berzerk0

This gist has been DEPRECATED.

The official version is found at https://berzerk0.github.io/GitPage/CTF-Writeups/Europa-HTB.html

Updates, and editing will happen to the GITPAGE VERSIONS ONLY

CTF Writeup: Europa on HackTheBox

2 December 2017

DiabloHorn

#!/usr/bin/env python
# DiabloHorn https://diablohorn.com
# blank out bytes taking into account the PE file format
# input file: base64 malware.exe | rev > enc.txt
import sys
import os
#pip install pefile
import pefile
import argparse
import logging

hugsy

;;
;; Token stealing shellcode for Windows 8.1 x64
;;

;; Save the current context on the stack
push rax
push rbx
push rcx

;; Get the current process

christoph2

import ctypes
import enum

#
#   Prerequisits:
#   -------------
#   If you are using Python < 3.4 run `pip install enum34`.
#
#   Problem Definition
#   ------------------