Debian 13: installing mobile verification toolkit to trace pegasus malware for android devices

Mobile Verification Toolkit (MVT) is a tool to facilitate the consensual forensic analysis of Android and iOS devices, for the purpose of identifying traces of compromise. The Mobile Verification Toolkit (MVT) was developed by the Amnesty International Security Lab.

Here are common known spyware can be trace by MVT:

1. Pegasus: NSO Group spyware targeting iOS and Android
2. Predator: Commercial spyware associated with Intellexa
3. Reign: Sophisticated spyware associated with QuaDream
4. Hermit: Commercial spyware associated with RCS Lab
5. KingsPawn: Spyware associated with QuaDream investigations
6. FinSpy / FinFisher: Commercial surveillance software
7. DarkCaracal: Mobile surveillance campaign targeting Android devices

Install python 

# apt install python3 python3-venv sqlite3 libusb-1.0-0 libimobiledevice-utils usbmuxd pipx

Install adb for android

# apt install -y android-sdk-platform-tools android-sdk-platform-tools-common

Create virtual python 

$ pipx ensurepath
Success! Added /[home_user]/.local/bin to the PATH environment variable.

Consider adding shell completions for pipx. Run 'pipx completions' for
instructions.

You will need to open a new terminal or re-login for the PATH changes to take
effect. Alternatively, you can source your shell's config file with e.g.
'source ~/.bashrc'.

Otherwise pipx is ready to go!

Install mvt

$ pipx install mvt
  installed package mvt 2026.11.2, installed using Python 3.13.5
  These apps are now globally available
    - mvt
    - mvt-android
    - mvt-ios
⚠️  Note: '/[home_user]/.local/bin' is not on your PATH environment
    variable. These apps will not be globally accessible until your PATH is
    updated. Run `pipx ensurepath` to automatically add it, or manually modify
    your PATH in your shell's config file (e.g. ~/.bashrc).
done!
$ ls ./.local/bin/
mvt  mvt-android  mvt-ios

Add virtual python binary 

$ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
$ source ~/.bashrc
$ mvt version


        MVT - Mobile Verification Toolkit

        https://mvt.re
        Version: 2026.11.2

        You have not yet downloaded any indicators, check the `download-iocs` 
command!

Download spyware indicators

$ mvt download-iocs


        MVT - Mobile Verification Toolkit

        https://mvt.re
        Version: 2026.11.2

        You have not yet downloaded any indicators, check the `download-iocs` 
command!


               [mvt.common.updates] Downloaded indicators "NSO Group Pegasus 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2021-07-18_nso_pegasus.stix2
               [mvt.common.updates] Downloaded indicators "Predator Spyware 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_intellexa_predator_predator.stix2
               [mvt.common.updates] Downloaded indicators "RCS Lab Spyware 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2022-06-23_rcs_lab_rcs.stix2
               [mvt.common.updates] Downloaded indicators "Stalkerware 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AssoEchap_
stalkerware-indicators_master_generated_stalkerware.stix2
               [mvt.common.updates] Downloaded indicators "Surveillance campaign
linked to mercenary spyware company" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2023-03-29_android_campaign_malware.stix2
               [mvt.common.updates] Downloaded indicators "Quadream KingSpawn 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-04-11_quadream_kingspawn.stix2
               [mvt.common.updates] Downloaded indicators "Operation 
Triangulation Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-06_01_operation_triangulation_operation_triangulation
.stix2
               [mvt.common.updates] Downloaded indicators "WyrmSpy and DragonEgg
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2023-07-25_wyrmspy_dragonegg_wyrmspy_dragonegg.stix2
               [mvt.common.updates] Downloaded indicators "Wintego Helios 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-05-02_wintego_helios_wintego_helios.stix2
               [mvt.common.updates] Downloaded indicators "NoviSpy (Serbia) 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTec
h_investigations_master_2024-12-16_serbia_novispy_novispy.stix2
               [mvt.common.updates] Downloaded indicators "EagleMsgSpy 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2024-12-25_eaglemsgspy_eaglemsgspy.stix2
               [mvt.common.updates] Downloaded indicators "Candiru 
(DevilsTongue) Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_candiru_candiru.stix2
               [mvt.common.updates] Downloaded indicators "ResidentBat 
Indicators of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_ResidentBat_residentbat.stix2
               [mvt.common.updates] Downloaded indicators "Cellebrite Indicators
of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_cellebrite_cellebrite.stix2
               [mvt.common.updates] Downloaded indicators "DarkSword Indicators 
of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-30_darksword_darksword.stix2
               [mvt.common.updates] Downloaded indicators "Coruna Indicators of 
Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-03-03_coruna_cryptowaters_coruna.stix2
               [mvt.common.updates] Downloaded indicators "Morpheus Indicators 
of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-23_ips_morpheus_morpheus.stix2
               [mvt.common.updates] Downloaded indicators "BTMOB Indicators of 
Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-05-26_btmob_btmob.stix2
               [mvt.common.updates] Downloaded indicators "Spyrtacus Indicators 
of Compromise" to 
/[home_user]/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-projec
t_mvt-indicators_main_2026-04-09_sio_spyrtacus_spyrtacus.stix2
$ mvt version
        MVT - Mobile Verification Toolkit

        https://mvt.re
        Version: 2026.11.2

        Indicators updates checked recently, next automatic check in 12 hours

MVT installation done.

