Skip to content

Instantly share code, notes, and snippets.

View rxwx's full-sized avatar

Rich Warren rxwx

542 followers · 1 following
View GitHub Profile
@rxwx
rxwx / encrypt_dpapi_blob.py
Created August 29, 2024 10:46
Encrypt a DPAPI blob with arbitrary master key (using Python)
from Crypto.Cipher import AES, DES3
from Crypto.Hash import HMAC, SHA1, SHA512, SHA256
from Crypto.Util.Padding import pad
from io import BytesIO
import argparse
import string
import base64
import uuid
import os
@rxwx
rxwx / InjectVEH.c
Last active October 22, 2024 07:34
Vectored Exception Handler Injector BOF
#include <Windows.h>
#include <stdio.h>
#include "VEH.h"
#include "ntos.h"
#include "ntrtl.h"
//#include "peb.h"
#include "ntldr.h"
#include "hwbp.h"
#include "base\helpers.h"
@rxwx
rxwx / AmsiContextHook.cpp
Created November 30, 2023 17:04
Bypass AMSI on Windows 11 by hooking the AMSI context VTable on the heap with a ROP gadget. Look ma, no code patches!
#include <Windows.h>
#include <Psapi.h>
#include <metahost.h>
#include <comutil.h>
#include <mscoree.h>
#include "patch_info.h"
#include "base\helpers.h"
/**
* For the debug build we want:
@rxwx
rxwx / AmsiLoader.cpp
Created November 29, 2023 16:01
Execute shellcode with AMSI
#include <Windows.h>
#include <iostream>
#include <fstream>
#include <amsi.h>
#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)
// https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/
typedef struct tagHAMSICONTEXT {
@rxwx
rxwx / dump_beacon_datastore.py
Last active September 25, 2023 19:34
Dump items (BOFs, assemblies, files etc.) from the CobaltStrike 4.9+ beacon datastore (stored with BeaconDataStoreProtectItem / data-store load)
from ctypes import wintypes
import argparse
import ctypes
import yara
import hexdump
"""
.text:0000000180010840 ; char __fastcall BeaconDataStoreUnprotectItem(unsigned __int64)
.text:0000000180010840 BeaconDataStoreUnprotectItem proc near ; CODE XREF: sub_1800100F8+9E↑p
.text:0000000180010840 ; sub_1800102E8+AD↑p
@rxwx
rxwx / trac-decode.py
Created September 7, 2023 17:54
Decode "Obscured" Check Point Trac.config files
import io
import sys
import string
KEY_STR = 'ModifiedFwPropertySheetWithOKTheSheetIDS_LDAP_AU_PROPERTIESNULL0FW_WP_OBJECTS'
def get_byte(x):
c = ord(chr(x).lower())
if ((c - 0x30) & 255) < 10:
retval = c - 0x30
@rxwx
rxwx / GetSxsPath.cs
Created July 3, 2023 12:43
Determine redirection path for SxS DotLocal DLL Hijacking
using System;
using System.IO;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
using static GetSxsPath.NativeMethods;
namespace GetSxsPath
{
internal class NativeMethods
@rxwx
rxwx / Generator.cs
Created November 11, 2022 18:58
Generate ApprovedApplication BinaryFormatter payload
using System;
using System.Globalization;
using System.IO;
using System.Reflection;
using System.Runtime.Serialization.Formatters.Binary;
using System.Threading;
using Microsoft.Exchange.Data.Directory.SystemConfiguration;
namespace ApprovedAppGenerator
{
@rxwx
rxwx / offver.py
Created April 15, 2020 10:23
Get Office version that last saved the file
import re
import sys
versions = {
0x00: 'Excel 97',
0x01: 'Excel 2000',
0x02: 'Excel 2002',
0x03: 'Office Excel 2003',
0x04: 'Office Excel 2007',
0x06: 'Excel 2010',
@rxwx
rxwx / vivaldi-decrypt.py
Last active May 14, 2020 13:03
Decrypt Vivaldi Cookies on MacOS
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
import sqlite3
import os
import shutil
def clean(x):
return x[:-ord(x[-1])]
# Make a copy of the cookie file