| import os | |
| import sys | |
| SECTOR_SIZE = 512 | |
| def main(): | |
| try: | |
| if len(sys.argv) != 4: | |
| raise Exception('Not Enough Arguments') | |
| else: |
| ///////////////////////////////////////////////////////////////////////////// | |
| // // | |
| // Universal well-known SIDs // | |
| // // | |
| // Null SID S-1-0-0 // | |
| // World S-1-1-0 // | |
| // Local S-1-2-0 // | |
| // Creator Owner ID S-1-3-0 // | |
| // Creator Group ID S-1-3-1 // | |
| // Creator Owner Server ID S-1-3-2 // |
Mshta executable is invoked and calls the WldpGetLockdownPolicy function.
It sets the WLDP_HOST_INFORMATION members to:
dwRevision = 1 and dwHostId = WLDP_HOST_ID_GLOBAL (1)
This checks the state of a lockdown policy
Checks the registry for the CLSID of the mhtml dll.
RegOpenKeyExA(HKEY_CLASSES_ROOT, "clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", 0, 1u, &hKey)
FSD - File System Driver: A Driver that implements a File System
FCB - File Control Block: Uniquely represents an open, on-disk object in system memory. (a similarity to vnodes in UNIX). When an object is successfully opened in the Object Manager, an FCB is created by the IO Manager.
CCB - Context Control Block: A CCB is created by the FSD when a successful open operation in made by a user mode program. A Handle is returned and the CCB is a kernel representation of this handle.
| DLL utilizing ALPC | |
| Name: C:\Windows\System32\AudioSes.dll | |
| Name: C:\Windows\System32\CoreMessaging.dll | |
| Name: C:\Windows\System32\csrsrv.dll | |
| Name: C:\Windows\System32\daxexec.dll | |
| Name: C:\Windows\System32\DispBroker.dll | |
| Name: C:\Windows\System32\dps.dll | |
| Name: C:\Windows\System32\dwmapi.dll | |
| Name: C:\Windows\System32\dwmghost.dll | |
| Name: C:\Windows\System32\dwminit.dll |
| HANDLE curHandle = nullptr; | |
| NTSTATUS status; | |
| ULONG dwLen = 0; | |
| UNICODE_STRING strProcNameBuffer = { 0 }; | |
| PUNICODE_STRING ucBuffer = nullptr; | |
| //enumerate next processes, use flag 1 to enumerate the processlist backwards | |
| while (NtGetNextProcess(curHandle, MAXIMUM_ALLOWED, 0, 0, &curHandle) == STATUS_SUCCESS) | |
| { | |
| status = NtQueryInformationProcess(curHandle, ProcessImageFileName, 0, 0, &dwLen); |
| import string | |
| import random | |
| import os | |
| def gen_domain(seed): | |
| multiplier = int(0x41C64E6D) | |
| #seed = 1600000 | |
| domain = "" | |
| ebx = seed |
| /* | |
| * Small p2p chat program using raw udp sockets | |
| * by: Greg Lindor | |
| */ | |
| #include <unistd.h> | |
| #include <stdio.h> | |
| #include <string.h> |
| /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ | |
| /* THIS FILE IS AUTOGENERATED! */ | |
| #ifndef __OPENSNOOP_BPF_SKEL_H__ | |
| #define __OPENSNOOP_BPF_SKEL_H__ | |
| #include <stdlib.h> | |
| #include <bpf/libbpf.h> | |
| struct opensnoop_bpf { |
| #!/usr/bin/env bash | |
| # --slave /usr/bin/$1 $1 /usr/bin/$1-\${version} \\ | |
| function register_clang_version { | |
| local version=$1 | |
| local priority=$2 | |
| update-alternatives \ | |
| --install /usr/bin/llvm-config llvm-config /usr/lib/llvm-${version}/bin/llvm-config ${priority} \ |