Skip to content

Instantly share code, notes, and snippets.

View hasherezade's full-sized avatar

hasherezade hasherezade

5.5k followers · 27 following
View GitHub Profile
@hasherezade
hasherezade / injection_demos.md
Last active March 18, 2024 05:12
List of my PE injection demos
@hasherezade
hasherezade / aes_crypt.cpp
Last active March 6, 2024 02:32
AES 128 - encrypt/decrypt using Windows Crypto API
#include <Windows.h>
#include <wincrypt.h>
#include <stdio.h>
#pragma comment(lib, "advapi32.lib")
#define AES_KEY_SIZE 16
#define IN_CHUNK_SIZE (AES_KEY_SIZE * 10) // a buffer must be a multiple of the key size
#define OUT_CHUNK_SIZE (IN_CHUNK_SIZE * 2) // an output buffer (for encryption) must be twice as big
//params: <input file> <output file> <is decrypt mode> <key>
@hasherezade
hasherezade / main.cpp
Last active January 31, 2024 11:56
Get PEB64 from a WOW64 process
#include <Windows.h>
#include <iostream>
#include "ntdll_undoc.h"
PPEB get_default_peb()
{
#if defined(_WIN64)
return (PPEB)__readgsqword(0x60);
#else
@hasherezade
hasherezade / test.reg
Last active December 31, 2023 19:26
Demo: persistence key not visible for sysinternals autoruns (in a default configuration - read more: https://twitter.com/hasherezade/status/849756054145699840)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
@="Rundll32.exe SHELL32.DLL,ShellExec_RunDLL \"C:\\ProgramData\\test.exe\""
@hasherezade
hasherezade / syscall_extractor.cpp
Last active August 30, 2023 21:47
Extracts syscalls list from NTDLL.DLL
#include <stdio.h>
#include <Windows.h>
// based on: https://www.evilsocket.net/2014/02/11/on-windows-syscall-mechanism-and-syscall-numbers-extraction-methods/
// author: @evilsocket
// modified by: @hasherezade
#define IS_ADDRESS_BETWEEN( left, right, address ) ( (address) >= (left) && (address) < (right) )
PIMAGE_SECTION_HEADER SectionByRVA( PIMAGE_SECTION_HEADER pSections, DWORD dwSections, DWORD rva )
{
@hasherezade
hasherezade / main.cpp
Created July 17, 2021 16:35
A native way to enumerate processes (alternative to: EnumProcesses, CreateToolhelp32Snapshot - Process32First - Process32Next)
#include <windows.h>
#include <iostream>
#include "ntddk.h"
bool enum_processes()
{
ULONG retLen = 0;
// check length:
@hasherezade
hasherezade / petya_skull.txt
Created April 22, 2016 14:49
Petya ransomware's ASCII art (skull)
uu$$$$$$$$$$$uu
uu$$$$$$$$$$$$$$$$$uu
u$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$$$$$$$$$$$$$$$$$$$$u
u$$$$$$* *$$$* *$$$$$$u
*$$$$* u$u $$$$*
$$$u u$u u$$$
$$$u u$$$u u$$$
*$$$$uu$$$ $$$uu$$$$*
@hasherezade
hasherezade / peb_lookup.h
Last active May 5, 2023 07:47
Search module in PEB
#pragma once
#include <Windows.h>
//here we don't want to use any functions imported form extenal modules
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;// +0x00
LIST_ENTRY InMemoryOrderModuleList;// +0x08
LIST_ENTRY InInitializationOrderModuleList;// +0x10
void* BaseAddress; // +0x18
@hasherezade
hasherezade / GzipSimpleHttpServer.py
Last active January 18, 2023 14:11 — forked from bkeating/GzipSimpleHttpServer.py
Python's SimpleHttpServer, but w/Gzip support. 🤙
#!/usr/bin/python3
"""Simple HTTP Server.
This module builds on BaseHTTPServer by implementing the standard GET
and HEAD requests in a fairly straightforward manner.
"""
__version__ = "0.7"
@hasherezade
hasherezade / PesieveLdr.go
Last active January 6, 2023 02:11
PE-sieve scan in Golang
package main
import (
"fmt"
"syscall"
"unsafe"
)
var (
peSieveDll = syscall.NewLazyDLL("pe-sieve64.dll")