Joshua Tan Joshua-Tan

## msfvenom-reverse-tcp-WaitForSingleObject.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Joshua-Tan
                / msfvenom-reverse-tcp-WaitForSingleObject.md
            
            
              Last active
              May 8, 2019 14:29
                — forked from mgeeky/msfvenom-reverse-tcp-WaitForSingleObject.md
            
              
                (OSCE/CTP, Module #3: Backdooring PE Files) Document explaining how to locate WaitForSingleObject(..., INFINITE) within msfvenom's generated payload and how to fix the payload's glitches.
              
          
    Looking for WaitForSingleObject call within modern msfvenom generated payload.


Abstract
This is a document explaining how to locate WaitForSingleObject(..., INFINITE) within msfvenom's generated payload and how to fix the payload's glitches. It goes through the analysis of a windows/shell_reverse_tcp payload, touching issues like stack alignment, WaitForSingleObject locating & patching. It has been written when I realised there are many topics on the Offensive-Security OSCE/CTP forums touching problem of finding this particular Windows API. Since RE is one of my stronger FU's I decided to write down my explanation of the subject.
Contents:

  
## .vimrc
set nocompatible
set number
set backspace=2
set autoindent
set smartindent

## problem1.c
#include<stdio.h>
#include<stdint.h>
#include<string.h>
#include<unistd.h>
#include<assert.h>
#include<stdlib.h>

#define CHUNK 1024

int j;

## Penn Treebank II Tags.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Joshua-Tan
                / Penn Treebank II Tags.md
            
            
              Created
              September 25, 2017 05:20
                — forked from nlothian/Penn Treebank II Tags.md
            
              
                Penn Treebank II Tags
              
          
    Taken from https://web.archive.org/web/20130517134339/http://bulba.sdsu.edu/jeanette/thesis/PennTags.html (since the source document now appears to be offline)
Penn Treebank II Tags

Note: This information comes from "Bracketing Guidelines for Treebank II Style Penn Treebank Project" - part of the documentation that comes with the Penn Treebank.
Contents:

Bracket Labels

Clause Level

  
## CZ3006_Q7.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Joshua-Tan
                / CZ3006_Q7.md
            
            
              Last active
              February 26, 2017 16:35
            
              
                Source code for Q7 of CZ3006 Nov/Dec 2016 Exam Paper
              
          
    HTML File
<html xmlns = "http://www.w3.org/1999/xhtml"><head>
<script type="text/javascript">
	function bin_to_deci(){
		var deciNum=0;
		var binaryForm = document.getElementById("binaryForm");
		for(i=0; i < binaryForm.elements["binNum"].length; i++)
			if(binaryForm.elements["binNum"][i].checked)

  
## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Joshua-Tan
                / keybase.md
            
            
              Created
              February 20, 2017 16:38
            
          
    Keybase proof

I hereby claim:

I am joshua-tan on github.
I am joshtan (https://keybase.io/joshtan) on keybase.
I have a public key ASDgqVCp9Xf4_TQ_NZGyn2_MKqJw3KZIdgfHwBzb-zcd2go

To claim this, I am signing this object:

  
## T6Q6
group: T6Q6
R = {
	a:number, b:number
	7, 14
	19, 38
	3, 6
	28, 56
}
	set nocompatible
	set number
	set backspace=2
	set autoindent
	set smartindent
	#include<stdio.h>
	#include<stdint.h>
	#include<string.h>
	#include<unistd.h>
	#include<assert.h>
	#include<stdlib.h>

	#define CHUNK 1024

	int j;