Develop Reference

Decoding a Payload using GitHub Decoder Script

Abstract:
I am analysing a pcap file, with live malware (for educational purposes), and using Wireshark - I managed to extract few objects from the HTTP stream and some executables.
During my Analysis, I found instances hinting Fiestka Exploit Kit used.
Having Googled a ton, I came across a GitHub Rep: https://github.com/0x3a/tools/blob/master/fiesta-payload-decrypter.py
What am I trying to achieve?
I am trying to run the python fiesta-payload-decrypter.py against the malicious executable (extracted from the pcap).
What have I done so far?
I've copied the code onto a plain text and saved it as malwaredecoder.py. - This script is saved in the same Folder (/Download/Investigation/) as the malware.exe that I want to run it against.
What's the Problem?
Traceback (most recent call last):
File "malwaredecoder.py", line 51, in <module>
sys.exit(DecryptFiestaPyload(sys.argv[1], sys.argv[2]))
File "malwaredecoder.py", line 27, in DecryptFiestaPyload
fdata = open(inputfile, "rb").read()
IOError: [Errno 2] No such file or directory: '-'
I am running this python script in Kali Linux, and any help would be much appreciated. Thank you.

The script expects two args... What are you passing it?
Looks like it expects the args to be files and it sees a -, (dash), as the input file.
https://github.com/0x3a/tools/blob/master/fiesta-payload-decrypter.py#L44 Here it looks like the first arg is the input file and second is the output file.
Try running it like this:
python malewaredecoder.py /Download/Investigation/fileImInvestigating.pcap /Download/Investigation/out.pcap
All that said, good luck, that script looks pretty old and was last modified in 2015.

Script .py reading fine but not after building with pyinstaller

When i run setup.py as a script i have no issues reading a parameter file.
When i build with pyinstaller and run the same script as a .exe i receive the below error.
>setup.exe
Traceback (most recent call last):
File "setup.py", line 106, in <module>
param_file_info = paramsfx.extract_param_file_info(param_text)
File "app\paramsfx.py", line 64, in extract_param_file_info
s_n = re.search(rc_n, param_file_text)
File "c:\users\xxxxxx\appdata\local\programs\python\python37-32\lib\re.py", line 183, in search
return _compile(pattern, flags).search(string)
TypeError: cannot use a string pattern on a bytes-like object
[21776] Failed to execute script setup
i have read up on other posts how to resolve this error however before changing the code (that is working fine as a script) i wanted to see if anyone had any thoughts as to why it read the parameter differently as a .exe.

Just from looking at this output and not the code I noticed this:
"TypeError: cannot use a string pattern on a bytes-like object"
If this is true, I would recommend doing some python type conversion. Here is a link to help you out
https://www.w3schools.com/python/trypython.asp?filename=demo_numbers_convert
Because I don't know how your code is structured, choosing which form of conversion you choose may affect your results so please be careful with that.
I hope my explanation could have provided some use to you.

