Skip to content

Instantly share code, notes, and snippets.

View hasherezade's full-sized avatar

hasherezade hasherezade

6.8k followers · 35 following
View GitHub Profile
@hasherezade
hasherezade / test.reg
Last active December 31, 2023 19:26
Demo: persistence key not visible for sysinternals autoruns (in a default configuration - read more: https://twitter.com/hasherezade/status/849756054145699840)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
@="Rundll32.exe SHELL32.DLL,ShellExec_RunDLL \"C:\\ProgramData\\test.exe\""
@hasherezade
hasherezade / find_import_by_addr.cpp
Created April 7, 2017 18:18
Find imported function by address
#include <stdio.h>
#include <Windows.h>
#include <TlHelp32.h>
#include <map>
#include <iostream>
#include "peloader/pe_hdrs_helper.h"
/*
@hasherezade
hasherezade / AppProxy.cpp
Created April 13, 2017 15:04
AppProxy
#include <stdio.h>
#include <Windows.h>
#include <psapi.h>
#include <string>
HANDLE create_new_process(IN const char* path, IN const char* cmd)
{
STARTUPINFOA si;
memset(&si, 0, sizeof(STARTUPINFO));
@hasherezade
hasherezade / latent_decode.cpp
Last active August 4, 2017 01:07
Decoder fot the LatentBot
/*
* Decoder for the strings of LatentBot
* CC-BY: hasherezade
*/
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#ifdef _MSC_VER
@hasherezade
hasherezade / latent_dec.py
Last active August 4, 2017 01:06
Script for IDA Pro decoding Latent Bot's strings
"""latent_dec.py: Script for IDA Pro decoding Latent Bot's strings"""
__author__ = "hasherezade"
import idautils
lookup_table = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x00\x00\x3F\x34\x35\x36\x37\x38\x39\x3A\x3B\x3C\x3D\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x00\x00\x00\x00\x00\x00\x1A\x1B\x1C\x1D\x1E\x1F\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2A\x2B\x2C\x2D\x2E\x2F\x30\x31\x32\x33\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\
@hasherezade
hasherezade / private_key.txt
Created July 5, 2017 19:57
enter aes-256-cbc decryption password:
Congratulations!
Here is our secp192k1 privkey:
38dd46801ce61883433048d6d8c6ab8be18654a2695b4723
We used ECIES (with AES-256-ECB) Scheme to encrypt the decryption password into the "Personal Code" which is BASE58 encoded.
@hasherezade
hasherezade / base58.py
Created July 12, 2017 21:01
Base58 decoder
#!/usr/bin/env python2.7
import sys
import os
import argparse
# Base58 charset
alphabet = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
@hasherezade
hasherezade / mac1_1000028.xml
Last active December 6, 2021 13:08
TrickBot configs
<mcconf>
<ver>1000028</ver>
<gtag>mac1</gtag>
<servs>
<srv>186.103.161.204:443</srv>
<srv>163.53.206.187:443</srv>
<srv>191.7.30.30:443</srv>
<srv>46.160.165.31:443</srv>
<srv>93.99.68.140:443</srv>
<srv>190.34.158.250:443</srv>
@hasherezade
hasherezade / 64bitasm_gcc.cpp
Created October 11, 2017 18:25
#include <stdio.h>
void set_regs()
{
void* address = (void*) 0x00000000;
char *val = (char*) "mmmmmm";
__asm__ volatile (
"mov %1, %%rdi \n"
"mov %0, %%rsp \n"
: /* no output operand*/
@hasherezade
hasherezade / kaybase.md
Created November 22, 2017 18:11

Keybase proof

I hereby claim:

  • I am hasherezade on github.
  • I am hasherezade (https://keybase.io/hasherezade) on keybase.
  • I have a public key whose fingerprint is 4664 DAE5 DBAA D9CE 9769 0442 E415 3E8F 9A4C 195F

To claim this, I am signing this object: