diff --git a/tests/Encoding/test_Encoding.py b/tests/Encoding/test_Encoding.py index d3826b9890..37aa8330bc 100644 --- a/tests/Encoding/test_Encoding.py +++ b/tests/Encoding/test_Encoding.py @@ -15,7 +15,7 @@ def test_unicode(self): assert result["encoding"] in ("ascii",) def test_utf8_bom(self): - result = encoding.detect(b"\xEF\xBB\xBF") + result = encoding.detect(b"\xef\xbb\xbf") assert result["encoding"] in ("UTF-8-SIG",) def test_unicode_utf8(self): diff --git a/tests/Logging/modules/test_MongoDB.py b/tests/Logging/modules/test_MongoDB.py index 4ccbca98df..983f3355f8 100644 --- a/tests/Logging/modules/test_MongoDB.py +++ b/tests/Logging/modules/test_MongoDB.py @@ -57,8 +57,9 @@ class TestMongoDB: con_method = "iframe" # Creating a MongoDB object for all the test methods. - with patch(pymongo.__name__ + ".MongoClient", new=mongomock.MongoClient), patch( - "gridfs.Database", new=mongomock.database.Database + with ( + patch(pymongo.__name__ + ".MongoClient", new=mongomock.MongoClient), + patch("gridfs.Database", new=mongomock.database.Database), ): log.ThugOpts.mongodb_address = "mongodb://localhost:123" mongo = MongoDB() diff --git a/tests/functional/test_exploits.py b/tests/functional/test_exploits.py index 56efe0be33..b0d4eaee79 100644 --- a/tests/functional/test_exploits.py +++ b/tests/functional/test_exploits.py @@ -1438,3 +1438,22 @@ def test_Qakbot(self, caplog): ] self.do_perform_test(caplog, sample, expected, useragent="osx10chrome97") + + def test_Mimikatz(self, caplog): + sample = os.path.join(self.exploits_path, "mimikatz.js") + expected = [ + "ActiveXObject: system.text.asciiencoding", + "[System.Text.ASCIIEncoding] GetByteCount_2 count = 20164", + "[System.Text.ASCIIEncoding] GetBytes_4", + "ActiveXObject: system.security.cryptography.frombase64transform", + "[System.Security.Cryptography.FromBase64ToTransform] TransformFinalBlock", + "ActiveXObject: system.io.memorystream", + "[System.IO.MemoryStream] Write", + "ActiveXObject: system.runtime.serialization.formatters.binary.binaryformatter", + "ActiveXObject: system.collections.arraylist", + "[System.Runtime.Serialization.Formatters.Binary.BinaryFormatter] Deserialize_2", + "[System.Collections.ArrayList] Add", + "[System.Collections.ArrayList] ToArray", + ] + + self.do_perform_test(caplog, sample, expected) diff --git a/tests/samples/exploits/mimikatz.js b/tests/samples/exploits/mimikatz.js new file mode 100644 index 0000000000..6cebe5a999 --- /dev/null +++ b/tests/samples/exploits/mimikatz.js @@ -0,0 +1,305 @@ + diff --git a/thug/ActiveX/CLSID.py b/thug/ActiveX/CLSID.py index b5e482bf7e..296ed660fa 100644 --- a/thug/ActiveX/CLSID.py +++ b/thug/ActiveX/CLSID.py @@ -16,6 +16,8 @@ # Foundation, Inc., 59 Temple Place, Suite 330, Boston, # MA 02111-1307 USA +import io + from .modules import AcroPDF from .modules import AdodbRecordset from .modules import AdodbStream @@ -94,6 +96,7 @@ from .modules import StormMps from .modules import SymantecAppStream from .modules import SymantecBackupExec +from .modules import System from .modules import StreamAudioChainCast from .modules import Toshiba from .modules import UniversalUpload @@ -1288,6 +1291,63 @@ "Set_MonthText11": SymantecBackupExec.Set_MonthText11, }, }, + # System.Collections.ArrayList + { + "id": (), + "name": ("system.collections.arraylist",), + "attrs": { + "arraylist": [], + }, + "funcattrs": {}, + "methods": { + "Add": System.Collections.ArrayList.Add, + "ToArray": System.Collections.ArrayList.ToArray, + }, + }, + # System.IO.MemoryStream + { + "id": (), + "name": ("system.io.memorystream",), + "attrs": { + "stream": io.BytesIO(), + "Position": 0, + }, + "funcattrs": {}, + "methods": { + "Write": System.IO.MemoryStream.Write, + }, + }, + # System.Runtime.Serialization.Formatters.Binary.BinaryFormatter + { + "id": (), + "name": ("system.runtime.serialization.formatters.binary.binaryformatter",), + "attrs": {}, + "funcattrs": {}, + "methods": { + "Deserialize_2": System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize_2, + }, + }, + # System.Security.Cryptography.FromBase64Transform + { + "id": (), + "name": ("system.security.cryptography.frombase64transform",), + "attrs": {}, + "funcattrs": {}, + "methods": { + "TransformFinalBlock": System.Security.Cryptography.FromBase64Transform.TransformFinalBlock, + }, + }, + # System.Text.ASCIIEncoding + { + "id": (), + "name": ("system.text.asciiencoding",), + "attrs": {}, + "funcattrs": {}, + "methods": { + "GetByteCount_2": System.Text.ASCIIEncoding.GetByteCount_2, + "GetBytes_4": System.Text.ASCIIEncoding.GetBytes_4, + }, + }, # StreamAudioChainCast { "id": ("2253F320-AB68-4A07-917D-4F12D8884A06",), diff --git a/thug/ActiveX/modules/System/Collections/ArrayList.py b/thug/ActiveX/modules/System/Collections/ArrayList.py new file mode 100644 index 0000000000..1daeb8c7b2 --- /dev/null +++ b/thug/ActiveX/modules/System/Collections/ArrayList.py @@ -0,0 +1,14 @@ +import logging + +log = logging.getLogger("Thug") + + +def Add(self, value): + log.ThugLogging.add_behavior_warn("[System.Collections.ArrayList] Add") + self.arraylist.append(value) + return self.arraylist.index(value) + + +def ToArray(self): + log.ThugLogging.add_behavior_warn("[System.Collections.ArrayList] ToArray") + return list(self.arraylist) diff --git a/thug/ActiveX/modules/System/Collections/__init__.py b/thug/ActiveX/modules/System/Collections/__init__.py new file mode 100644 index 0000000000..2adc3a95ad --- /dev/null +++ b/thug/ActiveX/modules/System/Collections/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "ArrayList", +] + +from . import ArrayList diff --git a/thug/ActiveX/modules/System/IO/MemoryStream.py b/thug/ActiveX/modules/System/IO/MemoryStream.py new file mode 100644 index 0000000000..d996afe7e8 --- /dev/null +++ b/thug/ActiveX/modules/System/IO/MemoryStream.py @@ -0,0 +1,17 @@ +import io +import logging + +log = logging.getLogger("Thug") + + +def Write(self, buffer, offset=0, count=-1): + log.ThugLogging.add_behavior_warn("[System.IO.MemoryStream] Write") + + buflen = count if count > -1 else len(buffer) + bufdat = buffer[: buflen - 1] + + streamdata = self.stream.getvalue() + data = f"{streamdata[:offset]}{bufdat}{streamdata[offset:]}" + + self.stream = io.BytesIO(data.encode()) + self.Position = len(data) diff --git a/thug/ActiveX/modules/System/IO/__init__.py b/thug/ActiveX/modules/System/IO/__init__.py new file mode 100644 index 0000000000..f764e2f7af --- /dev/null +++ b/thug/ActiveX/modules/System/IO/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "MemoryStream", +] + +from . import MemoryStream diff --git a/thug/ActiveX/modules/System/Runtime/Activator.py b/thug/ActiveX/modules/System/Runtime/Activator.py new file mode 100644 index 0000000000..3f26ff6fa7 --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Activator.py @@ -0,0 +1,6 @@ +class Activator: + def __init__(self, delegate): + self.delegate = delegate + + def CreateInstance(self, Type): + pass diff --git a/thug/ActiveX/modules/System/Runtime/Delegate.py b/thug/ActiveX/modules/System/Runtime/Delegate.py new file mode 100644 index 0000000000..358d9a0f55 --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Delegate.py @@ -0,0 +1,9 @@ +from .Activator import Activator + + +class Delegate: + def __init__(self, code): + self.code = code + + def DynamicInvoke(self, args): + return Activator(self) diff --git a/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/BinaryFormatter.py b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/BinaryFormatter.py new file mode 100644 index 0000000000..311db5568b --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/BinaryFormatter.py @@ -0,0 +1,14 @@ +import logging + +from thug.ActiveX.modules.System.Runtime.Delegate import Delegate + +log = logging.getLogger("Thug") + + +def Deserialize_2(self, buf): + log.ThugLogging.add_behavior_warn( + "[System.Runtime.Serialization.Formatters.Binary.BinaryFormatter] Deserialize_2" + ) + + data = buf.stream.getvalue() + return Delegate(data) diff --git a/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/__init__.py b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/__init__.py new file mode 100644 index 0000000000..859320ae0f --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/Binary/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "BinaryFormatter", +] + +from . import BinaryFormatter diff --git a/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/__init__.py b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/__init__.py new file mode 100644 index 0000000000..99b57c870f --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Serialization/Formatters/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "Binary", +] + +from . import Binary diff --git a/thug/ActiveX/modules/System/Runtime/Serialization/__init__.py b/thug/ActiveX/modules/System/Runtime/Serialization/__init__.py new file mode 100644 index 0000000000..1434bd5600 --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/Serialization/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "Formatters", +] + +from . import Formatters diff --git a/thug/ActiveX/modules/System/Runtime/__init__.py b/thug/ActiveX/modules/System/Runtime/__init__.py new file mode 100644 index 0000000000..afd4db59fd --- /dev/null +++ b/thug/ActiveX/modules/System/Runtime/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "Serialization", +] + +from . import Serialization diff --git a/thug/ActiveX/modules/System/Security/Cryptography/FromBase64Transform.py b/thug/ActiveX/modules/System/Security/Cryptography/FromBase64Transform.py new file mode 100644 index 0000000000..bf050bcf38 --- /dev/null +++ b/thug/ActiveX/modules/System/Security/Cryptography/FromBase64Transform.py @@ -0,0 +1,11 @@ +import base64 +import logging + +log = logging.getLogger("Thug") + + +def TransformFinalBlock(self, buffer, offset, count): + log.ThugLogging.add_behavior_warn( + "[System.Security.Cryptography.FromBase64ToTransform] TransformFinalBlock" + ) + return bytes(base64.b64decode("".join(buffer[offset : offset + count]))) diff --git a/thug/ActiveX/modules/System/Security/Cryptography/__init__.py b/thug/ActiveX/modules/System/Security/Cryptography/__init__.py new file mode 100644 index 0000000000..3a892aa95b --- /dev/null +++ b/thug/ActiveX/modules/System/Security/Cryptography/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "FromBase64Transform", +] + +from . import FromBase64Transform diff --git a/thug/ActiveX/modules/System/Security/__init__.py b/thug/ActiveX/modules/System/Security/__init__.py new file mode 100644 index 0000000000..7535a16722 --- /dev/null +++ b/thug/ActiveX/modules/System/Security/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "Cryptography", +] + +from . import Cryptography diff --git a/thug/ActiveX/modules/System/Text/ASCIIEncoding.py b/thug/ActiveX/modules/System/Text/ASCIIEncoding.py new file mode 100644 index 0000000000..b458d42041 --- /dev/null +++ b/thug/ActiveX/modules/System/Text/ASCIIEncoding.py @@ -0,0 +1,16 @@ +import logging + +log = logging.getLogger("Thug") + + +def GetByteCount_2(self, chars): + count = len(chars.encode("utf-8")) + log.ThugLogging.add_behavior_warn( + f"[System.Text.ASCIIEncoding] GetByteCount_2 count = {count}" + ) + return count + + +def GetBytes_4(self, chars): + log.ThugLogging.add_behavior_warn("[System.Text.ASCIIEncoding] GetBytes_4") + return list(chars) diff --git a/thug/ActiveX/modules/System/Text/__init__.py b/thug/ActiveX/modules/System/Text/__init__.py new file mode 100644 index 0000000000..a41479af82 --- /dev/null +++ b/thug/ActiveX/modules/System/Text/__init__.py @@ -0,0 +1,5 @@ +__all__ = [ + "ASCIIEncoding", +] + +from . import ASCIIEncoding diff --git a/thug/ActiveX/modules/System/__init__.py b/thug/ActiveX/modules/System/__init__.py new file mode 100644 index 0000000000..fdbcdafd17 --- /dev/null +++ b/thug/ActiveX/modules/System/__init__.py @@ -0,0 +1,7 @@ +__all__ = ["Collections", "IO", "Runtime", "Security", "Text"] + +from . import Collections +from . import IO +from . import Runtime +from . import Security +from . import Text diff --git a/thug/DOM/JScriptEncode.py b/thug/DOM/JScriptEncode.py index b9c1949f24..9a0785d4f3 100644 --- a/thug/DOM/JScriptEncode.py +++ b/thug/DOM/JScriptEncode.py @@ -7,13 +7,13 @@ DDECODE = {} -DDECODE[9] = "\x57\x6E\x7B" -DDECODE[10] = "\x4A\x4C\x41" -DDECODE[11] = "\x0B\x0B\x0B" -DDECODE[12] = "\x0C\x0C\x0C" -DDECODE[13] = "\x4A\x4C\x41" -DDECODE[14] = "\x0E\x0E\x0E" -DDECODE[15] = "\x0F\x0F\x0F" +DDECODE[9] = "\x57\x6e\x7b" +DDECODE[10] = "\x4a\x4c\x41" +DDECODE[11] = "\x0b\x0b\x0b" +DDECODE[12] = "\x0c\x0c\x0c" +DDECODE[13] = "\x4a\x4c\x41" +DDECODE[14] = "\x0e\x0e\x0e" +DDECODE[15] = "\x0f\x0f\x0f" DDECODE[16] = "\x10\x10\x10" DDECODE[17] = "\x11\x11\x11" DDECODE[18] = "\x12\x12\x12" @@ -24,107 +24,107 @@ DDECODE[23] = "\x17\x17\x17" DDECODE[24] = "\x18\x18\x18" DDECODE[25] = "\x19\x19\x19" -DDECODE[26] = "\x1A\x1A\x1A" -DDECODE[27] = "\x1B\x1B\x1B" -DDECODE[28] = "\x1C\x1C\x1C" -DDECODE[29] = "\x1D\x1D\x1D" -DDECODE[30] = "\x1E\x1E\x1E" -DDECODE[31] = "\x1F\x1F\x1F" -DDECODE[32] = "\x2E\x2D\x32" +DDECODE[26] = "\x1a\x1a\x1a" +DDECODE[27] = "\x1b\x1b\x1b" +DDECODE[28] = "\x1c\x1c\x1c" +DDECODE[29] = "\x1d\x1d\x1d" +DDECODE[30] = "\x1e\x1e\x1e" +DDECODE[31] = "\x1f\x1f\x1f" +DDECODE[32] = "\x2e\x2d\x32" DDECODE[33] = "\x47\x75\x30" -DDECODE[34] = "\x7A\x52\x21" +DDECODE[34] = "\x7a\x52\x21" DDECODE[35] = "\x56\x60\x29" -DDECODE[36] = "\x42\x71\x5B" -DDECODE[37] = "\x6A\x5E\x38" -DDECODE[38] = "\x2F\x49\x33" -DDECODE[39] = "\x26\x5C\x3D" +DDECODE[36] = "\x42\x71\x5b" +DDECODE[37] = "\x6a\x5e\x38" +DDECODE[38] = "\x2f\x49\x33" +DDECODE[39] = "\x26\x5c\x3d" DDECODE[40] = "\x49\x62\x58" -DDECODE[41] = "\x41\x7D\x3A" +DDECODE[41] = "\x41\x7d\x3a" DDECODE[42] = "\x34\x29\x35" DDECODE[43] = "\x32\x36\x65" -DDECODE[44] = "\x5B\x20\x39" -DDECODE[45] = "\x76\x7C\x5C" -DDECODE[46] = "\x72\x7A\x56" -DDECODE[47] = "\x43\x7F\x73" -DDECODE[48] = "\x38\x6B\x66" -DDECODE[49] = "\x39\x63\x4E" +DDECODE[44] = "\x5b\x20\x39" +DDECODE[45] = "\x76\x7c\x5c" +DDECODE[46] = "\x72\x7a\x56" +DDECODE[47] = "\x43\x7f\x73" +DDECODE[48] = "\x38\x6b\x66" +DDECODE[49] = "\x39\x63\x4e" DDECODE[50] = "\x70\x33\x45" -DDECODE[51] = "\x45\x2B\x6B" +DDECODE[51] = "\x45\x2b\x6b" DDECODE[52] = "\x68\x68\x62" DDECODE[53] = "\x71\x51\x59" -DDECODE[54] = "\x4F\x66\x78" -DDECODE[55] = "\x09\x76\x5E" -DDECODE[56] = "\x62\x31\x7D" -DDECODE[57] = "\x44\x64\x4A" -DDECODE[58] = "\x23\x54\x6D" +DDECODE[54] = "\x4f\x66\x78" +DDECODE[55] = "\x09\x76\x5e" +DDECODE[56] = "\x62\x31\x7d" +DDECODE[57] = "\x44\x64\x4a" +DDECODE[58] = "\x23\x54\x6d" DDECODE[59] = "\x75\x43\x71" -DDECODE[60] = "\x4A\x4C\x41" -DDECODE[61] = "\x7E\x3A\x60" -DDECODE[62] = "\x4A\x4C\x41" -DDECODE[63] = "\x5E\x7E\x53" -DDECODE[64] = "\x40\x4C\x40" +DDECODE[60] = "\x4a\x4c\x41" +DDECODE[61] = "\x7e\x3a\x60" +DDECODE[62] = "\x4a\x4c\x41" +DDECODE[63] = "\x5e\x7e\x53" +DDECODE[64] = "\x40\x4c\x40" DDECODE[65] = "\x77\x45\x42" -DDECODE[66] = "\x4A\x2C\x27" -DDECODE[67] = "\x61\x2A\x48" -DDECODE[68] = "\x5D\x74\x72" +DDECODE[66] = "\x4a\x2c\x27" +DDECODE[67] = "\x61\x2a\x48" +DDECODE[68] = "\x5d\x74\x72" DDECODE[69] = "\x22\x27\x75" -DDECODE[70] = "\x4B\x37\x31" -DDECODE[71] = "\x6F\x44\x37" -DDECODE[72] = "\x4E\x79\x4D" -DDECODE[73] = "\x3B\x59\x52" -DDECODE[74] = "\x4C\x2F\x22" -DDECODE[75] = "\x50\x6F\x54" -DDECODE[76] = "\x67\x26\x6A" -DDECODE[77] = "\x2A\x72\x47" -DDECODE[78] = "\x7D\x6A\x64" -DDECODE[79] = "\x74\x39\x2D" -DDECODE[80] = "\x54\x7B\x20" -DDECODE[81] = "\x2B\x3F\x7F" -DDECODE[82] = "\x2D\x38\x2E" -DDECODE[83] = "\x2C\x77\x4C" -DDECODE[84] = "\x30\x67\x5D" -DDECODE[85] = "\x6E\x53\x7E" -DDECODE[86] = "\x6B\x47\x6C" -DDECODE[87] = "\x66\x34\x6F" +DDECODE[70] = "\x4b\x37\x31" +DDECODE[71] = "\x6f\x44\x37" +DDECODE[72] = "\x4e\x79\x4d" +DDECODE[73] = "\x3b\x59\x52" +DDECODE[74] = "\x4c\x2f\x22" +DDECODE[75] = "\x50\x6f\x54" +DDECODE[76] = "\x67\x26\x6a" +DDECODE[77] = "\x2a\x72\x47" +DDECODE[78] = "\x7d\x6a\x64" +DDECODE[79] = "\x74\x39\x2d" +DDECODE[80] = "\x54\x7b\x20" +DDECODE[81] = "\x2b\x3f\x7f" +DDECODE[82] = "\x2d\x38\x2e" +DDECODE[83] = "\x2c\x77\x4c" +DDECODE[84] = "\x30\x67\x5d" +DDECODE[85] = "\x6e\x53\x7e" +DDECODE[86] = "\x6b\x47\x6c" +DDECODE[87] = "\x66\x34\x6f" DDECODE[88] = "\x35\x78\x79" -DDECODE[89] = "\x25\x5D\x74" +DDECODE[89] = "\x25\x5d\x74" DDECODE[90] = "\x21\x30\x43" DDECODE[91] = "\x64\x23\x26" -DDECODE[92] = "\x4D\x5A\x76" -DDECODE[93] = "\x52\x5B\x25" -DDECODE[94] = "\x63\x6C\x24" -DDECODE[95] = "\x3F\x48\x2B" -DDECODE[96] = "\x7B\x55\x28" +DDECODE[92] = "\x4d\x5a\x76" +DDECODE[93] = "\x52\x5b\x25" +DDECODE[94] = "\x63\x6c\x24" +DDECODE[95] = "\x3f\x48\x2b" +DDECODE[96] = "\x7b\x55\x28" DDECODE[97] = "\x78\x70\x23" DDECODE[98] = "\x29\x69\x41" -DDECODE[99] = "\x28\x2E\x34" -DDECODE[100] = "\x73\x4C\x09" -DDECODE[101] = "\x59\x21\x2A" +DDECODE[99] = "\x28\x2e\x34" +DDECODE[100] = "\x73\x4c\x09" +DDECODE[101] = "\x59\x21\x2a" DDECODE[102] = "\x33\x24\x44" -DDECODE[103] = "\x7F\x4E\x3F" -DDECODE[104] = "\x6D\x50\x77" -DDECODE[105] = "\x55\x09\x3B" +DDECODE[103] = "\x7f\x4e\x3f" +DDECODE[104] = "\x6d\x50\x77" +DDECODE[105] = "\x55\x09\x3b" DDECODE[106] = "\x53\x56\x55" -DDECODE[107] = "\x7C\x73\x69" -DDECODE[108] = "\x3A\x35\x61" -DDECODE[109] = "\x5F\x61\x63" -DDECODE[110] = "\x65\x4B\x50" +DDECODE[107] = "\x7c\x73\x69" +DDECODE[108] = "\x3a\x35\x61" +DDECODE[109] = "\x5f\x61\x63" +DDECODE[110] = "\x65\x4b\x50" DDECODE[111] = "\x46\x58\x67" -DDECODE[112] = "\x58\x3B\x51" +DDECODE[112] = "\x58\x3b\x51" DDECODE[113] = "\x31\x57\x49" -DDECODE[114] = "\x69\x22\x4F" -DDECODE[115] = "\x6C\x6D\x46" -DDECODE[116] = "\x5A\x4D\x68" -DDECODE[117] = "\x48\x25\x7C" +DDECODE[114] = "\x69\x22\x4f" +DDECODE[115] = "\x6c\x6d\x46" +DDECODE[116] = "\x5a\x4d\x68" +DDECODE[117] = "\x48\x25\x7c" DDECODE[118] = "\x27\x28\x36" -DDECODE[119] = "\x5C\x46\x70" -DDECODE[120] = "\x3D\x4A\x6E" -DDECODE[121] = "\x24\x32\x7A" -DDECODE[122] = "\x79\x41\x2F" -DDECODE[123] = "\x37\x3D\x5F" -DDECODE[124] = "\x60\x5F\x4B" -DDECODE[125] = "\x51\x4F\x5A" -DDECODE[126] = "\x20\x42\x2C" +DDECODE[119] = "\x5c\x46\x70" +DDECODE[120] = "\x3d\x4a\x6e" +DDECODE[121] = "\x24\x32\x7a" +DDECODE[122] = "\x79\x41\x2f" +DDECODE[123] = "\x37\x3d\x5f" +DDECODE[124] = "\x60\x5f\x4b" +DDECODE[125] = "\x51\x4f\x5a" +DDECODE[126] = "\x20\x42\x2c" DDECODE[127] = "\x36\x65\x57" DCOMBINATION = {} diff --git a/tools/distributed/thugctrl.py b/tools/distributed/thugctrl.py index f96e155292..950e95960e 100644 --- a/tools/distributed/thugctrl.py +++ b/tools/distributed/thugctrl.py @@ -1,5 +1,5 @@ #!/usr/bin/env python -""" Thug Control +"""Thug Control Send commands to Thug