NOTE: steps below does not tested, and may different output depends on your android phone. 

You MUST enable developer option and debug on your Android phone.  Connect your android phone using usb cable.

create directory for forensic

$ mkdir -p ~/forensics/{evidence/android,working/android,reports/android}

Pull your data from android phone

$ adb bugreport ~/forensics/evidence/android/bugreport.zip

Scan your data to find evidence of spying malware 

$ mvt-android check-bugreport -o ~/forensics/reports/android/ ~/forensics/evidence/android/bugreport.zip

Find out the result on folder ~/forensics/reports/android/ 

 

Debian 13: patching CVE-2026-109618 and CVE-2026-109619 php2shell

known CVE-2026-109618 and CVE-2026-109619

Description: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Offical debian patch

• debian 12 php 8.2 -> fix 8.2.35 
• debian 13 php 8.4 -> fix 8.4.27

source: https://security-tracker.debian.org/tracker/CVE-2026-109618

The steps are

1. check your php version# php -v
PHP 8.4.26 (cli) (built: Sep 24 2026 17:16:18) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.26, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
2. perform upgrade if patch require
   # apt update && apt upgrade -y
...
3. check php version after upgradea
   < # php -v PHP 8.4.27 (cli) (built: Oct 21 2026 07:53:46) (NTS) Copyright (c) The PHP Group Built by Debian Zend Engine v4.4.27, Copyright (c) Zend Technologies with Zend OPcache v8.4.27, Copyright (c), by Zend Technologies
4. Restart your apache 
   # systemctl restart apache2
5. Restart PHP-FPM if you install it
   # systemctl restart php8.4-fpm

Warning: for server running Debian 11 24/7 and lower, please upgrade to Debian 12 to get patch! 

If you can not upgrade your os these are minimum php version had been patched:

1. **PHP 8.2:** minimum 8.2.35
2. **PHP 8.3:** minimum 8.3.36
3. **PHP 8.4:** minimum 8.4.27
4. **PHP 8.5:** minimum 8.5.12

If your php below those version e.g. php 7.4, these are configuration for emergency:

1. apache include wamp
   
# Limit request body size to 2MB (adjust based on your app's actual needs)
LimitRequestBody 2097152
# if you use php-fpm
pm.max_requests = 1 if using PHP-FPM

2. nginx
   
http {
    client_max_body_size 2m;
}
3. lighttpd
   
server.max-request-size = 2048

4. iis with http
   
<configuration>
    <system.webServer>
        <security>
            <requestFiltering>
                <requestLimits maxAllowedContentLength="2097152" />
            </requestFiltering>
       </security>
   </system.webServer>
</configuration>
5. caddy
   
example.com {
    route {
        request_body {
            max_size 2MB
        }
        php_fastcgi localhost:9000
    }
}
6. haproxy
tune.http.maxrequest 

 

 

Windows: fix boot manager after downgrade windows 11 to windows 10 on HP 15-AF109AX

Symptom: windows boot show 2 option, windows 10 and windows recovery

Assume: partition windows 11 has been replace with windows 10. 

i used these steps to downgrade win 11 to win 10 (fresh install)

1. use gparted to delete drive c windows 11, resize esp partition from 100mb to 300mb (dual boot Debian), 
2. use original iso dvd to install Windows 10.
3. download and install wifi driver sp78044.exe from hp web. i download from existing debian inside this laptop, mount ntfs, and copy the file to windows directory. here is the url https://ftp.hp.com/pub/softpaq/sp78001-78500/sp78044.exe.

Find windows recovery / old windows i.e. windows 11

C:\Windows\system32>bcdedit /enum

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  en-US
inherit                 {globalsettings}
default                 {current}
resumeobject            {b9a24d5c-cf4c-11f1-88b8-fa1143ace85b}
displayorder            {current}
                        {7c1da856-b085-11ec-bcd2-a47027794018}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {current}
device                  partition=C:
path                    \Windows\system32\winload.efi
description             Windows 10
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {b9a24d5e-cf4c-11f1-88b8-fa1143ace85b}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                partition=C:
systemroot              \Windows
resumeobject            {b9a24d5c-cf4c-11f1-88b8-fa1143ace85b}
nx                      OptIn
bootmenupolicy          Standard

