Anonymous ID: a53a08 May 12, 2020, 6:06 p.m. No.9148279   🗄️.is 🔗kun   >>8379

So I have yet to install ghidra, but I took a look at some of the photos on Obama's tweets and ran some segments through an online brainfuck editor here's what I found. Is it normal for jpgs to have this?

 

>options passed to editor

Cell size (Bits): 8 16 32

Dynamic (infinite) Memory:

Memory size:

30000

 

Memory overflow behaviour:

undefined (fast) wrap abort

End of input: no change char:

\n

Dump Memory at char:

#

Count instructions

>input

ø.Id›¶Òî %A^z–³Ïì &Ca~›¹×õ1OmŒªÉè&Ed„£Ãã#Ccƒ¤Åå'Ij‹­Îð4Vx›½à&Il²ÖúAe‰®Ò÷@eŠ¯Õú Ek‘·ÝQwžÅì;cŠ²ÚR{£ÌõGp™Ãì@j”¾é>i”¿ê A l ˜ Ä ð!!H!u!¡!Î!û"'"U"‚"¯"Ý#

#8#f#”#Â#ð$$M$|$«$Ú% %8%h%—%Ç%÷&'&W&‡&·&è''I'z'«'Ü(

(?(q(¢(Ô))8)k))Ð5hÏ++6+i++Ñ,,9,n,¢,×--A-v-«-á..L.‚.·.î/$/Z/‘/Ç/þ050l0¤0Û11J1‚1º1ò22c2›2Ô3

3F33¸3ñ4+4e4ž4Ø55M5‡5Â5ý676r6®6é7$7`7

 

>output

Syntax error: Unexpected closing bracket in line 4 char 445.

 

'use strict';var _,o=[],c=0,p=0,j=0,i=[],m=new Uint8Array(30000);function q(i){self.postMessage({o:[i]})}q(m[p]);m[p+1]+=5;i.length&&(m[p+1]=i.pop());i.length&&(m[p+1]=i.pop());i.length&&(m[p+1]=i.pop());i.length&&(m[p+1]=i.pop());i.length&&(m[p+1]=i.pop());m[p+1]-=5;q(m[p+1]);q(m[p+1]);q(m[p+1]);q(m[p+1]);q(m[p+1]);m[p+1]++;return self.postMessage({s:-1,o:o,c:c,m:m,p:p+1,n:-1});

Anonymous ID: a53a08 May 20, 2020, 6:42 p.m. No.9258629   🗄️.is 🔗kun

>>9038853

>>9043711

Maybe we need to look at the PNG images as well.

The tool below was originally published Dec 17, 2017 (near the start of Q drops), it was later updated Sep 23, 2019 (during downtime between 8ch/8kun).

 

I tried running the author's sample image through an LSB analysis and it wasn't detected

http://lukeslytalker.pythonanywhere.com/stegano/scan

 

I'm not saying this is exactly what's used, but this technique or a variation of it is out there delivering executable payloads undetected.

Invoke-PSImage

 

>Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute

 

>Invoke-PSImage takes a PowerShell script and encodes the bytes of the script into the pixels of a PNG image. It generates a oneliner for executing either from a file of from the web.

 

>It can either create a new image using only the payload data, or it can embed the payload in the least significant bytes of an existing image so that it looks like an actual picture. The image is saved as a PNG, and can be losslessly compressed without affecting the ability to execute the payload as the data is stored in the colors themselves. When creating new images, normal PowerShell scripts are actually significantly compressed, usually producing a png with a filesize ~50% of the original script.

 

>With the embed method, the least significant 4 bits of 2 color values in each pixel are used to hold the payload. Image quality will suffer as a result, but it still looks decent. It can accept most image types as input, but output will always be a PNG because it needs to be lossless. Each pixel of the image is used to hold one byte of script, so you will need an image with at least as many pixels as bytes in your script.

 

https://github.com/peewpw/Invoke-PSImage

Anonymous ID: a53a08 May 27, 2020, 8:38 p.m. No.9340169   🗄️.is 🔗kun

>>9042549

>>9042985

I've ran the whole string (from the jpeg header through the end of the dashes) on several interpreters (https://tio.run/#brainfuck https://copy.sh/brainfuck/ https://fatiherikli.github.io/brainfuck-visualizer)

 

each of these had a seven character output "ÿññð" (hex: 01 01 01 FF F1 F1 F0)

 

with only the unbroken string after the forward slash as in your example outputs "òòñ" (hex: f2 f2 f1) you get -17 because the data pointer ends at 238. The pointer starts at 255 and increases/decreases with each +/- and the periods print out the value of the byte. So Q cycled the byte value up and down, printed, and then signed with value difference.

 

my thoughts is that it could be:

-a suspicious file signature to look for in malware or apps

 

-a bug that that's being exploited

>Netview SNMP Automation Task CNMAUTO unable to receive data

Start of CP-MSU data

02 D6 12 12 00 23 FF F0 00 0FFF F1 F1 F04B F3 .O…..0 …110.3

End of CP-MSU data

SNMPAPI: TRACE: Entering snmpFreeDecodedPDU

SNMPAPI: TRACE: Exiting snmpFreeDecodedPDU

SNMPAPI: TRACE: CNMAUTO request completed with return code 24004

>This shows that we are receiving a trap through the snmp automation service in netview. However, it did not get converted into an ALERT and it does not go to NPDA

https://www.ibm.com/support/pages/netview-snmp-automation-task-cnmauto-unable-receive-data

 

-an ip address formatted in hex (not sure if executables store this ip's way), this would put it as 255.241.241.240 which would put it as a class e address "reserved for experimental purposes only for R&D or Study". is the traffic for the 4am news drops or other comms being routed through an otherwise "unused" ip?