pocorgtfo

There's also Proof Of Concept Or GTFO edited by Pastor Manuel LaPhroaig https://github.com/angea/pocorgtfo

Proof of Concept or GTFO issue 0x14 is a PDF document file that can also be run as a NES ROM. The file will display its own MD5 hash in a PDF viewer, and also displays its own MD5 hash in a NES emulator (only first 40KB+16 bytes are actually loaded there) https://github.com/angea/pocorgtfo#0x14 And yes, documents are not normally supposed to be able to display their own MD5 hash.

Bootable whatever polyglots are a recurring feature in PoC||GTFO, which I find to always be an enlightening read: https://github.com/angea/pocorgtfo?tab=readme-ov-file#0x22

> To defend against concatenated ZIP files, Perception Point suggests that users and organizations use security solutions that support recursive unpacking Yeah, or, you know, just outright reject any ZIP file that doesn't start with a file entry, where a forward-scan of the file entries doesn't match the result of the central-directory-based walk. There is just so much malicious crud coming in via email that you just want to instantly reject anything that doesn't look 'normal', and you definitely don't want to descend into the madness of recursive unpacking, 'cuz that enables another class of well-known attacks. And no, "but my precious use-case" simply doesn't apply, as you're practically limited to a whole 50MB per attachment anyway. Sure, "this ZIP file is also a PDF is also a PNG is also a NES cartridge which displays its own MD5" (vi

Indeed this is very confusing! The program implements a pretty standard state machine (ok), but there is nothing apparently async here. The auth alludes to combining the state machine with async IO in this paper (https://github.com/angea/pocorgtfo/blob/master/contents/arti...), but this implementation is just using fread to (synchronously) read a chunk of bytes. Furthermore, given disk caching and memory mapping, I'm not convinced async IO would really be that astonishingly different, as individual reads are going to be amortized over pretty much the same bulk reads that the sample program is doing. As the author says themselves, it seems the main win is hand implementing the incremental utf8 parsing instead of calling a library/os function.

rob graham wrote an article on this wc program in the humorously titled PoC||GTFO journal - see [1]. he also tweeted about it a few years ago [2]. [1] https://github.com/angea/pocorgtfo/blob/master/contents/arti... [2] https://twitter.com/ErrataRob/status/1494009849427992576

Yup. PoC||GTFO article (one of many, IIRC) on crafting a polyglot PDF / JPEG file: https://github.com/angea/pocorgtfo/blob/master/contents/arti...

1) People systematically underestimate the possibility of creating collisions that still do something "interesting", like being polyglots (files that can be interpreted in multiple formats, executable or otherwise). See PoC||GTFO, specifically anything by Ange Albertini, for examples; grep https://github.com/angea/pocorgtfo/blob/master/README.md for "MD5". I specifically recommend this writeup: https://github.com/angea/pocorgtfo/blob/master/writeups/19/R... . 1bis) You can use an existing collision to create new collisions. People seem to think you need to generate all the work again from scratch; this is not true. See PoC||GTFO for proof by example. 1cis) The files do not need to be gigantic. See PoC||GTFO for proof by example. 2) You can do the collision in advance, and publish the malicious version later. What it accomplishes is that t

If you want to learn more how these things work I'd highly suggest going through the PoC||GTFO archive (https://github.com/angea/pocorgtfo/blob/master/README.md) and check out entries by Ange Albertini or entries named like "This ZIP is also a PDF".

Ange Albertini's work on collisions is pretty great and he makes lots of example images and illustrations. https://corkami.github.io/ In particular he works on/with the PoC||GTFO team and is responsible for the MD5 collision cover art in a past issue: https://github.com/angea/pocorgtfo For SHA-1 (and others) you might find more at his github project: https://github.com/corkami/collisions hth, adric

On a similar topic, PoC||GTFO [0] features files that are valid with multiple file formats. Issue 19 [1], for instance, "is valid as a PDF document, a ZIP archive, and a HTMLpage. It is also available as a Windows PE executable, a PNG image and an MP4 video" (see "technical note"). They are made by Ange Albertini [2] who has a great talk [3] on how he does this kind of things [0] https://www.alchemistowl.org/pocorgtfo/ [1] https://www.alchemistowl.org/pocorgtfo/pocorgtfo19.pdf [2] https://github.com/angea/pocorgtfo [3] https://www.youtube.com/watch?v=W9WnnMJ0RKg

Fiora refactored the MMU code emitted by Dolphin to a far jump, which had significant performance improvements over inlining the code [0]. She had an article about it in PoC || GTFO [1]. [0] https://dolphin-emu.org/blog/2014/09/30/dolphin-progress-rep... [1] https://github.com/angea/pocorgtfo/blob/master/contents/issu...

It's a PDF, a ZIP, and an HTML page: If you drop it on itself in a browser, it can give you a PDF viewer, a video and a PNG explaining the whole file structure. All these files have the same MD5. https://twitter.com/angealbertini/status/1111329484647616513 The explanation for how the MD5 trick is achieved is in the PDF, starting on page 21. Edit: whoops, probably more relevant is this earlier issue, which has the MD5 printed on the cover. https://github.com/angea/pocorgtfo/blob/master/contents/issu... The relevant article in that issue starts on page 46.