Skip to content

remove the crypto command #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 20, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 3 additions & 18 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,6 @@ performs the following steps:
3. added files are copied into the hidden directory `.ret/files` inside a subfolder that is named using the sha-2-256 hex digest of the file content
4. save metadata about the files, specifically their length, location and file type (i.e. elf or not), in the files json file in the hidden `.ret` directory
5. uses strings, with widths of 8, 16 and 32 bits per character, in combination with grep to search for flags according to the flag format
6. uses yara to search for constants associated with cryptography. this is equivilent to running the `crypto` command on the files

added files are subject to processing by other commands that operate on the set of added files

adding a file does not prevent changes from occuring to the source file nor does it detect them for you, like a version control system would
Expand Down Expand Up @@ -200,10 +198,9 @@ checks for the following:
3) ida
4) ghidra
5) pin
6) yara
7) gcloud
8) 7z
9) pin
6) gcloud
7) 7z
8) pin

🔗 https://github.com/rerrorctf/ret/blob/main/commands/check.go

Expand Down Expand Up @@ -237,18 +234,6 @@ if you provide a custom url it should be the equivalent of https://gchq.github.i

---

### 🚀 <u>cr</u>ypto

```
$ ret crypto [file1 file2 file3...]
```

search for crypto constants using yara rules with ret

🔗 https://github.com/rerrorctf/ret/blob/main/commands/crypto.go

---

### 🚩 <u>ct</u>ftime

```
Expand Down
16 changes: 1 addition & 15 deletions commands/add.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ func init() {
List: true,
},
},
SeeAlso: []string{"status", "crypto"}})
SeeAlso: []string{"status"}})
}

func AddHelp() string {
Expand All @@ -41,7 +41,6 @@ func AddHelp() string {
"3. added files are copied into the hidden directory " + theme.ColorCyan + "`.ret/files`" + theme.ColorReset + " inside a subfolder that is named using the sha-2-256 hex digest of the file content\n" +
"4. save metadata about the files, specifically their length, location and file type (i.e. elf or not), in the files json file in the hidden " + theme.ColorCyan + "`.ret`" + theme.ColorReset + " directory\n" +
"5. uses strings, with widths of 8, 16 and 32 bits per character, in combination with grep to search for flags according to the flag format\n" +
"6. uses yara to search for constants associated with cryptography. this is equivilent to running the `crypto` command on the files\n\n" +
"added files are subject to processing by other commands that operate on the set of added files\n\n" +
"adding a file does not prevent changes from occuring to the source file nor does it detect them for you, like a version control system would\n\n" +
"you can track several version of a file by adding each of them remembering that they are addressed according to the hash of their content\n\n" +
Expand Down Expand Up @@ -171,19 +170,6 @@ func addFile(srcPath string) {
grep2Win(dstPath, "")
grep2Win(dstPath, "-el")
grep2Win(dstPath, "-eL")

var buffer bytes.Buffer
util.CryptoWithYara(dstPath, &buffer)

scanner := bufio.NewScanner(&buffer)
for i := 0; i < 4; i++ {
if scanner.Scan() {
fmt.Printf(theme.ColorPurple+"🚀 %s"+theme.ColorReset+"\n", scanner.Text())
}
}
if scanner.Scan() {
fmt.Printf(theme.ColorGray + "🚀 one or more lines hidden" + theme.ColorReset + "\n")
}
}

func Add(args []string) {
Expand Down
11 changes: 4 additions & 7 deletions commands/check.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ func init() {
Emoji: "✅",
Func: Check,
Help: CheckHelp,
SeeAlso: []string{"crypto", "angr", "sage", "docker", "libc", "inscount"},
SeeAlso: []string{"angr", "sage", "docker", "libc", "inscount"},
})
}

Expand All @@ -24,10 +24,9 @@ func CheckHelp() string {
theme.ColorGray + "3) " + theme.ColorReset + "ida\n" +
theme.ColorGray + "4) " + theme.ColorReset + "ghidra\n" +
theme.ColorGray + "5) " + theme.ColorReset + "pin\n" +
theme.ColorGray + "6) " + theme.ColorReset + "yara\n" +
theme.ColorGray + "7) " + theme.ColorReset + "gcloud\n" +
theme.ColorGray + "8) " + theme.ColorReset + "7z\n" +
theme.ColorGray + "9) " + theme.ColorReset + "pin\n"
theme.ColorGray + "6) " + theme.ColorReset + "gcloud\n" +
theme.ColorGray + "7) " + theme.ColorReset + "7z\n" +
theme.ColorGray + "8) " + theme.ColorReset + "pin\n"
}

func testCommand(command string, args ...string) bool {
Expand Down Expand Up @@ -66,8 +65,6 @@ func Check(args []string) {
suggestLink("https://www.intel.com/content/www/us/en/developer/articles/tool/pin-a-binary-instrumentation-tool-downloads.html")
}

testCommand("yara", "--help")

testCommand("7z", "--help")

if !testCommand("stat", "/opt/pin/pin") {
Expand Down
52 changes: 0 additions & 52 deletions commands/crypto.go

This file was deleted.

39 changes: 0 additions & 39 deletions util/crypto.go

This file was deleted.

Loading