X-C3LL

' Proof of Concept: retrieving SSN for syscalling in VBA
' Author: Juan Manuel Fernandez (@TheXC3LL)


'Based on:
'https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/
'https://www.crummie5.club/freshycalls/


Private Type LARGE_INTEGER

jthuraisamy

Windows Toolkit

Binary

Native Binaries

• IDA Pro

IDA Plugins	Preferred	Neutral	Unreviewed

makelariss

# -*- coding: UTF-8 -*-
import enum, os, sys
# https://twitter.com/highsenburger69
from ctypes.wintypes import *
from ctypes import *
# These libraries have the APIs we need
kernel32 = WinDLL('kernel32',  use_last_error=True)
advapi32 = WinDLL('advapi32',  use_last_error=True)
shell32  = WinDLL('shell32',   use_last_error=True)
psapi    = WinDLL('psapi.dll', use_last_error=True)

netbiosX

using System;
using System.Net;
using System.Diagnostics;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;
　
/*
Author: Casey Smith, Twitter: @subTee
License: BSD 3-Clause

poxyran

Start GDB and execute the following commands:

catch syscall ptrace
commands 1
set ($eax) = 0
continue
end

Then, run the app and voilá! you can debug your program :)

paschalis-mpeis

/* A simple(cool) example of a register based VM, w/ a minimal IS (load, store,add) implemented by
http://www.opensourceforu.com/2011/06/virtual-machines-for-abstraction-dalvik-vm/

Instruction length: 16bit.
Registers: 4


 * myvm.c
 */
#include "stdio.h"

omidkrad

# PowerShell function to run JavaScript/JQuery and return results back to PS, with timeout

# some web page with jQuery in it
$url = "http://jquery.com/"

Function ResetTimer
{
    $script:startTime = [DateTime]::Now
}

DmitrySoshnikov

// "Fetch, decode, eval!"
// A simple Register-based VM, Assembler, and Disassembler.
// by Dmitry Soshnikov <[email protected]>

// This virtual machine (VM) consists of registers (data storage),
// and operations (instructions) which operate on the registers.

// --------------------------------------------------------------
// Registers.
// --------------------------------------------------------------