🇵🇱

Adam Ziaja adamziaja

🇵🇱

mattifestation / TrustedHashes.csv

Created December 16, 2017 16:44

All catalog hashes extracted from a mounted install.wim from en_windows_10_multi-edition_vl_version_1709_updated_sept_2017_x64_dvd_100090741.iso

We can't make this file beautiful and searchable because it's too large.

	"Algorithm","Hash","CatalogPath","Hint"
	"SHA256","71A0AEC9941BA21780C3BED570AEAF3BC5B9473BB6662F7CAF194F33C0E1B918","C:\Windows\InfusedApps\Frameworks\Microsoft.Advertising.Xaml_10.1705.4.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat",
	"SHA256","F5EEEC38876E48617643A9E735A30B9EC3D08D77075CD81F239A15626E3F7DD5","C:\Windows\InfusedApps\Frameworks\Microsoft.Advertising.Xaml_10.1705.4.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat",
	"SHA256","4BA33EC224E42FC929BA6487041C2C4275C5BCA66CD89471A09BC7F522A5661F","C:\Windows\InfusedApps\Frameworks\Microsoft.Advertising.Xaml_10.1705.4.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat",
	"SHA256","71A0AEC9941BA21780C3BED570AEAF3BC5B9473BB6662F7CAF194F33C0E1B918","C:\Windows\InfusedApps\Frameworks\Microsoft.Advertising.Xaml_10.1705.4.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat",

mattifestation / GetCatalogHashes.ps1

Created December 16, 2017 16:48

Sample code used to extract catalog hashes from a mounted Windows image

	# https://github.com/mattifestation/CatalogTools
	Import-Module CatalogTools

	# install.wim was mounted to C:\Mount with Mount-WindowsImage
	$SystemCatalogEntries = ls -Path C:\Mount -Include '*.cat' -Recurse \| % {
	$CatalogInfo = Get-CatalogFile -Path $_.FullName
	$FilePath = 'C:' + $CatalogInfo.FilePath.Path.Substring(8)

	$CatalogInfo.CatalogMembers \| ? { $_.HashInfo.Algorithm -and $_.HashInfo.FileHash } \| % {
	$Hint = $null

dezhub / Get-Doppelgangers.ps1

Created December 21, 2017 21:08

	function Get-Doppelgangers
	{
	<#
	.SYNOPSIS

	Detects use of NTFS transactions for stealth/evasion, aka 'Process Doppelganging'

	Author: Joe Desimone (@dez_)
	License: BSD 3-Clause