing offensive about the MessageBox example, it's mostly showing how to use Win32 APIs in various ways, which is going to be necessary for a lot of the more malicious stuff, such as calling VirtualAllocEx to allocate executable code[1]. I doubt this will help either Russia nor Ukraine. [0]: https://github.com/trickster0/OffensiveRust https://github.com/trickster0/OffensiveRust [1]: https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/dynamic_shellcode_local_inject_bin.nim https://github.com/byt3bl33d3r/OffensiveNim/blob/master/src/...
- cb321 4y ago
  I think @tgv was A) trying to be funny/sarcastic, and B) using 2 different definitions of "offensive" (of which the dictionary has a few, actually [0])..all to make the point that the meaning of "offensive nim" is somewhat ambiguous without more context. EDIT: @tgv might have been more understood himself had he said "title should be changed to 'Offensive (Red Team) Nim'" or something along those lines. [0] https://www.dictionary.com/browse/offensive https://www.dictionary.com/browse/offensive
  - tgv 4y ago
    I was not trying to be funny. I just didn't understand it, and had no idea this was a regular term. There are two common meanings for offensive, and one of them matches "weaponize", but none of them fitted the README. I did try to avoid sounding condescending or negative by giving light-hearted examples in the only context I knew for those words.
    - cb321 4y ago
      Ah. Thanks for the clarification and apologies for my own misinterpretation. EDIT: FWIW I think in this case the origin is just "opposite of 'defensive'" as in "offense & defense" in sports..red & blue teams, etc.

synergy20 4y ago

nim truly deserves more love,it is my lang to pick up this year,safe c++ with python syntax,great combination to me,and it is also mature,cross platform,production ready.

weitzj 4y ago
Yeah. That is my goal as well. I struggled choosing between learning Rust, Zig, Ocaml or F# and landed at Nim Given the compilation step to C allows nice FFI and using all kinds of compilers
- cb321 4y ago
  I think it's a pretty nice prog.lang (PL). You may be very happy. Though nothing is perfect, there is much to recommend it. By now I've written over 150 command-line tools with https://github.com/c-blake/cligen https://github.com/c-blake/cligen . A few are at https://github.com/c-blake/bu https://github.com/c-blake/bu or https://github.com/c-blake/nio https://github.com/c-blake/nio { screw 1970s COBOL-esque SQL ;-) } or in their own repos. I use quite a few every day..(EDIT: some even dozens of times per day - "production" is more an aspect of code than a PL itself - e.g., is poorly tested Python code "production"). If it helps, I like to use the "mob branch" [0] of TinyCC/tcc [1] for really fast builds in debugging mode, but this may only work if you toss `@if tcc: mm:markAndSweep @end` or similar in your nim.cfg. Then I have a little `@if r: ...` so I can say `nim c -d:r foo` for a release build with gcc/whatever. [0] https://repo.or.cz/w/tinycc.git https://repo.or.cz/w/tinycc.git [1] https://en.wikipedia.org/wiki/Tiny_C_Compiler https://en.wikipedia.org/wiki/Tiny_C_Compiler
  - sva_ 4y ago
    > https://github.com/c-blake/bu https://github.com/c-blake/bu That's quite an impressive amount of cmdline tools.
    - cb321 4y ago
      Thanks. Just a fraction published as I try to motivate/document/clean up before doing so. I kind of live at the Zsh prompt and tend to fill gaps as I find them & iterate on that. Also, if you think of an idea for more, please feel free to raise an issue - maybe it's already done somewhere. Or even better, use it as an excuse to learn Nim and file a PR or even better do your own repo. :)

cb321 4y ago

Not sure what program initially seemed malicious to the makers of anti-virus software, but work like this combined with laziness/unresponsiveness of AV software makers Re: fixing false positives can create trouble for almost any small userbase programming language. Many mentions with Nim can be seen at https://forum.nim-lang.org/search?q=av https://forum.nim-lang.org/search?q=av (and probably other queries as well). I think at some point the binary executable for the Nim compiler itself was flagged. :-(

luma 4y ago

Is type safety a critical concern when developing red team tooling? What exactly is the threat model?

V1ndaar 4y ago
Well, type safety is not only relevant for security related things. It plain and simply makes working with a language much more pleasant and less error prone. Less time wasted debugging code etc.
- spijdar 4y ago
  I'll add that beyond strictly "offensive" tooling, Nim has more or less replaced Python in my toolkit for things like reimplementing custom encryption routines during an engagement. Static types are a huge benefit in staying sane, IMO, especially when doing bit/structure twiddling. Sure, there are ways of accomplishing this is dynamic languages, but Nim is both fast and fun to use.
  - cb321 4y ago
    I would say the value of distinction is related to how many things you distinguish..Re-stated, the likelihood you mix things up (and thus the value of a checker) depends upon how many things. Perhaps nigh tautological, but a rapid corollary of this is that if everything is a string/line in a file, the distinction is less valuable than if you have many kinds of CPU register (say). In fact, there is even https://en.wikipedia.org/wiki/Typed_assembly_language https://en.wikipedia.org/wiki/Typed_assembly_language .
    - gavinray 4y ago
      Typed ASM sounds neat, I googled for it but what references I found were quite dated. Does anyone know of a working implementation you can play with today?
  - freedomben 4y ago
    How common would you say it is for red teamers to use Nim over Python?