Windows Boot Loader
-------------------
identifier              {7c1da856-b085-11ec-bcd2-a47027794018}
device                  unknown <-----------------------------------
path                    \WINDOWS\system32\winload.efi
description             Windows 10
locale                  en-US
inherit                 {bootloadersettings}
recoverysequence        {7c1da857-b085-11ec-bcd2-a47027794018}
displaymessageoverride  Recovery
recoveryenabled         Yes
isolatedcontext         Yes
allowedinmemorysettings 0x15000075
osdevice                unknown
systemroot              \WINDOWS
resumeobject            {7c1da855-b085-11ec-bcd2-a47027794018}
nx                      OptIn
bootmenupolicy          Standard

Remove  windows recovery / old windows 

C:\Windows\system32>bcdedit /delete {7c1da856-b085-11ec-bcd2-a47027794018}
The operation completed successfully.

Restart your laptop to test it.

We dont want windows 10 upgrading to windows 11

1. open regedit (run->regedit)
2. go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows 
3. create a new key WindowsUpdate if not exist
4. at right side create these values:
• ProductVersion -> String Value -> Windows 10
• TargetReleaseVersionInfo -> String Value -> 22H2
• TargetReleaseVersion -> DWORD (32-bit) -> 1

 or copy this to notepad and save as no_win11.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"TargetReleaseVersion"=dword:00000001
"ProductVersion"="Windows 10"
"TargetReleaseVersionInfo"="22H2"

then right click to file and merge 

Debian 13: in dual boot, grub update can not fix debian boot

Go into windows and open cmd with administrator 

C:\Windows\System32>bcdedit /enum all

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {bootmgr}
                        {e074b9af-824b-11f1-806d-806e6f6e6963}
                        {3923b543-cc0a-11f1-9907-806e6f6e6963}
timeout                 1

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  id-ID
inherit                 {globalsettings}
default                 {current}
resumeobject            {d5b4c214-c5eb-11f0-b9cc-bfd3f4d1aeed}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Firmware Application (101fffff)
-------------------------------
identifier              {3923b543-cc0a-11f1-9907-806e6f6e6963}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\debian\shimx64.efi
description             debian

Firmware Application (101fffff)
-------------------------------
identifier              {e074b9af-824b-11f1-806d-806e6f6e6963}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\RECOVERY\BOOT\BOOTMGFW.EFI
description             Windows Boot Manager
....

run

C:\Windows\System32>bcdedit /set {fwbootmgr} displayorder {3923b543-cc0a-11f1-9907-806e6f6e6963} {bootmgr} {e074b9af-824b-11f1-806d-806e6f6e6963}
The operation completed successfully. 

confirm boot order

C:\Windows\System32>bcdedit /enum all

Firmware Boot Manager
---------------------
identifier              {fwbootmgr}
displayorder            {3923b543-cc0a-11f1-9907-806e6f6e6963}
                        {bootmgr}
                        {e074b9af-824b-11f1-806d-806e6f6e6963}
timeout                 1

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\Microsoft\Boot\bootmgfw.efi
description             Windows Boot Manager
locale                  id-ID
inherit                 {globalsettings}
default                 {current}
resumeobject            {d5b4c214-c5eb-11f0-b9cc-bfd3f4d1aeed}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Firmware Application (101fffff)
-------------------------------
identifier              {3923b543-cc0a-11f1-9907-806e6f6e6963}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\debian\shimx64.efi
description             debian

Firmware Application (101fffff)
-------------------------------
identifier              {e074b9af-824b-11f1-806d-806e6f6e6963}
device                  partition=\Device\HarddiskVolume2
path                    \EFI\RECOVERY\BOOT\BOOTMGFW.EFI
description             Windows Boot Manager
... 

Restart your computer.

Last option, change boot order from Bios (depends on vendor) 

Bios -> Boot NVME Drive BBS Priorities  

windows 11: find esp partition free space

use cmd or powershell and use disk part to mount esp partition

C:\Windows\System32>diskpart

Microsoft DiskPart version 10.0.26100.1150

find which is esp partition

DISKPART> list volume

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     C   Windows_Bon  NTFS   Partition    137 GB  Healthy    Boot
  Volume 1     D   Data_Boni    NTFS   Partition     20 GB  Healthy
  Volume 2         SYSTEM       FAT32  Partition    100 MB  Healthy    System
  Volume 3         Recovery     NTFS   Partition   1001 MB  Healthy    Hidden



select volume, it is volume 2 

DISKPART> select volume 2

Volume 2 is the selected volume. 

assign drive letter for volume 2

DISKPART> assign letter=z

DiskPart successfully assigned the drive letter or mount point.

exit, and run command dir z: and at the it will show free space ",,,,,  bytes free"

Don't forget to remove drive letter, replace assign letter=z to  remove letter=z