Und3rf10w

import tkinter as tk
from queue import Queue, Empty
import logging
import threading
import sys

# Configure stream redirection as a context manager
class StdoutRedirector:
    def __init__(self, write_func):
        self.write_func = write_func

Und3rf10w

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

// CUDA runtime
#include <cuda_runtime.h>

__global__ void xorObfuscatePayload(char* data, int len, char key) {
    int idx = blockIdx.x * blockDim.x + threadIdx.x;

Und3rf10w

Overview

This document descrives the process of setting up headscale with swag, using letsencrypt certs.

This assumes you have a subdomain (e.g. wg.example.com) pointing to your SWAG instance and want to use it as a reverse proxy.

Swag .env

Add the subdomain for your desired headscale domain to your .env file.

For example: SWAG_EXTRA_DOMAINS=wg.example.com

Und3rf10w

package main

import (
	"fmt"
)

type methodArgumentsInterface interface {
	determineStruct() interface{}
}

Und3rf10w

for line in `cat response.json| jq '.value[].contentBytes'`; do
  echo $line | tr -d '"' | base64 -d > $(echo -n $line | cut -c2-5).file; 
done

Und3rf10w

# This script adds matrix-hookshot support via generic webhooks to Cobalt Strike
# Ensure that you configure the variables necessary at the beginning
# @Und3rf10w
# Modified from @vysecurity 's pushover-ng.cna

$version = "0.1a";

##########################
# MODIFY THESE VARIABLES #
##########################

Und3rf10w

alpha_list = []
for x in range(0x61,0x7a):
    alpha_list.append(chr(x))
    alpha_list.append(0) # To represent Null Bytes


def generate_driver_name(current_pid, address_of_az_array):
    """
    Generates the current driver name based off of the PID of hermeticWiper
    :param current_pid: The current Process ID of the HermeticWiper.exe

Und3rf10w

# Add this to .zshrc

vtapidownload () {
    if [ "$#" -ne 2 ]; then
        echo "Get a download url for a sha256sum via VirusTotal\n\nUsage: vtapidownload <vtapikey> <sha256 sum of file>"
    else;
        curl -H "x-apikey: $1" https://www.virustotal.com/api/v3/files/$2/download_url
    fi
}

Und3rf10w

0: kd> dt -b nt!_IRP
   +0x000 Type             : Int2B
   +0x002 Size             : Uint2B
   +0x004 AllocationProcessorNumber : Uint2B
   +0x006 Reserved         : Uint2B
   +0x008 MdlAddress       : Ptr64 
   +0x010 Flags            : Uint4B
   +0x018 AssociatedIrp    : <anonymous-tag>
      +0x000 MasterIrp        : Ptr64 
      +0x000 IrpCount         : Int4B

Und3rf10w

# Author: @Und3rf10w
# See: https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html
# You'd still have to set up the client config and define certain parameters. Leaving this neutered as is for now

import json
import win32com.client
import win32con, win32gui, win32print
import win32api
import os
import traceback