Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add python3 support and remove need for temp file #1

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 11 additions & 18 deletions cloakify.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/python
#!/usr/bin/env python
#
# Filename: cloakify.py
#
Expand Down Expand Up @@ -35,30 +35,23 @@
# Current Limitations (to be fixed in future development):
#
# - Vulnerable to frequency analysis attacks
# - Creates temporary Base64 file in local directory and deletes when finished,
# but does not do "secure delete" (potential digital forensics trail)

import os, sys, getopt, base64
from __future__ import division, absolute_import, with_statement, print_function, unicode_literals
import sys
import base64

array64 = list("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/+=")
payloadB64 = "payloadB64.txt";

if ( len(sys.argv) != 3 ):
print "usage: cloakify.py <payloadFilename> <cipherFilename>"
exit
if len(sys.argv) != 3:
print("usage: cloakify.py <payloadFilename> <cipherFilename>")
exit()

else:
base64.encode( open( sys.argv[1] ), open( payloadB64, "w" ))
payloadCloaked = base64.b64encode(open(sys.argv[1], 'rb').read()).decode('utf-8')

with open( payloadB64 ) as file:
payloadCloaked = file.read()

with open( sys.argv[2]) as file:
arrayCipher = file.readlines()
with open(sys.argv[2]) as file:
arrayCipher = file.readlines()

for char in payloadCloaked:
if char != '\n':
print arrayCipher[ array64.index(char) ],

if os.path.exists( payloadB64 ):
os.remove( payloadB64 )
print(arrayCipher[array64.index(char)], end='')
29 changes: 15 additions & 14 deletions decloakify.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/python
#!/usr/bin/env python
#
# Filename: decloakify.py
#
Expand All @@ -10,8 +10,8 @@
# against human analysts and their workflows. Bonus Feature: Defeats signature-based
# malware detection tools (cloak your other tools).
#
# Description: Decodes the output of cloakify.py into its underlying Base64 format,
# then does Base64 decoding to unpack the cloaked payload file. Requires the use of the
# Description: Decodes the output of cloakify.py into its underlying Base64 format,
# then does Base64 decoding to unpack the cloaked payload file. Requires the use of the
# same cipher that was used to cloak the file prior to exfitration, of course.
#
# Prepackaged ciphers include: lists of desserts in English, Arabic, Thai, Russian,
Expand All @@ -24,25 +24,26 @@
#
# $ ./decloakify.py cloakedPayload.txt ciphers/desserts.ciph


import sys, getopt, base64
from __future__ import division, absolute_import, with_statement, print_function, unicode_literals
import sys
import base64

array64 = list("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/+=")

if ( len(sys.argv) != 3 ):
print "usage: decloakify.py <cloakedFilename> <cipherFilename>"
exit
if len(sys.argv) != 3:
print("usage: decloakify.py <cloakedFilename> <cipherFilename>")
exit()

else:
with open( sys.argv[1]) as file:
listExfiltrated = file.readlines()
with open(sys.argv[1]) as file:
listExfiltrated = file.readlines()

with open( sys.argv[2]) as file:
arrayCipher = file.readlines()
with open(sys.argv[2]) as file:
arrayCipher = file.readlines()

clear64 = ""

for word in listExfiltrated:
clear64 += array64[ arrayCipher.index(word) ]
clear64 += array64[arrayCipher.index(word)]

print base64.b64decode( clear64 )
print(base64.b64decode(clear64).decode('utf-8'))