pierrehpezier

SHA256	Name	Description
01193b3f2299b6fa849824e6b3e7276d1b9d23c62dc06b9cefc31ade1bab5201	pam_unix.so	Authentication bypass with hardcoded password and credential harvesting.
a60040a22cbb9db1a20dc2814249a7088f82fcb4fbc0fb1535c37700ee11c271	bd.bin	Rust-based dropper deploying a PAM backdoor with C2 support.
99e69fe905fef0d4f0bac72ab55e6427163552c4972f1640e52ac9fccea66623	stooge1	Manual PAM symbol hijacking to steal plaintext credentials.
ccf20313c97946ac9b20a95486811b801113d7828d66b90a149813d79d5d8aca	pam_backdoor.so	Logs intercepted usernames and passwords to a hidden file.
c7022836a3f92a6589df7cce99ee3db69ce0a98a7c266ba90a8ec5e37227329e	pam_backdoor.so	Captures plaintext credentials and stores them for later retrieval.
5dc45286ff0904add55a4c2b286f0e79c7b880dfa21c6badbb5f814fefd7476e	pam_backdoor.so	Exfiltrates stolen credentials via outbound HTTP requests.
`18e87a07ebb1995e1822e0609f221b13d3d86588b5575509fc085f0d38

pierrehpezier

# IDAPython 7.x / 8.x
# Finds calls to RE_resolve_kernel_api, extracts obfuscated string from RCX,
# Atbash-deobfuscates it, comments the LEA/CALL, then renames the stored
# resolved API pointer, e.g. unk_140005098 -> ptr_RtlInitUnicodeString.

import re

import idaapi
import idautils
import idc

pierrehpezier

#!/usr/bin/env python3
import socket
import hashlib
import hmac
import sys

HOST = '192.168.56.115'
PORT = 8000

HMAC_KEY = bytes.fromhex('a3915bd70e62c4883f1a7de650b92cf56e8347da15ac790bc15834ef962d4a71')

pierrehpezier

#!/usr/bin/env python3
"""
Client for IOCTL 0x222004 of the analyzed kernel input filter.

Drains the keystroke event ring populated by the driver's keyboard read-completion
routine. Output layout (decoded from RE_irp_dispatch_device_control @ 0x140002890,
case 0x222004):

    UINT32 count;
    struct {

pierrehpezier

#!/usr/bin/env python3
"""
handshake_hash.py
=================

Emulate the Htsysm49BE01 driver's RE_handshake_hash_v[0..3] in user-mode
via Unicorn so a client can compute the expected verify hash for IOCTL
0xAA023828 without any kernel-mode hooks, breakpoints, or driver patching.

Why this works (and why the driver author thought it wouldn't):

pierrehpezier

/*
 * Copyright (c) 2026 Nextron Systems
 * Author: Pierre-Henri Pezier
 *
 * POC: Trigger attack chain for the signed kernel rootkit
 *
 * This demonstrates the usermode-to-kernel code execution pipeline:
 *   1. Map a PE payload into process memory
 *   2. Resolve ntoskrnl function RVAs from usermode
 *   3. Build the 56-byte XOR-encrypted command buffer

pierrehpezier

/*
 * Copyright (c) 2026 Nextron Systems
 * Author: Pierre-Henri Pezier
 *
 * POC: Trigger attack chain for the signed kernel rootkit
 *
 * This demonstrates the usermode-to-kernel code execution pipeline:
 *   1. Map a PE payload into process memory
 *   2. Resolve ntoskrnl function RVAs from usermode
 *   3. Build the 56-byte XOR-encrypted command buffer

pierrehpezier

# Copyright (c) 2026 Nextron Systems
# Author: Pierre-Henri Pezier

import idaapi
import idautils
import idc


def _touches_rax(ea):
    """Check if instruction at ea writes to rax/eax/ax/al/ah."""

pierrehpezier

# Copyright (c) 2026 Nextron Systems
# Author: Pierre-Henri Pezier

import idaapi
import idautils
import idc
import re
import struct

from unicorn import *

pierrehpezier

import binascii
from unicorn import *
from unicorn.x86_const import *
import ida_segment
import ida_bytes
import ida_funcs
import ida_nalt
import idc
import idautils