TypeError while using Openpyxl to read file

I was trying out Openpyxl, and wrote the following code:
from openpyxl import load_workbook, __version__
workbook = load_workbook(filename="Contacts.xlsx")
sheet = workbook.active
That's it, no other code.
I got the following error on running:
(TL;DR, due to line 2, I got
"TypeError: __init__() got an unexpected keyword argument 'extLst'")
"C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\Scripts\python.exe" "C:/Users/taijee/Documents/PythonAll/Python Scripts/newfile.py"
Traceback (most recent call last):
File "C:/Users/taijee/Documents/PythonAll/Python Scripts/newfile.py", line 2, in <module>
workbook = load_workbook(filename="Contacts.xlsx")
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\reader\excel.py", line 315, in load_workbook
reader.read()
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\reader\excel.py", line 279, in read
apply_stylesheet(self.archive, self.wb)
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\styles\stylesheet.py", line 192, in apply_stylesheet
stylesheet = Stylesheet.from_tree(node)
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\styles\stylesheet.py", line 102, in from_tree
return super(Stylesheet, cls).from_tree(node)
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\descriptors\serialisable.py", line 83, in from_tree
obj = desc.from_tree(el)
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\descriptors\sequence.py", line 85, in from_tree
return [self.expected_type.from_tree(el) for el in node]
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\descriptors\sequence.py", line 85, in <listcomp>
return [self.expected_type.from_tree(el) for el in node]
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\styles\fills.py", line 64, in from_tree
return PatternFill._from_tree(child)
File "C:\Users\taijee\Documents\PythonAll\Python Scripts\venv\lib\site-packages\openpyxl\styles\fills.py", line 102, in _from_tree
return cls(**attrib)
TypeError: __init__() got an unexpected keyword argument 'extLst'
Process finished with exit code 1
I've searched for similar problems and found one, but it was from 2014 so the solution given was to download version 2.0 of Openpyxl instead of 2.2.
The openpyxl version is 3.0.4, python version 3.8.3, and Contacts.xlsx definitely exists in the same folder.
Edit:
Making a new file had worked, but I recently made another program using openpyxl. It was working fine but it suddenly broke, giving an error very similar to the one above (I didn't record it at the time, but the last line TypeError: __init__() got an unexpected keyword argument 'extLst' definitely matched).
I had made no changes to the program between the successful runs and the unsuccessful ones, so I concluded the file was at fault. I had opened and closed the file once, though I don't remember whether the very next run was the one when it broke. After the error appeared, when I opened the file I couldn't save any changes - it gave some sort of error.
Note: I don't have Office, so I'm using Planmaker of the SoftMaker Office Suite to open the .xlsx files when I need to.
I deleted the file and created a new one with the same name so as to not change the code, but the problems persisted with the new file, including the inability to save changes.
Only when I created a new file with a different name did the code work.
It may not even be an openpyxl problem, but rather a Planmaker problem, though I don't understand why the error would be the one I keep getting.
Neverthless, If someone could explain why this happens or how to fix it, I'll be really grateful.
Meanwhile, I'll see if a file I never use openpyxl on will still give me the same problem, and if it does, whether openpyxl gives the same error with that file when used in a program.

I too was using Planmaker of the SoftMaker Office Suite, got the same error when I try to edit one of my .xlsx with openpyxl. The only solution that I found is by not using the Planmaker and go back to MS Excel.
As much as I don't like MS Excel like the next guy, but it works flawlessly with openpyxl.
Probably not the solution you seek, but it's a solution for me at least.

I got the same error "
TypeError: init() got an unexpected keyword argument 'extLst'
" because I changed and saved a tabular workbook file in xlsx format with Planmaker software.
Thereafter I saved this file with libreoffice calc. Then loading of this xlsx file with openpyxl was working.
This might be a workaround for some users.

Just a note, in case others stumble over this: openpyxl in the latest version (3.0.10) seems to now raise an error on the "unexpected keyword". Before you could using the warnings-module to ignore it. No more.
Since I am working on Linux, going to MS Excel is not an option, so I rewrote my latest Python project to use pylightxl instead of openpyxl. It more hassle, as it has a lot less functionality, but it does not choke on Softwaker's extensions.
– Hendrik

Tensorflow failed to create a newwriteablefile when retraining inception

I am following this tutorial: https://codelabs.developers.google.com/codelabs/tensorflow-for-poets/?utm_campaign=chrome_series_machinelearning_063016&utm_source=gdev&utm_medium=yt-desc#4
I am running this part of the code:
python retrain.py \
--bottleneck_dir=bottlenecks \
--how_many_training_steps=500 \
--model_dir=inception \
--summaries_dir=training_summaries/basic \
--output_graph=retrained_graph.pb \
--output_labels=retrained_labels.txt \
--image_dir=flower_photos
Here is the error that I get after it finds the images, makes a bunch of bottlenecks and also does steps training.
Traceback (most recent call last):
File "retrain.py", line 1062, in <module>
tf.app.run(main=main, argv=[sys.argv[0]] + unparsed)
File "C:\Anaconda3\lib\site-packages\tensorflow\python\platform\app.py", line 48, in run
_sys.exit(main(_sys.argv[:1] + flags_passthrough))
File "retrain.py", line 905, in main
f.write('\n'.join(image_lists.keys()) + '\n')
File "C:\Anaconda3\lib\site-packages\tensorflow\python\lib\io\file_io.py", line 101, in write
self._prewrite_check()
File "C:\Anaconda3\lib\site-packages\tensorflow\python\lib\io\file_io.py", line 87, in _prewrite_check
compat.as_bytes(self.__name), compat.as_bytes(self.__mode), status)
File "C:\Anaconda3\lib\contextlib.py", line 66, in __exit__
next(self.gen)
File "C:\Anaconda3\lib\site-packages\tensorflow\python\framework\errors_impl.py", line 466, in raise_exception_on_not_ok_status
pywrap_tensorflow.TF_GetCode(status))
tensorflow.python.framework.errors_impl.NotFoundError: Failed to create a NewWriteableFile: /tmp/output_labels.txt : The system cannot find the path specified.
You can find all my code here:
https://github.com/officialgupta/MachineLearningRecipes
Thanks

