PoC||GTFO

Pastor Emmanual Laphroaig [1] as well as the phRack crew [2] continue carrying the torch in this tradition as best they can [1] https://alchemistowl.org/pocorgtfo/ [2] https://phrack.org/issues/72/1

I'd recommend Paged Out https://pagedout.institute/ And PoCoGTFO https://alchemistowl.org/pocorgtfo/ These are free modern magazines that capture the feeling of joy of programming that Dobbs and BYTE used to have

I'll link my favorite computing journal, and cite its title here: PoC || GTFO [0]. [0]:https://www.alchemistowl.org/pocorgtfo/

I highly recommend PoC||GTFO…you can buy the collection of essays from no starch…or download from here for the latest and greatest: https://www.alchemistowl.org/pocorgtfo/ Also, 2600 The Hacker Quarterly…you can find at your local Barnes or PDF on their website

You might love this article from page 14 of PoC||GTFO #20: https://www.alchemistowl.org/pocorgtfo/pocorgtfo20.pdf (warning: it's a relatively big PDF file, which also works as a .zip file with resources)

What a classic! Phrack stopped publishing some time ago but the world of security ploughs on, who can recommend similar modern resources to Phrack? Here's a few I'm aware of: https://www.alchemistowl.org/pocorgtfo/ https://secret.club/

This would have been (and still might be?) a fantastic submission to the International Journal of PoC||GTFO: https://www.alchemistowl.org/pocorgtfo/

Classical examples of chimera/polyglots are: PoC||GTFO International Journal of Proof-of-Concept or ... https://www.alchemistowl.org/pocorgtfo/ Corkami: https://github.com/corkami

If you love this, you're going to positively squee at Poc||GTFO, if you haven't read it yet: https://www.alchemistowl.org/pocorgtfo/ I mean, does HN filter out PoC||GTFO release announcements or something? I seem to remember there being mention that it might've hit the filter list ..

On a similar topic, PoC||GTFO [0] features files that are valid with multiple file formats. Issue 19 [1], for instance, "is valid as a PDF document, a ZIP archive, and a HTMLpage. It is also available as a Windows PE executable, a PNG image and an MP4 video" (see "technical note"). They are made by Ange Albertini [2] who has a great talk [3] on how he does this kind of things [0] https://www.alchemistowl.org/pocorgtfo/ [1] https://www.alchemistowl.org/pocorgtfo/pocorgtfo19.pdf [2] https://github.com/angea/pocorgtfo [3] https://www.youtube.com/watch?v=W9WnnMJ0RKg

there are some great pdf's on the PoC||GTFO site that go deep into the subject :) https://www.alchemistowl.org/pocorgtfo/

Sir and/or Madam, I feel the need to inform you that you are, more than likely, quite ill-informed. Zines are a spectacular human achievement, worthy of your attention and respect. Or, were it otherwise, how do you explain this godamn amazing piece of work: https://www.alchemistowl.org/pocorgtfo/

In case anyone loves this type of thing but hasn’t heard of PoC||GTFO, I encourage you to take a look: https://www.alchemistowl.org/pocorgtfo/

From the PDF: "Bitrot will burn libraries with merciless indignity that even Pets Dot Com didn’t deserve. Please mirror don’t merely link! pocorgtfo15.pdf and our other issues far and wide, so our articles can help fight the coming flame deluge. We like the following mirrors. https://unpack.debug.su/pocorgtfo/ " https://pocorgtfo.hacke.rs/ https://www.alchemistowl.org/pocorgtfo/ https://www.sultanik.com/pocorgtfo/

This is genuinely brilliant. Thanks for sharing. For anyone who wants to read the back issues: https://www.alchemistowl.org/pocorgtfo/

PoC||GTFO 0x10 had a great article on the copy protection mechanisms these programs use. https://www.alchemistowl.org/pocorgtfo/

There is good reason to believe the weaknesses introduced by the NSA with the PX1000-cr algorithm were introduced as part of a series of multiple backdoors that cooperate together [2][3]. The equation system to be solved is rather huge (~20 megabytes when shown as ASCII text), therefore it is logical to assume the NSA required more efficient techniques to break it in the 1980s. The fact that the first and last character, as well as the top bits in between, leak the keystream makes for an easy and cheap attack that amortizes the algebraic attack costs. Detection of key re-use is therefore trivial. And since this is a stream cipher key reuse, it is cryptographically disastrous; an excellent illustration of this is the Venona project [1].The NSA has spent decades trying to recover plaintext from two-timepads, but in the Venona case they did not know which two messages shared the same key. This is significantly simpler with the PX1000-cr. For Venona, it is a safe guess that the NSA developed a significant amount of HW capable of recovering plaintext from two plaintexts that have been XOR-ed together. This implies they may employ more costly algebraic or other attacks only on cryptograms with unique keys. This, I feel, is a critical insight: there is not a single backdoor here, but numerous ones that cooperate. [1] https://en.wikipedia.org/wiki/Venona_project [2] https://www.alchemistowl.org/pocorgtfo/pocorgtfo21.pdf [3]…

The Reverend Pastor Manul Laphroaig at Alchemist Owl is responsible for a lot of this madness: https://www.alchemistowl.org/pocorgtfo/ I confess to having become a fan long, long ago ..

