anonymous / Injectable.cpp

Created December 18, 2017 15:25

Simple UserMode Hook Example

	#include <windows.h>
	#include <stdio.h>


	FARPROC fpCreateProcessW;
	BYTE bSavedByte;

	// Blog Post Here:
	// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108
	// tasklist \| findstr explore.exe

patois / listkmods.py

Last active January 11, 2025 00:47

ida/vmware kernel debugging helper

	from idaapi import *

	# with code taken from
	# - http://hexblog.com/idapro/vmware_modules.py
	# - HexRays forum
	# - https://gist.github.com/nmulasmajic/f90661489f858237bcd68fbde5516abd#file-find_nt_imagebase_x64-py

	class LoadedModulesList(Choose2):

	def __init__(self, title, modlistEA=BADADDR, flags=0, width=None, height=None, embedded=False, modal=False):

herrcore / HexCopy.py

Last active August 23, 2024 08:41

IDA Plugin for quickly copying disassembly as encoded hex bytes (updated for IDA 7xx) - moved https://github.com/OALabs/hexcopy-ida

Moved: https://github.com/OALabs/hexcopy-ida

scotgabriel / Windows command line gui access.md

Last active November 11, 2023 14:53

Common windows functions via rundll user32 and control panel

Rundll32 commands

OS: Windows 10/8/7

Add/Remove Programs

RunDll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,0

Content Advisor

RunDll32.exe msrating.dll,RatingSetupUI

Control Panel

struppigel / dedosfuscator.py

Created July 26, 2018 16:41

Deobfuscates Batch script in https://www.gdatasoftware.com/blog/2018/07/30924-g-data-analysis-discovers-dosfuscation-in-the-wild

	import sys
	import re

	if len(sys.argv) <= 1: exit()
	scriptpath = sys.argv[1]

	with open(scriptpath, 'r') as scriptfile:
	script = scriptfile.read().replace('^', '')
	p = re.compile('\([Ss][Ee][Tt][^=]+=([^&]+)&&')
	s = p.search(script)

mylamour / start_fuzzing.md

Last active February 20, 2022 13:30

#Fuzzing#

Artical

JohnLaTwC / 80610bb3a5be887e9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2

Created September 23, 2018 16:56

Pentest VBA VBS sample

	## Uploaded by @JohnLaTwC
	## Sample Hash: 80610bb3a5be887e9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	olevba3 0.53.1 - http://decalage.info/python/oletools
	Flags Filename
	----------- -----------------------------------------------------------------
	OpX:M-S-HB-- 9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	===============================================================================
	FILE: 9eaa7f6883725b24c358862b39b52c4766634554f02bc9d2
	Type: OpenXML
	-------------------------------------------------------------------------------

ulexec / flareon5_ch12_subleq_processor.py

Last active October 6, 2018 03:27

Small and dirty subleq IDA processor module for flareon5 challenge 12


	# Subleq Processor module for Flareon5 challenge 12. Tested in IDA 7
	# by @ulexec

	import sys
	import idc
	import idaapi
	import idautils
	from idc import *
	from idaapi import *

jthuraisamy / windows-toolkit.md

Last active April 12, 2022 20:00

Windows Toolkit

Binary

Native Binaries

IDA Pro

IDA Plugins	Preferred	Neutral	Unreviewed

lizthegrey / attributes.rb

Last active March 27, 2025 02:16

Hardening SSH with 2fa

	default['sshd']['sshd_config']['AuthenticationMethods'] = 'publickey,keyboard-interactive:pam'
	default['sshd']['sshd_config']['ChallengeResponseAuthentication'] = 'yes'
	default['sshd']['sshd_config']['PasswordAuthentication'] = 'no'

. NoThrowForwardIt