Obviously, it is! Decompile pyinstaller executable If the executable file contains the keyword “ pyi-windows-manifest-filename”, then we can confirm it is a pyinstaller compiled executable. So, we know the executable is somehow related to python. When you navigate to “Symbols” tab, it shows that python36.dll is a loaded module. Let’s further analysis it by attaching my_secret_pyinstaller.exe to 圆4dbg. Then, we move on to check the executable file using Detect it Easy, and it is identified as Visual C/C++ compiled program. In this case, seems we are not able to find the password string. Strings.exe is an effective way to extract text string from any executable file. On the other hand, extract password from exe file is always one of our key goal during red team engagement. From a blue team’s perspective, we will first try to find IP address or malicious domain. Whenever I get an executable on hand, the first step is always to check what can we deduce from the executable file. pyinstaller -F my_secret_pyinstaller.py Identification of PyInstaller executable Below is the command to generate the executable file. After installation, we can compile the script using pyinstaller, and the output “ my_secret_pyinstaller.exe” will be generated under dist/ folder.

In order to install pyinstaller, we can use command pip install pyinstaller command.

If password.rstrip(' ') != MyPassword: #password = raw_input('Enter Password: ') Now, we start with a simple python script called “ my_secret_pyinstaller.py“. The first one we are going to discuss is pyinstaller, which is popular python script converter. However, we try to do it in a more simpler and effective way. Of course, you may said I can bypass authentication using disassembler such as OllyDbg, Immunity Debugger, 圆4dbg or IDA Pro. For each of the script converters, our flow of discussion is write a simple script, discuss how to convert to executable file, analysis of executable file and lastly how to decompile it. So, we start with some basic script and our goal is to bypass the authentication. As you may also aware, many Anti-Virus evasion tools such as Veil Evasion can generate executable file in these formats. In this part 1 series, we will focus on some popular script-to-executable file converter including py2exe, PyInstaller and AutoIT. The key techniques still apply to malware samples analysis.

Although we will use red team’s perspective to extract information such as credentials in this article. These information may includes credentials, keys, database information, IP address, etc. Actually, there are tons of information that is available in an executable file. Extract password from exe is one of the technique that we may use during our red team engagement.

Exe to autoit script converter online