This is surely either derived from the Alchemist Owl's POC||GTFO musings, or destined to be included in them at some point in the very near future. https://www.alchemistowl.org/pocorgtfo/ I'll never get my head around the fact that a language that started life as a way to accurately draw things on a printer and on a screen, is capable of being used for full-fledged applications such as this - although I suppose it makes sense, its still just too weird to me. What's next? A full-blown desktop OS in Postscript, which is also the User Manual? I sure freakin' hope so .. ;)

PoC || GTFO Volume II has a section of using a crafted polyglot ZIP / PDF to exploit SNES Super Game Boy. https://www.alchemistowl.org/pocorgtfo/pocorgtfo10.pdf Issue is that PDF has turned into a form submitting for some US government agencies and other organizations. Until PDFs are no longer used for form submission and are transitioned to static documents they are a good exploit entry.

Wonder how this would handle a polyglot[0][1], that is valid as a PDF document, a ZIP archive, and a Bash script that runs a Python webserver, which hosts Kaitai Struct’s WebIDE which, allowing you to view the file’s own annotated bytes. [0]: https://www.alchemistowl.org/pocorgtfo/ [1]: https://www.alchemistowl.org/pocorgtfo/pocorgtfo16.pdf Edit: just tested, and it does only identify the zip layer

The International Journal of Proof of Concept or GTFO (https://www.alchemistowl.org/pocorgtfo/) is a fun compilation of reverse-engineering efforts with a bent towards older systems - issue 0x2 has an article on getting RCE on a Tamagotchi :D

For anyone out there still using MD5 for any reason, check out this PDF file: https://www.alchemistowl.org/pocorgtfo/pocorgtfo14.pdf (42MB). You can also rename it to a .NES file and run it in a NES emulator. It's a PDF File which is also a NES ROM that displays its own MD5 sum. The PDF also shows its own MD5 sum a few times. (The MD5 sum also happens to begin with 5EAF00D) When an arbitrary MD5 can be created that easily, it's useless for any cryptographic applications, or even any data integrity.

I was struggling to find an easy way of introducing a weird-ish blog-zine(?) that I stumbled across while doing some 'Joshua keys' research called - The International Journal of PoC or GTFO (https://www.alchemistowl.org/pocorgtfo/) (Not Affiliated in any way to either btw) ('Joshua Keys' is a reference to the film WarGames)

masscan with the right setup (namely hardware + drivers but also connection obviously) can scan the entire IPv4 space (+ all ports) in ~5 minutes. Source Code: https://github.com/robertdavidgraham/masscan Article from PoC || GTFO with more internal details on how it works: https://www.alchemistowl.org/pocorgtfo/pocorgtfo15.pdf (Page 66) [Note: PDF is both a valid PDF + valid ZIP file with source code]

You might enjoy PoC||GTFO issue #10: > The polyglot file pocorgtfo10.pdf is valid as a PDF, as a ZIP file, and as an LSMV recording of a Tool Assisted Speedrun (TAS) that exploits Pokémon Red in a Super GameBoy on a Super NES. The result of the exploit is a chat room that plays the text of PoCkGTFO 10:3. https://www.alchemistowl.org/pocorgtfo/pocorgtfo10.pdf

If a link to Phrack is posted, then a link to POC||GTFO should be attached. A spiritual successor. https://www.alchemistowl.org/pocorgtfo/

I came here for this. E.g. https://www.alchemistowl.org/pocorgtfo/pocorgtfo19.pdf "This file, pocorgtfo19.pdf, is valid as a PDF document, a ZIP archive, and a HTML page. It is also available as a Windows PE executable, a PNG image and an MP4 video, all of which have the same MD5 as this PDF."

International Journal of Proof-of-Concept or Get The Fuck Out (PoC||GTFO or PoC or GTFO) https://www.alchemistowl.org/pocorgtfo/

Our neighbors at the fine journal of POC||GTFO are distinguished in PDF manipulation and polyglots. https://www.alchemistowl.org/pocorgtfo/