This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
function Subvert-CLRAntiMalware { | |
<# | |
.SYNOPSIS | |
A proof-of-concept demonstrating overwriting a global variable that stores a pointer to an antimalware scan interface context structure. This PoC was only built to work with .NET Framework Early Access build 3694. | |
.DESCRIPTION | |
clr.dll in .NET Framework Early Access build 3694 has a global variable that stores a pointer to an antimalware scan interface context structure. By reading the pointer at that offset and then overwriting the forst DWORD, the context structure will become corrupted and subsequent scanning calls will fail open. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
# Block Baidu | |
## | |
127.0.0.1 baidu.com | |
127.0.0.1 www.baidu.com | |
127.0.0.1 pan.baidu.com | |
127.0.0.1 post-js.baidu.com | |
127.0.0.1 bbs.baidu.com | |
127.0.0.1 tieba.baidu.com | |
127.0.0.1 wapp.baidu.com |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wordlist created from original 41G stash via: | |
grep -rohP '(?<=:).*$' | uniq > breachcompilation.txt | |
Then, compressed with: | |
7z a breachcompilation.txt.7z breachcompilation.txt | |
Size: |