matterpreter

 # Instantiate the object
$clsid = '{A845DCD6-BB08-4F37-9BA5-AAC66F5ADDCE}'
$obj = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID($clsid))

# Get the address of the IUnknown vtable
Add-Type -AssemblyName 'System.Runtime.InteropServices'
$iunk = [System.Runtime.InteropServices.Marshal]::GetIUnknownForObject($obj)
$vtable = [System.Runtime.InteropServices.Marshal]::ReadIntPtr($iunk)

# Locate the in-proc server and get it's base address

matterpreter

matterpreter

//Locate RPC procecures inside of server code
//@author Matt Hand (@matterpreter) based on original work by Sektor7 Labs (@reenz0h)
//@category Functions
//@keybinding 
//@menupath 
//@toolbar

import ghidra.app.script.GhidraScript;
import ghidra.program.model.block.*;
import ghidra.program.model.symbol.*;

matterpreter

using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Threading.Tasks;
using PeNet;
using PeNet.Header.Pe;

matterpreter

#@author matterpreter
#@category 
#@keybinding
#@menupath
#@toolbar

###
# To import to Neo4j:
#     CREATE CONSTRAINT function_name ON (n:Function) ASSERT n.name IS UNIQUE
#

matterpreter

lkd> dt -b nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
      +0x000 Header           : _DISPATCHER_HEADER
         +0x000 Lock             : Int4B
         +0x000 LockNV           : Int4B
         +0x000 Type             : UChar
         +0x001 Signalling       : UChar
         +0x002 Size             : UChar
         +0x003 Reserved1        : UChar
         +0x000 TimerType        : UChar

matterpreter

import frida
import sys

def on_message(message, data):
    if message['type'] == 'send':
        print(message['payload'])
    elif message['type'] == 'error':
        print(message['stack'])
    else:
     print(message)

matterpreter

public static void CyrillicSwap(string latinString)
{
    Console.OutputEncoding = Encoding.UTF8;
    Dictionary<string, string> CyrDict = new Dictionary<string, string>()
    {
        {"a", "а"}, // \u0430
        {"c", "с"}, // \u0441
        {"e", "е"}, // \u0435
        {"o", "о"}, // \u043e
        {"p", "р"}, // \u0440

matterpreter

0: kd> dt -b nt!_IRP
   +0x000 Type             : Int2B
   +0x002 Size             : Uint2B
   +0x004 AllocationProcessorNumber : Uint2B
   +0x006 Reserved         : Uint2B
   +0x008 MdlAddress       : Ptr64 
   +0x010 Flags            : Uint4B
   +0x018 AssociatedIrp    : <anonymous-tag>
      +0x000 MasterIrp        : Ptr64 
      +0x000 IrpCount         : Int4B

matterpreter

//Thanks @Arno0x: https://github.com/Arno0x/CSharpScripts/blob/master/shellcodeLauncher.cs
using System;
using System.Runtime.InteropServices;

namespace ShellcodeLoader
{
    class Program
    {
        static void Main(string[] args)
        {