I have also found some similar errors. And if I understood, that you need to set an absolute paths for --output_graph and --output_labels.
For example:
--output_graph=/home/%your_homhttps://stackoverflow.com/review/late-answers/17020426#e_user_name_folder%/Inception_retrained_graph.pb
--output_labels=/home/%your_home_user_name_folder%/Inception_retrained_labels.txt

I had the same issue. The only thing I had to do is to reduce the length of path.
For example:
C:\Users\test\lib\Workspace\DataScience\Bachelorarbeit\ba_test\src\saved_models\neural20201029-235456-a0.8775
instead of
C:\Users\test\lib\Workspace\DataScience\Bachelorarbeit\ba_test\src\saved_models\neural20201029-234822Arg-e1-b512-l1-n256-oadam-z0.005-r0-d0-a0.8803.

In a similar case,I have met errors, when I tried to execute this command:
writer = tf.python_io.TFRecordWriter(FLAGS.output_path)
then I found that, the output_path is empty. So you need to make sure an absolute paths is available.

I might be late for giving an answer but putting up an answer and hoping that it will be useful for anyone facing similar issue.
Today I came across similar issue while retraining the Inception model on Tensorflow and followed some steps to correct it.
There are two things we need to take care of.
Activate tensorflow before using Tensorflow commands.
source ~/tensorflow/bin/activate
Use full path of the files mentioned in your terminal commands as answered by #Nikita Verbitskiy in the answer below.

try below command in win10 to solve the problem
python -m retrain
--bottleneck_dir=bottlenecks
--how_many_training_steps=500
--model_dir=models
--summaries_dir=tf_files
--output_graph=retrained.pb
--output_labels=retrained_labels.txt
--architecture="mobilenet_0.50_224"
--image_dir=flower_photos

I faced the same problem, and could fix it.
Just to clear some things up, my code is running without ..
setting an absolute path
activating tensorflow
On the first run everything was saved as expected, on the second run I had the same issue as described.
For me it was enough to not set
--save_model_dir
but only setting
--output_labels
--output_graph

Understanding Parsing Error when reading model file into PySD

I am receiving the following error message when I try to read a Vensim model file (.mdl) using Python's PySD package.
My code is:
import pysd
import os
os.chdir('path/to/model_file')
model = pysd.read_vensim('my_model.mdl')
The Error I receive is:
Traceback (most recent call last):
Python Shell, prompt 13, line 1
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pysd/pysd.py", line 53, in read_vensim
py_model_file = translate_vensim(mdl_file)
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pysd/vensim2py.py", line 673, in translate_vensim
entry.update(get_equation_components(entry['eqn']))
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/pysd/vensim2py.py", line 251, in get_equation_components
tree = parser.parse(equation_str)
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/parsimonious/grammar.py", line 123, in parse
return self.default_rule.parse(text, pos=pos)
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/parsimonious/expressions.py", line 110, in parse
node = self.match(text, pos=pos)
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/parsimonious/expressions.py", line 127, in match
raise error
parsimonious.exceptions.ParseError: Rule 'subscriptlist' didn't match at '' (line 1, column 21).
I have searched for this particular error and I cannot find much information on the failed matching rule for 'subscriptlist'.
I appreciate any insight. Thank you.

Good news is that there is nothing wrong with your code. =) (Although you can also just include the path to the file in the .read_vensim call, if you don't want to make the dir change).
That being the case, there are a few possibilities that would cause this issue. One is if the model file is created with a sufficiently old version of Vensim, the syntax may be different from what the current parser is designed for. One way to get around this is to update Vensim and reload the model file there - Vensim will update to the current syntax.
If you are already using a recent version of Vensim (the parser was developed using syntax of Vensim 6.3E) then the parsing error may be due to a feature that isn't yet included. There are still some outstanding issues with subscripts, which you can read about here and here).

If you aren't using subscripts, you may have found a bug in the parser. If so, best course is to create a report in the github issue tracker for the project. The stack trace you posted says that the error is happening in the first line of the file, and that the error has to do with how the right hand side of the equation is being parsed. You might include the first few lines in your bug report to help me recreate the issue. I'll add a case to our growing test suite and then we can make sure it isn't a problem going forwards.