3 ms·
Playbook files are password protected archives. Anyone cares to reverse engineer the password from the executable?
by spiorf 4y ago
Playbook files are password protected archives. Anyone cares to reverse engineer the password from the executable?
- justsomehnguy 4y ago> Set the Archive format to 7z, and set malte as the password https://docs.ameliorated.io/developers/playbooks/creation.html https://docs.ameliorated.io/developers/playbooks/creation.ht...
- Kwpolska 4y agoThe password seems to be "malte". The executable is completely unobfuscated .NET, and all you need for "reverse engineering" is ILSpy or DotPeek. public static void ExtractFile(string apbx, string file, string targetDir, bool recursive = false) { if (recursive) APBX.RunCommand("x \"" + file + "\" -o\"" + targetDir + "\" -p\"malte\" -y -r"); else APBX.RunCommand("x \"" + apbx + "\" -o\"" + targetDir + "\" -p\"malte\" \"" + file + "\" -y -r-"); } public static void ExtractArchive(string apbx, string targetDir, string exclude = null) { if (exclude != null) APBX.RunCommand("x \"" + apbx + "\" -o\"" + targetDir + "\" -p\"malte\" -x!\"" + exclude + "\" -y"); else APBX.RunCommand("x \"" + apbx + "\" -o\"" + targetDir + "\" -p\"malte\" -y"); }
- dijit 4y agoInteresting; Malte is a common Danish, Swedish and Germanic male name.
- anaisbetts 4y agoYikes, this alone is grounds to never ever ever use this tool, intentionally obfuscating what commands are being run is malware-level behavior
- rootw0rm 4y agopassword is "malte" https://ibb.co/BNtHF1X https://ibb.co/BNtHF1X
- Kwpolska 4y agoHuh, IDA can do .NET IL? Interesting.