{"id":13775301,"url":"https://github.com/johnbergbom/peddlecheap","last_synced_at":"2025-05-11T07:32:21.606Z","repository":{"id":215850628,"uuid":"112479590","full_name":"johnbergbom/PeddleCheap","owner":"johnbergbom","description":"Pcaps for PeddleCheap and implant communication + script for interpreting and decrypting pcaps.","archived":false,"fork":false,"pushed_at":"2017-11-29T13:41:13.000Z","size":2015,"stargazers_count":15,"open_issues_count":1,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-11-17T10:39:43.774Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/johnbergbom.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-11-29T13:36:23.000Z","updated_at":"2024-07-16T02:29:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"c0105fff-2a0e-40e1-92a1-4d4427d66748","html_url":"https://github.com/johnbergbom/PeddleCheap","commit_stats":null,"previous_names":["johnbergbom/peddlecheap"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johnbergbom%2FPeddleCheap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johnbergbom%2FPeddleCheap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johnbergbom%2FPeddleCheap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/johnbergbom%2FPeddleCheap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/johnbergbom","download_url":"https://codeload.github.com/johnbergbom/PeddleCheap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253533965,"owners_count":21923515,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T17:01:36.635Z","updated_at":"2025-05-11T07:32:21.158Z","avatar_url":"https://github.com/johnbergbom.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"f13469c9891173804423be4403b2c4ff\"\u003e\u003c/a\u003epcap"],"sub_categories":["\u003ca id=\"eb49514924c3f4bf2acf6f3a4436af13\"\u003e\u003c/a\u003e未分类"],"readme":"# PeddleCheap\nPcaps for PeddleCheap and implant communication + script for interpreting pcaps.\n\nDecryptor script:  \ndp_decrypt.py: script to decrypt (and verbosely explain) the traffic when HTTP Proxy is used\n\nPcap files:  \nforward_level3_tcp_port_1163.pcap: level3 standard tcp implant with PeddleCheap doing a forward connection to implant  \nforward_level4_tcp_port_1167.pcap: level4 standard tcp implant with PeddleCheap doing a forward connection to implant  \nreverse_level3_http_port_80.pcap: level3 http proxy implant with implant doing reverse connection to PeddleCheap  \nreverse_level3_http_port_443.pcap: level3 http proxy implant with implant doing reverse connection to PeddleCheap  \nreverse_level3_tcp_port_53.pcap: level3 standard tcp implant with implant doing reverse connection to PeddleCheap  \n\nSupporting files:\n00041-pc_listen_2017_10_16_09h37m12s.966.xml: DanderSpritz log file (corresponds to reverse_level3_http_port_80.pcap)  \nsuccessful_reverse_connection_port80.txt: another DanderSpritz log file (corresponds to reverse_level3_http_port_80.pcap)  \nDsz_Implant_Pc.dll: PeddleCheap uploads this file to have it executed by the implant  \nDszLpCore.exe: executable that listens to open ports on the DanderSpritz host  \nPeddleCheap_Lp.dll: imported by DszLpCore.exe, communicates with the implant  \nPeddleCheap_2017_10_16_09h32m09s.409: directory containing implant (for reverse_level3_http_port_80.pcap) as well as the default public/private keys  \n\nSample output when ran against reverse_level3_http_port_80.pcap:\n----------------------------------------------------------------\n$ python dp_decrypt.py reverse_level3_http_port_80.pcap out.file PeddleCheap_2017_10_16_09h32m09s.409/Keys/private_key.bin\n\nSearching in pcap for implant deployment to DoublePulsar:  \nNbr packets: 1355  \npacket nbr 13 (ping request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 14 response: success  \n  packet nbr 14 xor key in response: 0x75503953 , target arch: x64 (64-bit)  \npacket nbr 15 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \npacket nbr 15: xor key for encrypting payload to DoublePulsar: 0x75503953  \n  packet nbr 19 response: success  \npacket nbr 20 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 24 response: success  \npacket nbr 25 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 29 response: success  \npacket nbr 30 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 34 response: success  \npacket nbr 35 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 39 response: success  \npacket nbr 40 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 44 response: success  \npacket nbr 45 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 49 response: success  \npacket nbr 50 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 54 response: success  \npacket nbr 55 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 59 response: success  \npacket nbr 60 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 64 response: success  \npacket nbr 65 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 69 response: success  \npacket nbr 70 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 74 response: success  \npacket nbr 75 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 79 response: success  \npacket nbr 80 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 84 response: success  \npacket nbr 85 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 89 response: success  \npacket nbr 90 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 94 response: success  \npacket nbr 95 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 99 response: success  \npacket nbr 100 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 104 response: success  \npacket nbr 105 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 109 response: success  \npacket nbr 110 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 114 response: success  \npacket nbr 115 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 119 response: success  \npacket nbr 120 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 124 response: success  \npacket nbr 125 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 129 response: success  \npacket nbr 130 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 134 response: success  \npacket nbr 135 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 139 response: success  \npacket nbr 140 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 144 response: success  \npacket nbr 145 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 149 response: success  \npacket nbr 150 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 154 response: success  \npacket nbr 155 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 159 response: success  \npacket nbr 160 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 164 response: success  \npacket nbr 165 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 169 response: success  \npacket nbr 170 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 174 response: success  \npacket nbr 175 (exec request): 10.0.0.2:1892 -\u003e 10.0.0.10:445  \n  packet nbr 178 response: success  \nDoublePulsar payload written to out.file\n\nExtracting public key data from pcap:  \nPublic key written to out.file.public_key  \nKey length: 2048  \nModulus: 0x9c49002465e0ee9ea5df71a77ffb33ac8681125d3e740bfa75c00503ad5482874e41a774348d5fac28841135536d8a5286121eb02d19712173fbb81ba8e0b27c58e303e6723aa7975e24c999c211dbc72f5066382a79c3b2a86a6386fe98f36d541dacd1a08f237af8635d20d06074df7ab363125e7202be6326fd9ba1ca4e861ff224e65d3eeffab9f3c17756b1c43217835a511923c02fb2c0dbf6f669933d5a495b1a27b7cb86c3ee14c6890b97dc3610fd89dc096bdd09e6f07dbd4ee592b46020b0fab89cf4dfdc567eb653317f37ec66158433faf5f6fc1fb70ed2cbcf862a0f3b30317034366d1f7b95f8148cae663596e7ec823041c52253eec53ae1  \nPublic key exponent: 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010001  \n\nExtracting private key data from provided file:  \nPrivate key exponent: 0x2c28401f089e0e2dcb262001b89a6c5641c6b43e9e47c19ea9a8708242760f4f55a01d452b180ac124cd73e342483ffde31db98803a61d9ddb1c733f756ecf5f6ce9ef8f2c154086f735a3b48aedead013a13ed07dc7dbb05dff79518a1c03238fd1b6a3a01ef1626c4dfee1279f29467f6fb1fd5dac0ef466257d207d0d2134393bfb7caf65b2ab1a122b561b594af4fe676cf271ef6ddd4cd60294556caff6ac48411b31518585a3ce9406445214925152c640a6d3acbcec8aec639ebb7039faf1d659c9eb4eef9462fc8e8924338da2c9ff867a3c316228d89e45da360f4af0e504f3e2ca6de32f42a2ef3426a840ce7d67b7ad91dd99367e413a4c59c771  \nPrime 1: 0xcdf9397a78e918aa4319cc5c3271e51f47565ce487b0f66cfbd7997bc57460729258640da0eef9a876e363d4b865488e5f168afec04693304e15797e06661ec554a68a09c68809f82e6695db4242c44e6418edad6c40388151e23a5a686906fe2337c95e2cddac42af0e79f93d9da3c0cc9786c2f4dcada901b1111ba47f80a5  \nPrime 2: 0xc23e4fd2fcd07816ed7b2aacb26bf111e1c4f371b2ebb826b02c8e00cfa4744a65be0aaca83b3d22a5d9f5bd97bd97c18ebd9f69f4657dc42649a5cda35fa1bebe9bffa578d487475bb8f50e6191dc950371e361012c44a7e7c4dea674abea452b5eb1141c156b22dad5a3024f33f5ad5c1675cc506346c02029dc0a701fe08d  \nPrime exponent 1: 0x1294a0f2c36583ac18518375edb7088c41cb30a60cf791c35314a7ebda6c1d2738bc708a2a3264a325d66d730b0f57f43fefb0aa3a7e235900323fbb76a84fae4d6c989739299c7c9ef2f221cd60688509d295de471da3fb467fb9f3dde75b92216b2ee727f4f74d2cad89a34a43a63a063ac515613167190fe6013d1521cb61  \nPrime exponent 2: 0x3a81c2516eccec1f1bd0e97db3104840769c78275b191d12aa26016fc51b67dbb0e1991d805eb77f642d4e9398cd0694ca85db2a72eecefef1f964f397ae0a6e05c3bf30fc4027af1ab58f3a91b0f99bf8b9a91f62d70ea6f46c9c13cf38a90bc490750df5978df9a5a88bbcfa56503db36b2078360e7115159b06282eb5ab51  \nCoefficient: 0x2c8bd71480d4b5bfa368551f27b776d99b69c040eefaa78d7d99020ec1fa471d9bddc705273a2e20897b4f2346d90f0537318504f09f6d2a528cba87c4c1ff44d3cd4b361d51ac03f16047136f30e6b0f5012f8253ea3d62d8bea222b318dc669a8f4713f9888bfc02bfbe9c7c5ae6817b84ec24a10f9a47df19263ba3b4b530  \n\nAnalyzing traffic between implant and DanderSpritz:  \npacket nbr 200: initial contact from implant to DanderSpritz  \n  Seq nbr: 0  \n  Payload length: 0  \n  Clear text length: 0  \n  Symm. encr. used: 0  \n  Custom header: TlEo: 0e59a2bc9:00000000  \npacket nbr 203: contains response from DanderSpritz (digital signature / magic number)  \n  Seq nbr: 1  \n  Payload length: 256  \n  Clear text length: 256  \n  Symm. encr. used: 0  \n  Decrypted magic number: 0x1fffffff...ffff00000200038e3071abdc7d00b9  \n  =\u003e interpretation:  \n  PeddleCheap ver: 2.3.0  \n  Magic number: 8e3071ab  \n  Random padding: dc7d  \n  Nbr random bytes: 185  \npacket nbr 211: implant sends symmetric key and platform info to DanderSpritz  \n  Seq nbr: 1  \n  Payload length: 256  \n  Clear text length: 256  \n  Symm. encr. used: 0  \n  Decrypted data: 000200031f0000009ac96bc2ca877c5394f1e5dcf009d07e000000000000000000000008000000080000000100000001  \n  =\u003e interpretation:  \n  Implant ver: 2.3.0  \n  Session key: 0x9ac96bc2ca877c5394f1e5dcf009d07e  \n  PC ID: 0000000000000000  \n  Architecture: 0008 (x64)  \n  Compiled architecture: 0008 (x64)  \n  Platform: 0001 (winnt)  \n  Compiled platform: 0001 (winnt)  \n  Next IV: b5f5546662b92c858cca6ac04c530a94  \npacket nbr 214: DanderSpritz response after getting magic number  \n  Seq nbr: 2  \n  Payload length: 16  \n  Clear text length: 4  \n  Symm. encr. used: 1  \n  Decrypted data (OS version check status): 0x00000000  \n  Next IV: 82413a117e459d08824cdd2ca9380ea2  \npacket nbr 222: implant acknowledges reception of OS version check status  \n  Seq nbr: 2  \n  Payload length: 16  \n  Clear text length: 4  \n  Symm. encr. used: 1  \n  Decrypted data (OS version check reception acknowledgement): 0x00000000  \n  Next IV: 4d801fbdc6bb391d5c6f8f1efd77049d  \npacket nbr 225: DanderSpritz empty response  \n  Seq nbr: 3  \n  Payload length: 0  \n  Clear text length: 0  \n  Symm. encr. used: 0  \npacket nbr 233: implant asks for new command from DS  \n  Seq nbr: 3  \n  Payload length: 0  \n  Clear text length: 0  \n  Symm. encr. used: 0  \npacket nbr 236: DanderSpritz sends PayloadInfo run type info and File/Library info to implant  \n  Seq nbr: 4  \n  Payload length: 16  \n  Clear text length: 4  \n  Symm. encr. used: 1  \n  Decrypted data (PayloadInfo run type info): 0x00020000  \n  Next IV: bdf117e78479cc2c36abd53e365c10ba  \n  Payload length: 48  \n  Clear text length: 36  \n  Symm. encr. used: 1  \n  Decrypted data (File/Library info): 0x0000000000000001000000000000000100000003dcce000000028af4205d000200080000  \n  Next IV: 37df8c4f8464e08ec7334fe68167d5c1  \npacket nbr 244: implant acknowledges reception of File/Library info  \n  Seq nbr: 4  \n  Payload length: 16  \n  Clear text length: 4  \n  Symm. encr. used: 1  \n  Decrypted data (File/Library info reception acknowledgement): 0x00000000  \n  Next IV: ad55f14210e59f5663c5086b0cfa6cba  \npacket nbr 247: DanderSpritz sends Export name to implant  \n  Seq nbr: 5  \n  Payload length: 16  \n  Clear text length: 3  \n  Symm. encr. used: 1  \n  Decrypted data (Export name): 0x233100  \n  Next IV: 4209181c23ee7273dd702f52ba699941  \npacket nbr 255: implant acknowledges reception of Export name  \n  Seq nbr: 5  \n  Payload length: 16  \n  Clear text length: 4  \n  Symm. encr. used: 1  \n  Decrypted data (Export name reception acknowledgement): 0x00000000  \n  Next IV: 4eff69ab69ab6048822d22e590d54d1f  \npacket nbr 258: DanderSpritz sends executable to implant  \n  Seq nbr: 6  \n  Payload length: 166656  \n  Size of executable: 166644  \n  Symm. encr. used: 1  \npacket nbr 282: DanderSpritz sends executable to implant  \npacket nbr 306: DanderSpritz sends executable to implant  \npacket nbr 331: DanderSpritz sends executable to implant  \npacket nbr 359: DanderSpritz sends executable to implant  \npacket nbr 384: DanderSpritz sends executable to implant  \npacket nbr 408: DanderSpritz sends executable to implant  \npacket nbr 433: DanderSpritz sends executable to implant  \npacket nbr 457: DanderSpritz sends executable to implant  \npacket nbr 481: DanderSpritz sends executable to implant  \npacket nbr 506: DanderSpritz sends executable to implant  \npacket nbr 530: DanderSpritz sends executable to implant  \npacket nbr 554: DanderSpritz sends executable to implant  \npacket nbr 578: DanderSpritz sends executable to implant  \n  Encrypted executable written to out.file.executable_encr  \n  Original size of executable: 338944  \n  Decrypted executable written to out.file.executable  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohnbergbom%2Fpeddlecheap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjohnbergbom%2Fpeddlecheap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohnbergbom%2Fpeddlecheap/lists"}